urelas | 0a9470ca42601d782f790502c1a35b9fedbd3f4f6dc2032798b79e453d526a4d

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-06_d25e15c35ca929bfff6e7f0202549dd1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 354KB
Sample261107-2falsavzcy
SHA256 0a9470ca42601d782f790502c1a35b9fedbd3f4f6dc2032798b79e453d526a4d
MD5 d25e15c35ca929bfff6e7f0202549dd1
SHA1 e6f03872ce99591364f44a25c7e0f1bcd1e07639
SHA512 2e6d574ccbdfc5b2f49d2d5a097d715ca2f0cfd677141cd84bb0cb95161ed2051402aa9c9f79a14218e2b1c98dad4fcea605543cb9a6274870ed501741a50019
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZL:wd7rpL43btmQ58Z27zw3eZL
TLSH
T1C8748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
1648	quawq.exe
3664	asqiqu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1976	cmd.exe
5988	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	asqiqu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	asqiqu.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-06_d25e15c35ca929bfff6e7f0202549dd1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	quawq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asqiqu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1648	4400	2026-11-06_d25e15c35ca929bfff6e7f0202549dd1_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4400 wrote to memory of 1976	4400	2026-11-06_d25e15c35ca929bfff6e7f0202549dd1_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 1648 wrote to memory of 3664	1648	quawq.exe	92
PID 3664 wrote to memory of 5988	3664	asqiqu.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-06_d25e15c35ca929bfff6e7f0202549dd1_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-06_d25e15c35ca929bfff6e7f0202549dd1_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\quawq.exe
  "C:\Users\Admin\AppData\Local\Temp\quawq.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Users\Admin\AppData\Local\Temp\asqiqu.exe
    "C:\Users\Admin\AppData\Local\Temp\asqiqu.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 3c4e0594b017cdd298520e13fc8f3c5c9f9513e6ad6a8477ba36002cafd80823
MD5 dad8d67e452750db81840fc5dcf92d88
SHA1 3a918389a98555b58ff4531db0a1976f57017a55
SHA512 eaa86672a89df3ed5163973c19b39a33ee1ace804e5cd1659acff02996f91b1135a4007788433bee8734440ed400102f51220b1eb33e1a5400a7f3aa7e081bbe
TLSH
T167D0C71146D6E75F0858912B0AB6618DC0B54C5C3F573B159721C94C71D541DF5D7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 e13ce6973d2dff72f972de80bdea899388667ca684a09abbd096e591aa122e46
MD5 563e0d24eec9fc00477b21e898ed46b0
SHA1 92dfbd98af30a0b935d04536c2a7624008301f2e
SHA512 dfd67f11c3ecf0ab5bb0e3a9c9eb9c03467e77eb4f54342eb33cf9a2060a0c091596de9867dc5eec15d2f357294f9d27f86a76fbb58b8c0bea3a22e1a94606a9
TLSH
T160E06803808BEA2B008DE40F0AB9A44DC12259A87E4B3B787312C26C52D682EF5D2242
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 3deac22befd6a6d059b6d74f54b1e91fe5b9e5fbc2704851457a3b82844359ee
MD5 7df660e014713009081c072fd800417d
SHA1 fd2ef7d52d33f5df4282aef8cdb3e2aaf5b0dfab
SHA512 0837cd5bf68cef6888e296239b14f75d40b4885906ce09a94db7a08020b1d30d2edb1b86fa61d2b3d4bcde2cff5478203ddeca116ebd22fe404428303437e7bd
TLSH
T151F04CD61065F4453A12ED23D3B46BD023834D8D1987ADB4041C71204D79C7C8454356
MD5 SHA1 SHA512 TLSH

Submit Download

quawq.exe

Path C:\Users\Admin\AppData\Local\Temp\quawq.exe
Size 354KB
SHA256 876068196ace70986000e773423d5b3afe3300187bbfcf3a6265dfe5742feba5
MD5 2ea3b79eaa0dfe031e612d005d9a022a
SHA1 e241ecd1ebca3877fca8c04eca24cabe5bc15743
SHA512 e3c75acbc398a5fce233895be22825cba6a4565db95962dce9e475c4e2a18ca16a62cf04bca453c6e4bc0700e3af956246a27260d44bf76dab8d80fb0e4e14af
SSDEEP 3072:wdXi+V5Kgxpdxj8gbib20xTyst542t8ZHWBow8+zoB91wDKCZX:wd7rpL43btmQ58Z27zw3eZX
TLSH
T14D748D253580C475F32A07314446EAF00A66BC391A99E54FFBB8BD79AD311978B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1648-14-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1648-24-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3664-25-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3664-26-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3664-35-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4400-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4400-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4400-21-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads