urelas | 7f3bfb31e7709655bd7b7552b4e07b001d3040130ea0e3deef0227eea0cff59d

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_9166f2473188ad0155516e11eb54e062_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 450KB
Sample261110-ag1qtabd96
SHA256 7f3bfb31e7709655bd7b7552b4e07b001d3040130ea0e3deef0227eea0cff59d
MD5 9166f2473188ad0155516e11eb54e062
SHA1 a3913e688f8f503f41747853a7796fa403d93615
SHA512 5a58a4c18c173a9ffcd4a0f787c51f5141609e9ebba317fbe00584eb3def9d160bb7c266a0e233258d744c1f94a802a7a9b7e8545b4c94e0fe9fe491b8d29527
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoBj:PMpASIcWYx2U6hAJQn9
TLSH
T154A4AD147640D4B6E31A0B310456EAF049A9AC3A17D9E48FF3387E766A311D3977B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 3 IoCs

pid	Process
4336	fybuh.exe
4768	humyso.exe
5200	jugee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4632	cmd.exe
4352	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	humyso.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	humyso.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_9166f2473188ad0155516e11eb54e062_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fybuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	humyso.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jugee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe
5200	jugee.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4336	4188	2026-11-09_9166f2473188ad0155516e11eb54e062_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 4188 wrote to memory of 4352	4188	2026-11-09_9166f2473188ad0155516e11eb54e062_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	91
PID 4336 wrote to memory of 4768	4336	fybuh.exe	93
PID 4768 wrote to memory of 5200	4768	humyso.exe	95
PID 4768 wrote to memory of 4632	4768	humyso.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-11-09_9166f2473188ad0155516e11eb54e062_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_9166f2473188ad0155516e11eb54e062_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\fybuh.exe
  "C:\Users\Admin\AppData\Local\Temp\fybuh.exe" hi
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Users\Admin\AppData\Local\Temp\humyso.exe
    "C:\Users\Admin\AppData\Local\Temp\humyso.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\jugee.exe
      "C:\Users\Admin\AppData\Local\Temp\jugee.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 9d343d030e13fc40d74453033e8e15fc715f99236cdea7d5c0bcd4dd790799b9
MD5 acf6d4fa2238b8c2387081d1cdb63385
SHA1 a6d67b874cb419a7b7afe0255680da42a8245db4
SHA512 8125663efaa214912b8fe4641d11d50426357a3a874a83df6f265597dcc7e1f08b6b44838d0845c1af55eaa58b629b9a3f89082e84bb047e9197078e38362123
TLSH
T107D0C71181D6D7AE0448902F4EB5658DC0755C5C3F873B519735C44C21C181DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 d2f7079c5de092c3058f0abbabe52d4ce06a7f1c372ae92505feb99f98750104
MD5 dad09f4682322be20ba039c5d3fe32b0
SHA1 b55d856782351cbddb2e29082b504d89f34b0943
SHA512 87370c764212ab4b1bde3fa77eb52ebb78a724935cf2aed197315e0272a0daaa6cd872fae9bd330e6562b86d2cb5f1e614c3a7399c6078cde232afb799b87ae0
TLSH
T178E02201819FDA3A010DD01B05B96A8FC09496687F9A3BB07310C24DA1E585EB2E6392
MD5 SHA1 SHA512 TLSH

Submit Download

fybuh.exe

Path C:\Users\Admin\AppData\Local\Temp\fybuh.exe
Size 450KB
SHA256 f4dbd90ef15c14a60792681928f9228f06b08b14f0ed0ac0524f9bd2388f3d7f
MD5 75b241ff42bfe365ac3d15c2a7ff85ce
SHA1 0033eb06d1e5b198f729d28e0ffbf1b0bd313d7f
SHA512 70f7378141afed7e3ce314b5703a18f7f93f222f97773421e0538fc0996f7542cf3185009db0b2d01de13129ea51f5a86a31eb2c129054428b2db71b97b3f165
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoB3:PMpASIcWYx2U6hAJQnt
TLSH
T1C5A4AD147640D4B6E31A0B310456EAF049A9AC3A17D9E48FF3387E766A311D3977B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 81a0d0faec137211fb210e88563de3c7e995bfaf92d0fbf7bf8b1ac54e822c59
MD5 9ef4dcda3b36e065abfa2521f6d32b1c
SHA1 ad614b8490c5024b2a8e4b7e19d7a8816914fa3e
SHA512 724c9ae786d1cb5b86c8766955377e01c4f5af22e4b889ad3950834c44adea53ee21b4c6f41688a1b194ccdd62ac55d9cfbe2d01c1490ee43994deefd2181afd
TLSH
T109F04CE11065A0557515E613F3A417D667E30E441F87DC444109B5709E76D7C4C04695
MD5 SHA1 SHA512 TLSH

Submit Download

humyso.exe

Path C:\Users\Admin\AppData\Local\Temp\humyso.exe
Size 450KB
SHA256 87272e56e6f3d3e424790ec1bf752d4c6b84c1b061728a3fbc194f173b274237
MD5 55d052ffc742b7e0cff99663921b578a
SHA1 13f54e27349ebc0c019af945f3393d00738bd56c
SHA512 8e76e39282458965bd000baa008174ecf3c085a6a97415350ddcf8df9e13bfd6fe0172ede189413f911c4844815a9badba22b89528df205d42d6e7f90058ddd2
SSDEEP 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpoBg:PMpASIcWYx2U6hAJQnm
TLSH
T1D9A4AD147640D4B6E31A0B310456EAF049A9AC3A17D9E48FF3387E766A311D3977B28F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jugee.exe

Path C:\Users\Admin\AppData\Local\Temp\jugee.exe
Size 223KB
SHA256 97c67271cf5dca5f6fe064fdfe81454c86e4dd0659daad2a9acdf209de914682
MD5 2cb9c154480112fc236659bd845c6b20
SHA1 f1329cfbc8e9a249024cb418d65512775ad371d2
SHA512 a565c3fca0db2aafb97df33a0186c203e1d8447ac1c29d51d9c9c6636acb5c2237881add9a33e1e38e5cc91b5d36033af26ba9388cef57c2c4e1c0fcf037afd5
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3L:unFhSIkAyDgjtS/FZx
TLSH
T17D24E042AA018888F34C4B316A17FAE449958D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4188-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4188-21-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4188-0-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4336-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4336-32-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4768-34-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4768-33-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4768-53-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/5200-44-0x0000000000590000-0x0000000000630000-memory.dmp

Download

memory/5200-55-0x0000000000590000-0x0000000000630000-memory.dmp

Download

memory/5200-56-0x0000000000590000-0x0000000000630000-memory.dmp

Download

memory/5200-57-0x0000000000590000-0x0000000000630000-memory.dmp

Download

memory/5200-58-0x0000000000590000-0x0000000000630000-memory.dmp

Download

memory/5200-59-0x0000000000590000-0x0000000000630000-memory.dmp

Download