urelas | ed8e48754d8e37fa3c40ce0a650cd8eda40fb5e16d01f4fdb9b1fcd41ef497f6

Analysis

max time kernel
150s
max time network
87s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_a5542a5b5668a80215cd65d87e10966c_elex_glassworm_rhadamanthys_stealc_stop.exe
Size 1.3MB
Sample261110-n3dp3afa94
SHA256 ed8e48754d8e37fa3c40ce0a650cd8eda40fb5e16d01f4fdb9b1fcd41ef497f6
MD5 a5542a5b5668a80215cd65d87e10966c
SHA1 db4ef2c78a0bad7ba051f670b27651c500e0247f
SHA512 c1b8433972b7337c563da78d974b2335aee8e9e14fc74ef8ada7dbc75cd6217cd03706c925ce20339b99b03836be0d47a75d21e4ef4dedb0587d7c4b5097d1c5
SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+n5:+rt4/NArwjs5pAVb
TLSH
T199551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 2 IoCs

pid	Process
2516	hiobx.exe
3292	laqan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2560	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2708	3292	WerFault.exe	92
4768	3292	WerFault.exe	92

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	hiobx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	hiobx.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_a5542a5b5668a80215cd65d87e10966c_elex_glassworm_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hiobx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	laqan.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2516	4632	2026-11-09_a5542a5b5668a80215cd65d87e10966c_elex_glassworm_rhadamanthys_stealc_stop.exe	89
PID 4632 wrote to memory of 2560	4632	2026-11-09_a5542a5b5668a80215cd65d87e10966c_elex_glassworm_rhadamanthys_stealc_stop.exe	90
PID 2516 wrote to memory of 3292	2516	hiobx.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-09_a5542a5b5668a80215cd65d87e10966c_elex_glassworm_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_a5542a5b5668a80215cd65d87e10966c_elex_glassworm_rhadamanthys_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\hiobx.exe
  "C:\Users\Admin\AppData\Local\Temp\hiobx.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\laqan.exe
    "C:\Users\Admin\AppData\Local\Temp\laqan.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 256
      4⤵
      Program crash
      PID:2708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 264
      4⤵
      Program crash
      PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3292 -ip 3292
1⤵
PID:5972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3292 -ip 3292
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 378B
SHA256 722cfbac87fabaa444ccd6599753b959b06ddf916fd114e7edd7cb47f227e505
MD5 4870a4504cf0b70f2e7aee91fd749beb
SHA1 30fc02b785bd979d6f43d8f2d557be2d32225edb
SHA512 0bd38206cbb589c62bc752e42f16c8f102e0a2cf66591acb8c7a195ddb5376f9e69ca72eadc236bd7ccbde92cb5953cb631823817a6003b6dda4bcdd641ce305
TLSH
T11EE0D801145AA97E011CD03F0DB9604DC1659AE8AF892B48D721C64E22DAC1EBAD6711
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 09ddffc300dc8adf48fff8ceb6cff27bb1a1188307b6e1d123cdd47db2e5b28c
MD5 a6a9794d0062cd30437abdf530c2e128
SHA1 4f624e3938d50b7fe4b64e025cac1ce53d5b55ea
SHA512 37ceacfd7671a486ce079cdce4d71e9f192b7c247b5476d4ff48bfd012d056640408d96cbc1bc83ba17d3e82a5180be1ff8a7dd0b44ca3642f8dcd952775aa56
TLSH
T113F08CD121B0B0013282E216C3A04F4133A30C882887BEA40109B1308835E2C48A431A
MD5 SHA1 SHA512 TLSH

Submit Download

hiobx.exe

Path C:\Users\Admin\AppData\Local\Temp\hiobx.exe
Size 1.3MB
SHA256 7f9efe28b9cbc1438971603e1a2b1365ffcc855d740699d528aab8580c1c1fbf
MD5 ee7178f8776066c57144e5673fd3ef8e
SHA1 387e4d3127cf3c0afd5304dbdf762c024ebe35ec
SHA512 6c6d5e8e3d906be8e697231c8d1e4d51fde7036d230365f96e4b1f3f413d9f26381398ada90ebecf89c7edf85a4e8ddcdd97984038ff1f0d228cf1eebd2b80c5
SSDEEP 12288:++GtVfjTQSaoINAHT1VQ1i3SyQEW85gMer5+nsL1Jer5+nkA1Yaner5+ns:+rt4/NArwjs5pAVC
TLSH
T1FD551753E7818AE8E75D05365B148150922EFD21AA8F6315B86C362CCF733879F66E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

laqan.exe

Path C:\Users\Admin\AppData\Local\Temp\laqan.exe
Size 231KB
SHA256 b8e0da8e06c58c4a3d013b854549ddb369a7c1a9deb0dc39149dff0687e87336
MD5 552824c40c6e592aa06045eb8959e7aa
SHA1 d79a245c066f45a08087aabe8003f90cd0242e91
SHA512 81b761334dc5345672a5c51131cc3755dc1c2e7f027c795f77d2ee629423fd0a9d81783d7759a828346d15ad6c34f37a199b5f4615c4f7b99ceea170fa9bfb0e
SSDEEP 3072:ack4sHDj+8L5cTMOdi5/TYSPXXUv4G4Y8oQIN3C9ISE0qJiNlUdpiq:z6r5cTfS/ZPHUWoQISzqJBpiq
TLSH
T1A734D06266004895F76E0F311ADBFAE4488A9E3C25D4F58EF43CBE3658321979A3714F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2516-13-0x00000000004F0000-0x0000000000647000-memory.dmp

Download

memory/2516-14-0x000000000051B000-0x000000000051C000-memory.dmp

Download

memory/2516-24-0x00000000004F0000-0x0000000000647000-memory.dmp

Download

memory/2516-35-0x00000000004F0000-0x0000000000647000-memory.dmp

Download

memory/3292-33-0x0000000000E00000-0x0000000000EB3000-memory.dmp

Download

memory/3292-36-0x0000000000E00000-0x0000000000EB3000-memory.dmp

Download

memory/4632-21-0x0000000000AD0000-0x0000000000C27000-memory.dmp

Download

memory/4632-0-0x0000000000AD0000-0x0000000000C27000-memory.dmp

Download

memory/4632-1-0x0000000000AFB000-0x0000000000AFC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads