urelas | 449dfb0902a91feff14ff7d3effcbfc306ee2167d5498e411ded20fb6d01c891

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/11/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-05_a044d3d554c5f1578ab9dcd2890658c5_amadey_elex_smoke-loader_stop.exe
Size 803KB
Sample261106-rtgxxaca97
SHA256 449dfb0902a91feff14ff7d3effcbfc306ee2167d5498e411ded20fb6d01c891
MD5 a044d3d554c5f1578ab9dcd2890658c5
SHA1 7c400d853fb1d6ef16dffae6fd0fd2533bef8d5f
SHA512 9e031742e5af17fe42bc7aec0d45cddb7dcea9fa2e53c41abdf27c647f576e0c57df584f0be5513f6aa6c368a185e1eb907a240e00fd90843d5f906611eb015f
SSDEEP 12288:dccNvdRExZGe+Q1nzPlgqmoWkI09HPZkioN:dnPfQpzNgqAkI09HL4
TLSH
T1BF05C0243B90C072E3662B754896F7B517BA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
3944	cibol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4752	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-05_a044d3d554c5f1578ab9dcd2890658c5_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cibol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3944	4816	2026-11-05_a044d3d554c5f1578ab9dcd2890658c5_amadey_elex_smoke-loader_stop.exe	89
PID 4816 wrote to memory of 4752	4816	2026-11-05_a044d3d554c5f1578ab9dcd2890658c5_amadey_elex_smoke-loader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-05_a044d3d554c5f1578ab9dcd2890658c5_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_a044d3d554c5f1578ab9dcd2890658c5_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\cibol.exe
  "C:\Users\Admin\AppData\Local\Temp\cibol.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 6bb7bc3ab366492e5386b42844cf52555813cf0bd14124d611768b927995d928
MD5 c9b55d2c9db02518d5c5d5d6ae757a9d
SHA1 9b788bd146c5503e6b9e5a6740873c74dc16100a
SHA512 99bea3b2b383472a90399f96f2406363a1dcb361558f78619c8c5884cc3526c506fa3b037525722161f9dc8cf64e41e7795fa6ab6f038f0f923d90e52a3d100f
TLSH
T12AE0200142ABED6E0404D42705F97C8EC0784DEC3F663761B215C24C32D746DF4D7602
MD5 SHA1 SHA512 TLSH

Submit Download

cibol.exe

Path C:\Users\Admin\AppData\Local\Temp\cibol.exe
Size 803KB
SHA256 ebffcadc2acc9332cf0a2362bc45b36d90bb2a0bbb9000f2dd98b8d13642f615
MD5 76063fd575682e6c2f964240abe8bcda
SHA1 21a321ec1f37c93ab4b8413c97844988727ce9d8
SHA512 bb01174212ed4a89b6db2d261efc510277a0fc7c13258e7c4c462155ac3032ec0a55170b53ae58e94cce7a183b7dfcb7cc478c60db298b8088fb32aaeac538f4
SSDEEP 12288:dccNvdRExZGe+Q1nzPlgqmoWkI09HPZkiov:dnPfQpzNgqAkI09HLu
TLSH
T15E05C0243B90C072E3662B754896F7B517BA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 72bdaa73d569ba7519b4140e51a94f6923205f30b5ec6024b876ce98fb8c7b63
MD5 3f02b421ff12fd291a154bcb1a87988b
SHA1 ea7386211f427f2cb690a15784c93c8de3028b5e
SHA512 79711da93f5495bb5386b53859ece9d490b600500c3b7d61901b700fd4f90bd8f29ef65ebe50f66e5dddc179ae77d82a9f25592034f33353286e9710aaad3454
TLSH
T17EF09BDA31A5F1553712E213E3D41BD42B930D58194B9E58474579704DF5C3CC458365
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3944-14-0x0000000000B69000-0x0000000000B6A000-memory.dmp

Download

memory/3944-13-0x0000000000B40000-0x0000000000C0C000-memory.dmp

Download

memory/3944-24-0x0000000000B40000-0x0000000000C0C000-memory.dmp

Download

memory/4816-0-0x0000000000010000-0x00000000000DC000-memory.dmp

Download

memory/4816-1-0x0000000000039000-0x000000000003A000-memory.dmp

Download

memory/4816-21-0x0000000000010000-0x00000000000DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads