urelas | d849887690da1aa5531590bfd1a3c8e096fa8f31c8273673afd899d07cb2b80a

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_23edd410757b975aa09f4db35f0e2337_elex_rhadamanthys_stop.exe
Size 175KB
Sample261111-bdtnrsds2r
SHA256 d849887690da1aa5531590bfd1a3c8e096fa8f31c8273673afd899d07cb2b80a
MD5 23edd410757b975aa09f4db35f0e2337
SHA1 82ae25dab15537ab6b5a0baa294aa0043068363e
SHA512 7cd1d27f84b2d70f5310f60abb2d08d0e18348da334fe4bdf7e6c4023450901aaf272de861f638769798d4c6810b95cf7703f87b41f1820c32150196a722e2ec
SSDEEP 1536:JF02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7p2Xu:wuYndSW7gILCLIPtqVu5Dqpxhz2e
TLSH
T1310407107640C436F36907315916EAF14969AD396AE8E98FF3B87E391D312C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183
121.88.5.184
218.54.28.139

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
5984	opert.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-11-09_23edd410757b975aa09f4db35f0e2337_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4708	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	opert.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	opert.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_23edd410757b975aa09f4db35f0e2337_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opert.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 5984	3648	2026-11-09_23edd410757b975aa09f4db35f0e2337_elex_rhadamanthys_stop.exe	91
PID 3648 wrote to memory of 4708	3648	2026-11-09_23edd410757b975aa09f4db35f0e2337_elex_rhadamanthys_stop.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-09_23edd410757b975aa09f4db35f0e2337_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_23edd410757b975aa09f4db35f0e2337_elex_rhadamanthys_stop.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217
MD5 6735bbe93159782090eb9c49dde676c6
SHA1 6edec7009f27d90d36081a9d4a05fc6e6bde28e2
SHA512 8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696
TLSH
T13CF012C110B7F0077123B201C504033437D3ECCD00438DD5069A73398A35C6C4514178
MD5 SHA1 SHA512 TLSH

Submit Download

opert.exe

Path C:\Users\Admin\AppData\Local\Temp\opert.exe
Size 175KB
SHA256 557bd369ad2bcf9844a59e29980be142208ad9b0137fbe2d5dfd22d92f3ae8fd
MD5 302939206b5388480ca80d6bab7634dd
SHA1 c64c0c3c9e129a041cba4255fcd929f421cd22ef
SHA512 54b59c08ed443fb03be21f5a0021ca50c050f046b13152bd8d382ba0048c94e850631e2f19ecfd118d5adba6a33b8e096e090f20bca20db7a270c1c0b8c6fdce
SSDEEP 1536:JF02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7p2XA:wuYndSW7gILCLIPtqVu5Dqpxhz2Q
TLSH
T12B0407107640C436F36907315916EAF14969AD396AE8E98FF3B87E391D312C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 342B
SHA256 cae5af6a54dc0fab6fc84d894dd3381cc45b756070eaa91e6fd54f1ec3b191cc
MD5 e765042f94f712528506235e21042f72
SHA1 67dae041e0dd48206ab447a779a32907febd6cb5
SHA512 376fd50b35e9bada8a060aa0410864236e94e55076a8453523eb0d11fb15467cd976e5b74507132774971a5a31b5dbb1faf136fa1bdb924bcf96a0313cc0365a
TLSH
T159E08610509AEE7D044C946B15BAA04DD06559AC7BD72B58B731CA5C21E7C0EBE9E323
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3648-0-0x00000000005D0000-0x00000000005FF000-memory.dmp

Download

memory/3648-1-0x00000000005E4000-0x00000000005E5000-memory.dmp

Download

memory/3648-21-0x00000000005D0000-0x00000000005FF000-memory.dmp

Download

memory/5984-12-0x0000000000770000-0x000000000079F000-memory.dmp

Download

memory/5984-14-0x0000000000784000-0x0000000000785000-memory.dmp

Download

memory/5984-24-0x0000000000770000-0x000000000079F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads