urelas | b0a6301859ce4367c5d8de163bd91df3a42709f7376f9bc08775b4e35a10b73d

Analysis

max time kernel
148s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_122a13591440f2c5ddbff86e4fa2512c_elex_rhadamanthys_stop.exe
Size 170KB
Sample261111-dfe99sdh44
SHA256 b0a6301859ce4367c5d8de163bd91df3a42709f7376f9bc08775b4e35a10b73d
MD5 122a13591440f2c5ddbff86e4fa2512c
SHA1 05de27997976e58c905fc688ee748df02d05e32c
SHA512 458ca15f8fdb5c1052f00b041a8c25be3a4e5a25a77485ed97362268cd145cb7e0d51ff3ce980f547e2b64da8f228fc81785d643a06317bfb8316a5d94652681
SSDEEP 1536:eADA0Wbt1931D2P7BWLQ4zR4LUKMcPHFE3HP/GTW65CGEgvpxyTfzP:eADA0Wc7UJ6LZMaHLW65DE8pxW7P
TLSH
T18404D41166008471F3590B314916FAE049A9AD3D5AE8F98FF7787E3A6D322C39A7314F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.208
112.175.88.207

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
3540	huter.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-11-09_122a13591440f2c5ddbff86e4fa2512c_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3232	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	huter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	huter.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_122a13591440f2c5ddbff86e4fa2512c_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 3540	2316	2026-11-09_122a13591440f2c5ddbff86e4fa2512c_elex_rhadamanthys_stop.exe	90
PID 2316 wrote to memory of 3232	2316	2026-11-09_122a13591440f2c5ddbff86e4fa2512c_elex_rhadamanthys_stop.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-11-09_122a13591440f2c5ddbff86e4fa2512c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_122a13591440f2c5ddbff86e4fa2512c_elex_rhadamanthys_stop.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\huter.exe
  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 53c25f3ea9f537bb7d5accae21cbc5c9ef83e4bdf52143201ab08b69403b489c
MD5 e9bde5b44e2cc18d88ff2ee2dbc7081c
SHA1 b2eba2136f52d53ff3f60541bc79e7b217d0b268
SHA512 573357570a89779fc2984dcc70639460bc8d0cfc6d3a0a37d0623a5804630e804b34671b0f98765b9f7a68b04aa550ffbfd9ca69f6157cff1c826466943bfc8c
TLSH
T17CF0928000A6F16E311AB502E006F77433229CEC040E6C8202D7F365A63112C8088078
MD5 SHA1 SHA512 TLSH

Submit Download

huter.exe

Path C:\Users\Admin\AppData\Local\Temp\huter.exe
Size 170KB
SHA256 945a580310d6e6f879014fb5d1045568a0d5bf1f89654bee30b39aee1036817d
MD5 0367a9c0286df39e3ec88e337c9170e3
SHA1 5991166f8f393cdfb2db86d14f8c1e4d090b25f0
SHA512 cf9e6b14cd9ca56f798de2cb306b4854f1cb82cdc29e9920d51bc9cfab5f5dda5f4a0f3e06f08a77975efaa92b77bcecd39afc6a10dd8066870fa0e1e0237158
SSDEEP 1536:eADA0Wbt1931D2P7BWLQ4zR4LUKMcPHFE3HP/GTW65CGEgvpxyTfz5:eADA0Wc7UJ6LZMaHLW65DE8pxW75
TLSH
T11204D41166008471F3590B314916FAE049A9AD3D5AE8F98FF7787E3A6D322C39A7314F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 342B
SHA256 4f0719f4c9b44109ebc6502ab1d4007a6bf7d73bd94679e0d804f5cc6025bdd2
MD5 1752b1eda5a79adce9b7232c7a4a7941
SHA1 6b8d8a57b453f815e52861e0337cda65ee9db3b9
SHA512 9c86f0b51eb3da878a0ffa7351124d3c663e8f796e60679a1b196d8c3eac86321c2491ed3e89cb14cda393372d289c7ac922cbfd3a2edbf64daca5fb77060b9e
TLSH
T1F1E02001458AFF27150C603F057DB3CCC05106BC6F472FD4D721C695619A91DF9C2311
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2316-0-0x0000000000620000-0x0000000000650000-memory.dmp

Download

memory/2316-1-0x0000000000633000-0x0000000000634000-memory.dmp

Download

memory/2316-21-0x0000000000620000-0x0000000000650000-memory.dmp

Download

memory/3540-12-0x0000000000490000-0x00000000004C0000-memory.dmp

Download

memory/3540-14-0x00000000004A3000-0x00000000004A4000-memory.dmp

Download

memory/3540-24-0x0000000000490000-0x00000000004C0000-memory.dmp

Download

memory/3540-25-0x0000000000490000-0x00000000004C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads