urelas | dbad3470e0a4e4d6510f754974e3f14bce2af4345007dd9c4ba68e5dcc170bc0

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_919775170182fd65b2f2c48c77761328_elex_rhadamanthys_stop.exe
Size 241KB
Sample261110-agbrpabd89
SHA256 dbad3470e0a4e4d6510f754974e3f14bce2af4345007dd9c4ba68e5dcc170bc0
MD5 919775170182fd65b2f2c48c77761328
SHA1 111b16b42625056c5c96093405275822d3c143e1
SHA512 013d677f4168628d98024f0627f2b4e4f90b5b6f10ae58b37905dac1dc99bcaaa4759d2bc80ff890c04cf98fbe9b9d1ece5000cbf533b1fee1b9d0dbf55bbe3e
SSDEEP 3072:K8ASpvo0LKrXEX65ezpxJ2kbJ7mv73E2o/9sY2k:ZASpvo0LKkRzpxJ2kRqroik
TLSH
T1C234491176008475F3190B315A16FAE049A9AD3D1AE8F84FF7787E365D322839A7728F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.207
112.175.88.208

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
1904	huter.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-11-09_919775170182fd65b2f2c48c77761328_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1544	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	huter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	huter.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_919775170182fd65b2f2c48c77761328_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 1904	5688	2026-11-09_919775170182fd65b2f2c48c77761328_elex_rhadamanthys_stop.exe	89
PID 5688 wrote to memory of 1544	5688	2026-11-09_919775170182fd65b2f2c48c77761328_elex_rhadamanthys_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-09_919775170182fd65b2f2c48c77761328_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_919775170182fd65b2f2c48c77761328_elex_rhadamanthys_stop.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 dd259fcdbf04aa773ede7515d6a83e5b112ed3d9eef4632cf856771bfeaafd98
MD5 7295fb9368a0ef278de4b9755bf9fa1b
SHA1 db5fa220d77ed7824ae0a4f822e0ce46010a5d77
SHA512 dd1a996311188c0baa54097fc7023f13e71115265fadb9dfa35f2a8d9df8aed1e37bd00ef612577d2eb63ba1b612a7b16a765ebfce3b7c9e7efebe54890eb88a
TLSH
T1B9F0928000A6F16D3116A502E006F77433229CEC040E5C8202D7F765663912C8088078
MD5 SHA1 SHA512 TLSH

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 241KB
SHA256 1ccea60b145b08243ce44e63b3ab3736d7e4319e456520d3fade9f4e059e51f7
MD5 af1996c0489234af8c746716b0826636
SHA1 42eb964abcf113842f9997b106a4393ca876cfd1
SHA512 8d0050a9a25240a17ef6921729f105141b45ac8119eb47b40cd403401ff760d4265f92c121282175fc2f44cc4a4ae2c368561b0d5ad0ffbe77c04ffa6e0b7393
SSDEEP 3072:K8ASpvo0LKrXEX65ezpxJ2kbJ7mv73E2o/9sY2k:ZASpvo0LKkRzpxJ2kRqroik
TLSH
T1E634491176008475F3190B315A16FAE049A9AD3D1AE8F84FF7787E365D322839A7728F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 342B
SHA256 c92a2f4428e4842ede7736bdf4f21d6eaacf0352e724e42c36e2354e77637569
MD5 36a0712cf95895bc7dde976d53497d05
SHA1 8f58ab626a0eb60d5dacb1b8a7484f244dcdb134
SHA512 a898931f479258f1a06463b77e56a1c6dc348281d69b9718b61ef5663c7962d6493144806814299935267cf09d5bc2fec6d6a703dfba375891db7492253085fe
TLSH
T183E08610519BDB1A084C606F0EBEA18CD86999B87F962BDC7F20C99911DBC1EB9D3711
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1904-12-0x0000000000840000-0x000000000087D000-memory.dmp

Download

memory/1904-14-0x0000000000853000-0x0000000000854000-memory.dmp

Download

memory/1904-24-0x0000000000840000-0x000000000087D000-memory.dmp

Download

memory/1904-25-0x0000000000840000-0x000000000087D000-memory.dmp

Download

memory/5688-0-0x00000000003E0000-0x000000000041D000-memory.dmp

Download

memory/5688-1-0x00000000003F3000-0x00000000003F4000-memory.dmp

Download

memory/5688-21-0x00000000003E0000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads