urelas | 5bd3728faf21d78a898a49527168372139d99e64ba2249c6ff2c2638a6a87b87

Analysis

max time kernel
148s
max time network
64s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_23c77ca9b7ad0d31f4e95cd0ba019340_elex_rhadamanthys_stop.exe
Size 175KB
Sample261111-bd9d8axvhy
SHA256 5bd3728faf21d78a898a49527168372139d99e64ba2249c6ff2c2638a6a87b87
MD5 23c77ca9b7ad0d31f4e95cd0ba019340
SHA1 8fc86af7576fbc0463f0b78f4b69837ec27a45dd
SHA512 d1a12799e9cce30b93415f925077c2513e23712c58fc22e62ac310c5313525f62e240bac4888468480f8db47ebb7ba7506f74a4cd4dc7a24fa38bdf566f7974d
SSDEEP 1536:JF02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7p2Xi:wuYndSW7gILCLIPtqVu5Dqpxhz2y
TLSH
T1770407107640C436F36907315916EAF14969AD396AE8E98FF3B87E391D312C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183
121.88.5.184
218.54.28.139

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
4280	opert.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-11-09_23c77ca9b7ad0d31f4e95cd0ba019340_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3332	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	opert.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	opert.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_23c77ca9b7ad0d31f4e95cd0ba019340_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opert.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4280	4336	2026-11-09_23c77ca9b7ad0d31f4e95cd0ba019340_elex_rhadamanthys_stop.exe	88
PID 4336 wrote to memory of 3332	4336	2026-11-09_23c77ca9b7ad0d31f4e95cd0ba019340_elex_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-09_23c77ca9b7ad0d31f4e95cd0ba019340_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_23c77ca9b7ad0d31f4e95cd0ba019340_elex_rhadamanthys_stop.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217
MD5 6735bbe93159782090eb9c49dde676c6
SHA1 6edec7009f27d90d36081a9d4a05fc6e6bde28e2
SHA512 8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696
TLSH
T13CF012C110B7F0077123B201C504033437D3ECCD00438DD5069A73398A35C6C4514178
MD5 SHA1 SHA512 TLSH

Submit Download

opert.exe

Path C:\Users\Admin\AppData\Local\Temp\opert.exe
Size 175KB
SHA256 401b863bbd4131b46255cebeb87ad664224b23ba983589bf99f6cd7db33e2f7f
MD5 0d563dc38969f2facab63adff97b596d
SHA1 189034e1d82fe021a68ff19dc4006b3c54a015f7
SHA512 9a0db5073f8b14edb83196d85f85121b6506f98fbfeb780b301ff1258a531395d4aa87ef3f7d19a57960298da21ec10762fd9e81192fa1117118dbb5c09893b8
SSDEEP 1536:JF02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7p2Xt:wuYndSW7gILCLIPtqVu5Dqpxhz29
TLSH
T1720407107640C436F36907315916EAF14969AD396AE8E98FF3B87E391D312C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 342B
SHA256 c5b715d655be141c464045e346dd41a2e5542e691f9f441954dc6adef88f0084
MD5 e3672eb34a60648cb242e450cb447f03
SHA1 a5bd9c45748ecf10fadd5f3544abafa41652ee20
SHA512 14715f38e5de68f53db66a5533e889287bf6ab7e97d202107bee137f1d79ee40722a467d12deabf599d0a413efb67072d0afb1c846dc8339306829df1b5a3e2c
TLSH
T1DDE0860270AAEE19095C601F09B9A28DC0A85DAC7B9A3B599B30C6D811ED80EB9D7361
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4280-12-0x00000000003C0000-0x00000000003EF000-memory.dmp

Download

memory/4280-14-0x00000000003D4000-0x00000000003D5000-memory.dmp

Download

memory/4280-24-0x00000000003C0000-0x00000000003EF000-memory.dmp

Download

memory/4336-0-0x00000000002C0000-0x00000000002EF000-memory.dmp

Download

memory/4336-1-0x00000000002D4000-0x00000000002D5000-memory.dmp

Download

memory/4336-21-0x00000000002C0000-0x00000000002EF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads