urelas | 608ea07e22d4db5dd8a254cf623be0e46bf0ac2d16f0812e01e2590968ce75f8

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_06d00dab269a82617379467ebe7bec1d_amadey_elex_smoke-loader_stop.exe
Size 586KB
Sample261109-q1ssbax18q
SHA256 608ea07e22d4db5dd8a254cf623be0e46bf0ac2d16f0812e01e2590968ce75f8
MD5 06d00dab269a82617379467ebe7bec1d
SHA1 fa853549e793717e9a51c8032b37bbaee9aac4f6
SHA512 c113ea5aba3525b5c3d0af4517cd4aec2ac4b58db8b3c1b9b07151a840116a138418354e6f03619410294957aa8d99f5fecc207541a2d273711df4c90353e085
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgtE:SnPfQpziAkI09HLMga
TLSH
T15CD4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
4876	byqib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4348	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_06d00dab269a82617379467ebe7bec1d_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	byqib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 4876	2896	2026-11-07_06d00dab269a82617379467ebe7bec1d_amadey_elex_smoke-loader_stop.exe	89
PID 2896 wrote to memory of 4348	2896	2026-11-07_06d00dab269a82617379467ebe7bec1d_amadey_elex_smoke-loader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-07_06d00dab269a82617379467ebe7bec1d_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_06d00dab269a82617379467ebe7bec1d_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\byqib.exe
  "C:\Users\Admin\AppData\Local\Temp\byqib.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 4cf5bfdc8c18da3e85f22a665385a2d9b05826cd031f2ab71e18fc27cbdd6112
MD5 5432426d33495619d7241e3ecf6877fa
SHA1 7799b662ee0208cff76f4474ce5cebc531472753
SHA512 6b9f52202805e89ccc8191c228bf3ad2728198a03c99de75a5091bb7f16593643fddb05fdd13b1582ba8a8443da71b6269cbb70f230d84a0c10712def337d886
TLSH
T15DE0DF55019FEE6A0804D01B0AB7B48EC0A258D83F423720A316C2CC12E542EFAE2282
MD5 SHA1 SHA512 TLSH

Submit Download

byqib.exe

Path C:\Users\Admin\AppData\Local\Temp\byqib.exe
Size 586KB
SHA256 9d031dcd3e8b3beeaba2357aa210998d1c9c979bfb453ff10a328a92e71ca71a
MD5 9014d388649e727c3d6adb027dd212ff
SHA1 e6dbf8547e182dbc3445935cb2efc0f59283ffb9
SHA512 a4f1f09fd017fa1d72051ee11c3f46a482d7111963bb3887ad398996ca2a67d6ff065890b94dac784c0d1f965df723fe2a10e57f4da411127a8901150703592f
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgtk:SnPfQpziAkI09HLMgm
TLSH
T1A7D4C0243790C072E3662B754896F7B51BBA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 5547f61a066786c8cd9b76f7a0e9094d776b4d0d2b22fbd272d11cd2809d550c
MD5 14f9adb410820e3a3d39ed672e9ebf1a
SHA1 a15083e5595905b5483fd1aa7ef735642c1f2bba
SHA512 7574d519595ec99e2d1c1fd23280c273ad9bcc17ec49799fb1e21b0a07f9ff89d55f9ad1cc8eaf97acf7ce1440971473ede9661cec0e5a82caee2821fa22bcb4
TLSH
T167F02BD631A0F0A5F61EF308C3A01F4003830C4827834C40020534308C33C5C80D8316
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2896-0-0x0000000000130000-0x00000000001FF000-memory.dmp

Download

memory/2896-1-0x0000000000159000-0x000000000015A000-memory.dmp

Download

memory/2896-20-0x0000000000130000-0x00000000001FF000-memory.dmp

Download

memory/4876-13-0x0000000000CF0000-0x0000000000DBF000-memory.dmp

Download

memory/4876-21-0x0000000000D19000-0x0000000000D1A000-memory.dmp

Download

memory/4876-24-0x0000000000CF0000-0x0000000000DBF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads