urelas | 697c224ca3586a60065f2fcab4f0f60f4151251570bb28e4ca23624639077805

Analysis

max time kernel
150s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 4.2MB
Sample261107-e5axhsaw9k
SHA256 697c224ca3586a60065f2fcab4f0f60f4151251570bb28e4ca23624639077805
MD5 36fd9f998a7c3385465f702b7d42b72e
SHA1 e106930392d0761c635bf69bb66a5e94d1c80e1c
SHA512 d9dfdf17f50b069987a1fc1135e9377d9e867647ac73eb91f192c332b280068069b7ca66fb02ae6b6e8607f3d2c6057961273c955cf3148667ea24bbbd5fcbd7
SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwu:ScRH6z5eG6wZM8HHQkaYN
TLSH
T1F016D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Custom signature

Detects executables referencing many IR and analysis tools 9 IoCs

resource	yara_rule
behavioral1/memory/3316-2-0x0000000000400000-0x000000000084E000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x000800000002440f-6.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/780-15-0x0000000000400000-0x000000000084E000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3316-17-0x0000000000400000-0x000000000084E000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/files/0x0007000000024415-25.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3916-26-0x0000000000400000-0x000000000084E000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/780-27-0x0000000000400000-0x000000000084E000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3916-28-0x0000000000400000-0x000000000084E000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3916-42-0x0000000000400000-0x000000000084E000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	pimoi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	ciyfiv.exe

Executes dropped EXE 3 IoCs

pid	Process
780	pimoi.exe
3916	ciyfiv.exe
1932	eclev.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4648	cmd.exe
3540	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ciyfiv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ciyfiv.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ciyfiv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eclev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pimoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe
1932	eclev.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 780	3316	2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	83
PID 3316 wrote to memory of 4648	3316	2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	84
PID 780 wrote to memory of 3916	780	pimoi.exe	86
PID 3916 wrote to memory of 1932	3916	ciyfiv.exe	98
PID 3916 wrote to memory of 3540	3916	ciyfiv.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-05_36fd9f998a7c3385465f702b7d42b72e_amadey_elex_glassworm_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\pimoi.exe
  "C:\Users\Admin\AppData\Local\Temp\pimoi.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Users\Admin\AppData\Local\Temp\ciyfiv.exe
    "C:\Users\Admin\AppData\Local\Temp\ciyfiv.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\eclev.exe
      "C:\Users\Admin\AppData\Local\Temp\eclev.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 ec97aff0c0ca5670ea148a03b50a0ad5510b773f7f578f53be28154ee11c625a
MD5 00f530552283230a86eb5ae4ea05dd01
SHA1 031d02fce43c12edf563ea86edb5d6aa69ec8cc3
SHA512 11db1de47f529b37d37a4de91613133dfdcc1292795c4c4f168edf1a79b99319063408f23437907dc855bd8554b0ca6edef93c1326423ffebfef62a55c129dce
TLSH
T1D1D0C71243DAD7AE0448D42B0AB6618DC0754D6C7F873B15DB25C44C31C141DF5D7342
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 458B
SHA256 a598ba437b563dbbc84b0bb72262416702a27544224acb3584fd74baae10329f
MD5 533788023690e496d91d13b2acdd936e
SHA1 912db45a1a6cb4e8833816fb05429063635efceb
SHA512 67225e78c3f96d479a9de8bd4f7b44590c6c87c8ed99ec4217f7604de43cc5d7894e0e7adf1194472194e66f578e3a189d7656b3b6fe74bc441ffb0b1427f44e
TLSH
T1E1F05C01019BCD66011CC41B05F8744E81958CAC7F9327F5A730C61E22DAC6FF492601
MD5 SHA1 SHA512 TLSH

Submit Download

ciyfiv.exe

Path C:\Users\Admin\AppData\Local\Temp\ciyfiv.exe
Size 4.2MB
SHA256 d96d2dea68727e09e5dbc8bd45c5e8f44bced3df46b993d8fb79f944db4f0f5c
MD5 10fd447d536aa394090dad7964bf22e4
SHA1 a6c3237b817ef14dec7e6472405d65869bffa7bc
SHA512 368c66a431b9816c8d9243182562a3d4e307413284cc1f646a3d567b48b00918b1ea7192b5768b5d9e98fe00ef725b36ff09556eb1731955136b15578ed40fdd
SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwM:ScRH6z5eG6wZM8HHQkaYL
TLSH
T1AD16D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eclev.exe

Path C:\Users\Admin\AppData\Local\Temp\eclev.exe
Size 223KB
SHA256 90bf5d0e2edf238da2f621b1e132124858278074544b19f5491e522b81bcbe37
MD5 e6f6376dc4ad5e8e1d63a78ac0e62e2a
SHA1 094fdcdd938aa713087cae2b88042e7aba23a50a
SHA512 ec181201913848c612ef3a1adc995d68075993f38afe278c2c19a17432c4ba118a73f6a429c506594ecff3f5c45addb7ac2346e1293d3919292fa10eeeb9ef94
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3W:unFhSIkAyDgjtS/FZo
TLSH
T1E724E042AA018888F38C4B316A17FAE449858D3C59D5F55FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 d24a915d2adb5c09f9b96813102802a0a1338a9a6c23f8eeb7ff034d58f595a8
MD5 825a80ceac97cb8dc183ab5724d2dde1
SHA1 399d28e0d88ad46c7ea03a56068bdb4603035820
SHA512 5cf1cbe299b1746fd6fdeb7e3ef2d95f576decdc5dcb785e0841cad028f987696a461eba6868e6b44dcf80f9e84683f1ff2ac963ed4b1913c36fef6913873af4
TLSH
T194F02BE91068F0243A12E727C3A00BA60FC31D4C2DC3CC44014431708835C1C44843D3
MD5 SHA1 SHA512 TLSH

Submit Download

pimoi.exe

Path C:\Users\Admin\AppData\Local\Temp\pimoi.exe
Size 4.2MB
SHA256 71e8c54e92d8d42312187dfe53652b9183032e11c126c19b3b8e62a4d452efb9
MD5 473a4799523ee9ce4c99ded61e6c83af
SHA1 935fb488dddfd7ae8338f4484ea4afdf86774cd9
SHA512 eadab73a77035ed53534d9374a82cad1e2934c417e1f326561a2e3107c535f1996b58a3504c97a0d6d8ff2ff66d973e553072eb9673bfb4d16e49342efeb3c7b
SSDEEP 24576:0aEcRxp6zm9we/6MMh3Qh3OFZr8Eu8MdoHQhUp5DBMYjvDwq:ScRH6z5eG6wZM8HHQkaY9
TLSH
T1A616D31173F94895F6F36B30AEB081555F36BDA89EF6C62D3144128E0DB6A50BE31B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/780-27-0x0000000000400000-0x000000000084E000-memory.dmp

Download

memory/780-15-0x0000000000400000-0x000000000084E000-memory.dmp

Download

memory/1932-44-0x0000000000330000-0x00000000003D0000-memory.dmp

Download

memory/1932-39-0x0000000000330000-0x00000000003D0000-memory.dmp

Download

memory/1932-45-0x0000000000330000-0x00000000003D0000-memory.dmp

Download

memory/1932-46-0x0000000000330000-0x00000000003D0000-memory.dmp

Download

memory/1932-47-0x0000000000330000-0x00000000003D0000-memory.dmp

Download

memory/1932-48-0x0000000000330000-0x00000000003D0000-memory.dmp

Download

memory/3316-17-0x0000000000400000-0x000000000084E000-memory.dmp

Download

memory/3316-2-0x0000000000400000-0x000000000084E000-memory.dmp

Download

memory/3316-3-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/3916-26-0x0000000000400000-0x000000000084E000-memory.dmp

Download

memory/3916-28-0x0000000000400000-0x000000000084E000-memory.dmp

Download

memory/3916-42-0x0000000000400000-0x000000000084E000-memory.dmp

Download