urelas | 76f9e9f6aa37f7624da29353b612ff27c86dc428ad7393eb1e4b75856c8cb036

Analysis

max time kernel
149s
max time network
83s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_0cddeb9347a63f8196236a241685a5b2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 694KB
Sample261109-qje5wsfg34
SHA256 76f9e9f6aa37f7624da29353b612ff27c86dc428ad7393eb1e4b75856c8cb036
MD5 0cddeb9347a63f8196236a241685a5b2
SHA1 78f5e4d26ebb0bc7c669532cd33e9dd5561282ea
SHA512 7faaedc58368c48eced746ff1b296532aad37d36ec832f95f7846a70d6d1d74bd822f6eaeed0120fa45f567b8593be977f9250c6d1598240ab7b7a2b59820990
SSDEEP 12288:LUyI6hJQglQA0IWb8DmPySxEuBZDxywHBlP94jpguwDxXlZ1nr0:dVh6gl6Iy8R9+ZdnnP94jpgl9Bnr0
TLSH
T16DE4F1216140C038F3AA077689A2E1E51A297DB85790E58FF7E87DB65A311D79B3330F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Custom signature

Detects executables built or packed with MPress PE compressor 3 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5e3-31.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3752-38-0x0000000000400000-0x0000000000596000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3752-48-0x0000000000400000-0x0000000000596000-memory.dmp	INDICATOR_EXE_Packed_MPress

Custom signature

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/1604-0-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5e1-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5052-18-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1604-21-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5052-23-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5768-24-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5768-26-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5768-45-0x0000000000400000-0x00000000004B3000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 3 IoCs

pid	Process
5052	sawid.exe
5768	kenoka.exe
3752	eryfu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3088	cmd.exe
924	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kenoka.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	kenoka.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_0cddeb9347a63f8196236a241685a5b2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sawid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kenoka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eryfu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe
3752	eryfu.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 5052	1604	2026-11-07_0cddeb9347a63f8196236a241685a5b2_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 1604 wrote to memory of 3088	1604	2026-11-07_0cddeb9347a63f8196236a241685a5b2_amadey_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 5052 wrote to memory of 5768	5052	sawid.exe	93
PID 5768 wrote to memory of 3752	5768	kenoka.exe	94
PID 5768 wrote to memory of 924	5768	kenoka.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-11-07_0cddeb9347a63f8196236a241685a5b2_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_0cddeb9347a63f8196236a241685a5b2_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Local\Temp\sawid.exe
  "C:\Users\Admin\AppData\Local\Temp\sawid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Users\Admin\AppData\Local\Temp\kenoka.exe
    "C:\Users\Admin\AppData\Local\Temp\kenoka.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\eryfu.exe
      "C:\Users\Admin\AppData\Local\Temp\eryfu.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 bd11d96398b3c1c7660bd1dd69369c40b0fe4cfbfe821b27224a1e9393b6ae01
MD5 92c5e864caef28b3b1311afb5752e01f
SHA1 04938b30663dcc023cd2b3b30b782179c8aa2b9f
SHA512 00cf8d21e1f9ed6ffe7f7766ddf21f4ce294915403733f1cae22bf0f872d9cca5197b8c58aeaeb3e07732661798b450a73f1028fbb9d653517c8a0545034cada
TLSH
T1C8E0D80141EEDA66014CC01F06B6A44F81B095A8BF9A37A5B611D74D72D282EF9B2762
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 ccd1462fe765be10767dfe33d99d94a70ba9d12d1567d462172b96eab2c6bbd7
MD5 42f4576160b66c3978a345271e3c6a9e
SHA1 4b95dbd5eb437e99e2725af71afebdbd9be34307
SHA512 88a028df388fefe910577bc360cb779fb625f11e6c632fc25a1f6159af99a52d5c030732b6eb5d3e9aafc3005e06215c908e6ff39fd126219dd80ea51cf841ce
TLSH
T168D0C71141D6D75E444C902B0AB5618DC0754CAC3F4B3F51972AC54C21D545DF5C7351
MD5 SHA1 SHA512 TLSH

Submit Download

eryfu.exe

Path C:\Users\Admin\AppData\Local\Temp\eryfu.exe
Size 469KB
SHA256 6f66d3a01ff121cc942cf3292c5b3f75992df00a40d4e3cfdcf55c64f63d34bb
MD5 75a51e88e84fdc83fd4997907d7f8ba5
SHA1 65d277c69c723d50cd2da2bc9942ee531f54a822
SHA512 84ce09a42e04603bd7c71346e82658a5969ec61cadcd3b819c246b765d833719b0fbf548d4517a03688b52a9d928690d8fa3b7b5d4f4b7f65c45cf72bfdee63f
SSDEEP 12288:RIbnq5ORFftIiB6gBFvST9kFO14SFoktWEY+ucXz+J6nJELcUmQ+7A:RIbq0ft8gLvoko1hmkQ5cXzyvL/f
TLSH
T151A4238E0D48B305EB396637379E3F48A130DE12C10A6B3766EDF1696F732506D921E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 fcf332fccd77baf7c508f651bfdc6029a577dc9286ca57f591076b8f5bb58a7f
MD5 a5fd2c65e5e8a7a1feee4a72fc89a52f
SHA1 1403dfa08622f88d3e3fe51effeb1e62deb31ac4
SHA512 219dfde1a8b05384037114da54a577dc5f70b154613d30becbfac56e8697e06c76846289d887e22860a22348b29714447a33cb6ff52afda1998ec75c60410591
TLSH
T15FF08CC61474B0943A01F612E3800BE623A34E886EC78C700114F1304D3681C8054212
MD5 SHA1 SHA512 TLSH

Submit Download

sawid.exe

Path C:\Users\Admin\AppData\Local\Temp\sawid.exe
Size 695KB
SHA256 4028bfbb9638552a5d90673db02b7c5b7ef6637c2ca515428c71c0f330f71a74
MD5 89774102d0b404c663e41ab0949c4c5f
SHA1 36cdb93b0a54fcaccb596b51e54e835c6f799e02
SHA512 08ece2756daa44270c4f79e563993eb350cd8d461e3b9d592c7e70db816a96cc7b7f5acbebb299d02c39abe26f67aa458d0ae9b4bc51fd42c39aa33f009a0fd9
SSDEEP 12288:LUyI6hJQglQA0IWb8DmPySxEuBZDxywHBlP94jpguwDxXlZ1nrT:dVh6gl6Iy8R9+ZdnnP94jpgl9BnrT
TLSH
T120E4F1216140C038F3AA077689A2E1E51A297DB85790E58FF7E87DB65A311D79B3330F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1604-21-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/1604-2-0x0000000000423000-0x0000000000424000-memory.dmp

Download

memory/1604-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/3752-38-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/3752-48-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/5052-18-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5052-23-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5768-24-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5768-26-0x0000000000400000-0x00000000004B3000-memory.dmp

Download

memory/5768-45-0x0000000000400000-0x00000000004B3000-memory.dmp

Download