urelas | 07d6fde0f7460e153051e12be439a789d014c91a06c58a2a71009366f3e00b0f

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_a5daa744a72c712d85b6b46a357a342a_amadey_elex_smoke-loader_stop.exe
Size 803KB
Sample261110-n2sgtsfa87
SHA256 07d6fde0f7460e153051e12be439a789d014c91a06c58a2a71009366f3e00b0f
MD5 a5daa744a72c712d85b6b46a357a342a
SHA1 3edd539e21c5af39f88082502f5f7846e4f1e95e
SHA512 592eff1b20271f6692f649f98b51cf52d27f847331caa9f7bfe2ac6dfdb0f2dd218094ccc7da8672bfcc17ec75d73bed2bdf20441e7a2752987d278c1cf4c0a5
SSDEEP 12288:dccNvdRExZGe+Q1nzPlgqmoWkI09HPZkioy:dnPfQpzNgqAkI09HL/
TLSH
T1AC05C0243B90C072E3662B754896F7B517BA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
2772	cozaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1628	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_a5daa744a72c712d85b6b46a357a342a_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cozaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 2772	3688	2026-11-09_a5daa744a72c712d85b6b46a357a342a_amadey_elex_smoke-loader_stop.exe	88
PID 3688 wrote to memory of 1628	3688	2026-11-09_a5daa744a72c712d85b6b46a357a342a_amadey_elex_smoke-loader_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-09_a5daa744a72c712d85b6b46a357a342a_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_a5daa744a72c712d85b6b46a357a342a_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Local\Temp\cozaa.exe
  "C:\Users\Admin\AppData\Local\Temp\cozaa.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 4c7b12c48d97c811056e0624de2e5805a18372c10e6bff2ca3063ef3d8b367a6
MD5 20519dcb8499cb6d3642c8a503e8a3bd
SHA1 589fe70986416ff2fd7478f5984296d39d1c59ed
SHA512 4433fa19c2e60e41b76e343942ab4b8e90929173d587ec5189ecf4f367a3fa9f37110f11bec90e06954d2b10fb0853dfd4db30748d1b7568c3475ef86519e379
TLSH
T14FE02002515FDEBA0404D11705F9668EC57149A83E9637397750CAAD12D585DFFD7302
MD5 SHA1 SHA512 TLSH

Submit Download

cozaa.exe

Path C:\Users\Admin\AppData\Local\Temp\cozaa.exe
Size 803KB
SHA256 dc992e67e774616d6cf36c8b0c14834cddbc70e0615cdf33462e3bf3e02d16b4
MD5 b95a7845045ec228d75f10dd9e5d150b
SHA1 ab04f567108cc8a804c6cf63c43dc23508a9fe77
SHA512 dbb81ae4f8b7163d0023200743557ab67e4934e23cf5bbd8a3cafda898fa2ad2635a95f0c92d3ae5b6c584fd217279aedd10139ea0e310ed744c80cecf9a3065
SSDEEP 12288:dccNvdRExZGe+Q1nzPlgqmoWkI09HPZkio9:dnPfQpzNgqAkI09HLo
TLSH
T14705C0243B90C072E3662B754896F7B517BA7C345A64968FF2A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 332c5b8a9fc5f6776b416bc90462207bd385c75e99424d76d09a46247ddd7f6a
MD5 9e4a465ca7759095974578ab8dae4883
SHA1 a62bf0a9156a2bd99ce560f67a39502d3ea66bc4
SHA512 40e398ea9f7661ede30f011eac05f017298d8e6be9dffcaba39cff404bea651a22f2590e72dc75162e87756a2c8d14701dcafa751e2a8f0d28e77b7c6dd70d71
TLSH
T167F09BDE1075E06E771BF623E7D407E527830D9C29478D480115F5704676C2CC4D43B5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2772-13-0x0000000000630000-0x00000000006FC000-memory.dmp

Download

memory/2772-21-0x0000000000659000-0x000000000065A000-memory.dmp

Download

memory/2772-24-0x0000000000630000-0x00000000006FC000-memory.dmp

Download

memory/3688-0-0x0000000000150000-0x000000000021C000-memory.dmp

Download

memory/3688-1-0x0000000000179000-0x000000000017A000-memory.dmp

Download

memory/3688-20-0x0000000000150000-0x000000000021C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads