urelas | 10394b48ec92134c7a18cebf1ef9967a39c7c2f84ee9a45a62df998468d681a4

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_20f93247db50015099d107f7085766da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 787KB
Sample261111-bqc7jsdc26
SHA256 10394b48ec92134c7a18cebf1ef9967a39c7c2f84ee9a45a62df998468d681a4
MD5 20f93247db50015099d107f7085766da
SHA1 740935055b6f13709dae8d04db281bb9ed7bdda1
SHA512 72e7cd73a4d462494dbf6c979ba3a7db63564a4b1648bf9b71518a867490e3020d92f9316b17ae79e40eb5c7dca3ef571aee56ccd65dc7a2c703eccb88d28d52
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEgz:d7dLBftJLW5YUWLrkJB0PJgz
TLSH
T1B60501213480C43AF71A07354441EAE44E7ABC7B18D1A65FFB787D36A9321579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Custom signature

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/5684-0-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c56c-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5884-18-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5684-22-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6124-33-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5884-31-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6124-34-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6124-53-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 3 IoCs

pid	Process
5884	aqgaf.exe
6124	hiqyny.exe
4148	ewixl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2968	cmd.exe
5632	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	hiqyny.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	hiqyny.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_20f93247db50015099d107f7085766da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aqgaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hiqyny.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewixl.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe
4148	ewixl.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 5884	5684	2026-11-09_20f93247db50015099d107f7085766da_amadey_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5684 wrote to memory of 5632	5684	2026-11-09_20f93247db50015099d107f7085766da_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5884 wrote to memory of 6124	5884	aqgaf.exe	92
PID 6124 wrote to memory of 4148	6124	hiqyny.exe	94
PID 6124 wrote to memory of 2968	6124	hiqyny.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-11-09_20f93247db50015099d107f7085766da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_20f93247db50015099d107f7085766da_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Users\Admin\AppData\Local\Temp\aqgaf.exe
  "C:\Users\Admin\AppData\Local\Temp\aqgaf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Users\Admin\AppData\Local\Temp\hiqyny.exe
    "C:\Users\Admin\AppData\Local\Temp\hiqyny.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\ewixl.exe
      "C:\Users\Admin\AppData\Local\Temp\ewixl.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4148
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 2b32c959d4edfcec86f213f5e8e320b5b505f15a0be12cd92e5873011ba3725a
MD5 12c3dc0fdefd407e03b2c434186d78ca
SHA1 a49946a5435caad7afc8a43043d8421675865b0c
SHA512 3e22f5172af72163ade7f649ee6ffa18e5a69cdc269c62c1ee86b921b8b7e210a6901bc7637cc97e6e26958ceb48436eec058ac348dc6c87e87fa724be28e6af
TLSH
T1CBD0C711C1D6D75E0448902B0BB5718DC07D4C5C7F873B11E721C46C61C181DF6C7341
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 a62980e0feb984588084ebfad7b2dc13d86315ff81ff7cfc7472a0cb5f11a38d
MD5 d22c740eabd8e75cc01b7d6b026bbc96
SHA1 e0029d7fc8e8a0b273bcb2a2395e6a85ca018915
SHA512 7c961bc80d19adfcc7167a19189f24664cd366b3a833e8b1538126244e5a63bf17b0ff558194a82fbf2009dbb95150a97d7beba8cbd0669ce8e33f5d590ac060
TLSH
T1D7E0D81302DFEF66054DD01F0AF9744D85648AA87F4E3FA4BB11C69C12EA81EF596302
MD5 SHA1 SHA512 TLSH

Submit Download

aqgaf.exe

Path C:\Users\Admin\AppData\Local\Temp\aqgaf.exe
Size 787KB
SHA256 34d3e4509f5e5f0d6174a6eb7138ae7edbcfa4b07407d26b1c8eddf6eec010f6
MD5 a0d147d5ca6b8a0d402f83d3c530a37d
SHA1 34ffe18fe073ec256deeb3fa1143bd7bf6aab53b
SHA512 087d06b3f1e03329d58167129c9649344453571ddf222e16898a56f9476b826fee49a2f0fd55d04f75805a610b1b7a73f1f8ea63fcc4041bdc4c0f3d6d4ef377
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEgS:d7dLBftJLW5YUWLrkJB0PJgS
TLSH
T1BE0501213480C43AF71A07354441EAE44E7ABC7B18D1A65FFB787D36A9321579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ewixl.exe

Path C:\Users\Admin\AppData\Local\Temp\ewixl.exe
Size 601KB
SHA256 c9f7e7d7f08616e2eca247f287d7dc20927177c627e9d6c74f79f74bc9d74ec3
MD5 8d2588873e4a2a6ee92d9fa32e2598dd
SHA1 6924fa620e14aa0b22a9a153a45c41f6532f6665
SHA512 b91cf6fc998a5fb2e19a2ccde9718199d657bb6e92c2438fe2fe50381c6d0a3a4d9f414380d5f749bf8c2e17954004fa4351e42ea0dae6a1f3879b02f077c691
SSDEEP 12288:g0/ofE9N0dFaDXAm8Ip9lNfgK4eLS9xHAyZq/G7yq/yWq4qe4MJuC6Pmi:gBfCIFaUmplN4K/sxgyZ9u2JpL4MJuCa
TLSH
T13FD4238FE3953634FD0967739CFE83211128AEDC46854D9262D729CAD6B718F8F68708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 ace7ced871dd2e6a81c8fe3b8469ef31a162f3b487b86aabf041af34676fcc53
MD5 013cdb3db29a753bc58c54204fbb8075
SHA1 e4f2b832ccfe16f4979bc6b094717505ab1878b5
SHA512 929136db1c4a121d3733d4deffa656dde45505af87ac3a63efecac388493d70e390d25d1ea247ce9804a35629144b69e71a1a18351c792d6d19ddd755852093b
TLSH
T11CF04CE221A1B16D3712E531E2A457556B930D8C194B9C640309B1708D7A86C5444215
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4148-46-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/4148-56-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/5684-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5684-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/5684-22-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5884-18-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5884-31-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/6124-34-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/6124-53-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/6124-33-0x0000000000400000-0x00000000004CB000-memory.dmp

Download