urelas | 5f701aba08806f6f361b4fe17f362d94a00cbf7517b75b1161dcedf7cca0afc6

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_c583aed453a5c3b2c61d049af9352a3b_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 787KB
Sample261109-yec4qset8y
SHA256 5f701aba08806f6f361b4fe17f362d94a00cbf7517b75b1161dcedf7cca0afc6
MD5 c583aed453a5c3b2c61d049af9352a3b
SHA1 12b2ede04c16684a2eedae40e8bb32cb3ccb0e34
SHA512 2131d5900925b194ee5d6c7f99e85daffdceca43b30883aafb89c5b124522420e1c7e34983ef3ce9b5167b973dd8886de95260dad07f95416519fe9bf8d5ce7b
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEg8:d7dLBftJLW5YUWLrkJB0PJg8
TLSH
T1850501213480C43AF71A07354445EAE44E7ABC7B18D1A65FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Custom signature

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/4712-0-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000016b43-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2228-18-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4712-22-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2228-32-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3932-33-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3932-34-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3932-53-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 3 IoCs

pid	Process
2228	petue.exe
3932	sudydy.exe
2792	emjof.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4288	cmd.exe
708	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sudydy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sudydy.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_c583aed453a5c3b2c61d049af9352a3b_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	petue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sudydy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe
2792	emjof.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2228	4712	2026-11-09_c583aed453a5c3b2c61d049af9352a3b_amadey_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 4712 wrote to memory of 4288	4712	2026-11-09_c583aed453a5c3b2c61d049af9352a3b_amadey_elex_rhadamanthys_smoke-loader_stop.exe	92
PID 2228 wrote to memory of 3932	2228	petue.exe	94
PID 3932 wrote to memory of 2792	3932	sudydy.exe	95
PID 3932 wrote to memory of 708	3932	sudydy.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-11-09_c583aed453a5c3b2c61d049af9352a3b_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_c583aed453a5c3b2c61d049af9352a3b_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\petue.exe
  "C:\Users\Admin\AppData\Local\Temp\petue.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\sudydy.exe
    "C:\Users\Admin\AppData\Local\Temp\sudydy.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\emjof.exe
      "C:\Users\Admin\AppData\Local\Temp\emjof.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 3f0ec44c0de3bf75d64595f958f6ed1b137aea7e30d9d3982c87cf2cb726a618
MD5 279573e36aa10decca38e8915a42d71b
SHA1 59d5177f6b1f7f1cc23cee52bc3aeba1975eebab
SHA512 d6673b6c9571a3500af4aa4e062a8861152db4d57c3852881f6838722034840fb25748f3836e9c1c1aa3d0a686af58a68561e4a5d54e7ffc889adca9039992c4
TLSH
T16DE09202016EE9770108D01B86F9E84DC1609BE87ADA37757750CA5D21E1C5EB6A2346
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 fd5ffcb9fd14947d75fb4dc2c2aefe5086fb9a51532ecb6fd04e5a261939fa9b
MD5 b8294b2188f2edf76427ed8d81d3f66b
SHA1 ba59d40bff7650cafb9d728152ebe4e069ee8500
SHA512 48b7cf1eb673690aae56294cde7c3ce2a9f40fc49a7dd0179b258e6cb8d3cad2b36a8036b10acd8cff3d2730f65165d86f64eca6b0f52fc058e7b34f061be4b6
TLSH
T176D0C71181D6EB9E0448913B0AB661CDD0754C5C7F973B119B26C48C31D581DF5C7342
MD5 SHA1 SHA512 TLSH

Submit Download

emjof.exe

Path C:\Users\Admin\AppData\Local\Temp\emjof.exe
Size 601KB
SHA256 f115154f6c156f71c39c8b9ce07e008edd1b393ec9db7b794998007c86c5b8cd
MD5 f32841329655790428acb79fe65dfefe
SHA1 8173152938da11c2ee8e05b99126d2389fe638d6
SHA512 2d0ceb4f39b58db83ccafee1a80d38649efe6f4c156755093d9c009495c2f05c93ab824d2b3dbf14f678d7218461eab4a70a04548ddc4a1e9f6852d0ebcd116c
SSDEEP 12288:g0/ofE9N0dFaDXAm8Ip9lNfgK4eLS9xHAyZq/G7yq/yWq4qe4MJuC6Pmd:gBfCIFaUmplN4K/sxgyZ9u2JpL4MJuC1
TLSH
T13FD4238FE3953634FD09677398FE83211128AEDC46854D9262D729CAD6B718F8F68708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 19cd698e9125da03f3a006172ca226bee6e8dfde1724b0682068e393e0c1b007
MD5 70b9381690f281eb703763b87f73bb35
SHA1 fbdab5048317c30b7474772ce1a034aac7c3d498
SHA512 f50b20c5045ef0f4e981ae6ff9639d0a68dcd42b337176a5019c3b26a74d0e0ce89f960013d2276c3718b4bde7438a24035ab8c846ca6c6e9b661aecdb6084a8
TLSH
T1E9F022CB32B2F00A3302EB23E3C023CE23830C882E03ACA8000A32B08C3AC3C8000380
MD5 SHA1 SHA512 TLSH

Submit Download

petue.exe

Path C:\Users\Admin\AppData\Local\Temp\petue.exe
Size 787KB
SHA256 85b2a47f232fbd84cddc0114d2c1140a8b28f73827b70dce72bcb5a4dcaedb41
MD5 9bfe18def69eebeb938364481d3a0f1a
SHA1 86082919da96da7f9f2753c28a6ca85926e79276
SHA512 c92af923d6bb75720bd4dd1364cd42a3c36693ae01e3099618dca1a98cf0da6eafc4ae678f136820c8829602ca0a1a2866d4ae7c53c4b38616e48d8b3881ff40
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEgf:d7dLBftJLW5YUWLrkJB0PJgf
TLSH
T1F10501213480C43AF71A07354445EAE44E7ABC7B18D1A65FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-32-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/2228-18-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/2792-50-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/2792-56-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/3932-34-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3932-33-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3932-53-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4712-22-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4712-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4712-3-0x000000000041C000-0x000000000041D000-memory.dmp

Download