urelas | c48f8ccd4a28071cbc7110fee286f30ad53cf938cd618944f0d7f8b2ba313e28

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/11/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_58615730cc2c146ba4f7c345b095b002_elex_rhadamanthys_stop.exe
Size 236KB
Sample261108-sem12sds3s
SHA256 c48f8ccd4a28071cbc7110fee286f30ad53cf938cd618944f0d7f8b2ba313e28
MD5 58615730cc2c146ba4f7c345b095b002
SHA1 d99e93aa9aa6d5d6b632314837fc142b475911df
SHA512 6a29499a5657be2ee1a27754b324adb6f404f4d82c2c4114f51a7b5a091f5578209946082e575f4dd2666b67ff8601018bc0f2641b88e74b759d2e5cb56ffe64
SSDEEP 3072:ARDHcD2npEcWILILEo/IGI7i65edpU+uQeX7IGCsXfi6ZEVjfZUg:Ad8gEcWiIL15FdpU+L+7y6fibX
TLSH
T1AF34381176008421F3590B315956FAE149A9AD3D19E8E08FF7B87E7A6D322C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
4272	huter.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-11-07_58615730cc2c146ba4f7c345b095b002_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3220	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	huter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	huter.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_58615730cc2c146ba4f7c345b095b002_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 4272	3452	2026-11-07_58615730cc2c146ba4f7c345b095b002_elex_rhadamanthys_stop.exe	89
PID 3452 wrote to memory of 3220	3452	2026-11-07_58615730cc2c146ba4f7c345b095b002_elex_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-07_58615730cc2c146ba4f7c345b095b002_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_58615730cc2c146ba4f7c345b095b002_elex_rhadamanthys_stop.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 e3832877c5daf6c70643fe4360ad7d987122cd3ff833b46cc54bf9f74f9a640d
MD5 b5b1bd5cd5fe7989395146eeb29b984a
SHA1 1c7e2dfeff3df9e5904b41764778169487361724
SHA512 ca7a703db4ca13c4e13c3a4ebe1015045935ee500b05b7514514e052208ff8e8e2a439b30030504d2ab93d0a79594f582b23659d579c3db4c9d920957e95389b
TLSH
T113F0928000A6F16D3116B102E006F77433229CEC050E6C8206E7B365663112C8088078
MD5 SHA1 SHA512 TLSH

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 236KB
SHA256 28a0a6d9cb2e76e935b117bf3112d6fa442b90ba1a22fd6b91587f89150aa542
MD5 3bbc0636a01bade1839de92f18fb2dcf
SHA1 66d7939b7a792a01c8f8a1bf28c70b4e97ef65cb
SHA512 04a41f2146ff8cf66a188a58b135eba499d77f2be5dbded250b790508d40d45efd7fb05df980659d0e0aa2fc67e92148eee4c007178195131409e58a85b19876
SSDEEP 3072:ARDHcD2npEcWILILEo/IGI7i65edpU+uQeX7IGCsXfi6ZEVjfZUl:Ad8gEcWiIL15FdpU+L+7y6fibM
TLSH
T16234381176008431F3590B315956FAE149A9AD3D19E8E08FF7B87E7A6D322C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 342B
SHA256 93c7e3c4cd1e94f0af8c610b4251b83ff97cae1bff47cad62fe1b575ff18b4e6
MD5 68cfdf02549b68862f9e15ea4242d5b6
SHA1 076346b3310a545ef9ee3bf5c90863a11dbe9547
SHA512 6cb3d17a5d537c270323806008cf5b1fc927362e0424407a0d14d40bf52bef78b625bdc4ed8c1d4a57111508e4b2c26a7aeb22b0e24c5af191d6c4803aee2ecf
TLSH
T1CFE08603509FEA1A455D943B09BEA28CC0A04DAC7E9A2F586B31C59831C680EB4D2A12
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3452-0-0x0000000000EF0000-0x0000000000F2E000-memory.dmp

Download

memory/3452-1-0x0000000000F04000-0x0000000000F05000-memory.dmp

Download

memory/3452-21-0x0000000000EF0000-0x0000000000F2E000-memory.dmp

Download

memory/4272-12-0x0000000000420000-0x000000000045E000-memory.dmp

Download

memory/4272-18-0x0000000000434000-0x0000000000435000-memory.dmp

Download

memory/4272-24-0x0000000000420000-0x000000000045E000-memory.dmp

Download

memory/4272-25-0x0000000000420000-0x000000000045E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads