urelas | e67f0356caa1cc84cd298c74231fc368fba1d64858c7410a5c6c0b119b5a8b48

Analysis

max time kernel
150s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_e1e73e2927b78dc85172b95f5a883aae_darkgate_elex_smoke-loader.exe
Size 2.1MB
Sample261111-vytdaaas4j
SHA256 e67f0356caa1cc84cd298c74231fc368fba1d64858c7410a5c6c0b119b5a8b48
MD5 e1e73e2927b78dc85172b95f5a883aae
SHA1 12535e299b0ee55b595350b783009f1870e4302b
SHA512 2ca88169a205c536971d9ca6196d9aaa19f4d145b838510eb38b86e299377f8a322342ca4da79b90bf7d38e85f67a90c3993e950a137eecf00c55f586c5199f3
SSDEEP 49152:3MDWLKW0qmkeX5Kz8FiM6JHCIgIV5XOCOe/78DGx5V1uCRkzWL8rl87Bxk7e6kH:QK0qmfXQaZ6JHCIgIV5XONe6Gx5TuCRb
TLSH
T153A5BE7D76A08076D67233B0464EE3F9F2ADAD314935064B76A13E397A304A34D2D26F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

112.175.88.208
112.175.88.207

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
3320	dofhir.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-11-10_e1e73e2927b78dc85172b95f5a883aae_darkgate_elex_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1864	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dofhir.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dofhir.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_e1e73e2927b78dc85172b95f5a883aae_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dofhir.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 3320	1004	2026-11-10_e1e73e2927b78dc85172b95f5a883aae_darkgate_elex_smoke-loader.exe	89
PID 1004 wrote to memory of 1864	1004	2026-11-10_e1e73e2927b78dc85172b95f5a883aae_darkgate_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-10_e1e73e2927b78dc85172b95f5a883aae_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_e1e73e2927b78dc85172b95f5a883aae_darkgate_elex_smoke-loader.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\dofhir.exe
  "C:\Users\Admin\AppData\Local\Temp\dofhir.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dofhir.exe

Path C:\Users\Admin\AppData\Local\Temp\dofhir.exe
Size 2.1MB
SHA256 7c5e745fa69dfdbed2ee33f53989c8e8ca4b5fb748fad34ea571b6c79ddd730f
MD5 394571c01c9c57b7fa6aada28c5a71ab
SHA1 e93604e0886a94c3c454d4f162e14ad5b94bda2a
SHA512 8cb79a47c1317be31de3df0da338eae16bacf3b64a651f9e6b79d3b193a9b209f1c2e706c6baa27e5163a79408439cbcbb20a40dfceb73784cf226208750d532
SSDEEP 49152:3MDWLKW0qmkeX5Kz8FiM6JHCIgIV5XOCOe/78DGx5V1uCRkzWL8rl87Bxk7e6k4:QK0qmfXQaZ6JHCIgIV5XONe6Gx5TuCRM
TLSH
T105A5BE7D76A08076D67233B0464EE3F9F2ADAD314935064B76A13E397A304A34D2D26F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 75bd0142158445b6feff7dbfe2aa1a34028e41fdc70ce5cf0606effccd1b260f
MD5 b50a8cc54d593d2527c10cf8e2a0d9a8
SHA1 2b56e653ea534aba82f2df3dfd238eedc2d90897
SHA512 931091e28539d74046e866b8f5bc41d727bca8921f2e1f5347bcd1170b90059e3303767eab00f4d897ddd10aee09139ee8b6a7604434d15f08e5729b3c8a6d28
TLSH
T1F6F092A400A6F15C3212A501E126F73223629DDC204DBC0502D7B335A23105C80EC07A
MD5 SHA1 SHA512 TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 350B
SHA256 e2c4a218cd5dedd1fadc4bb91010438c53177c7ed37121ec39699afe8b5176d8
MD5 44c1c1bd2454eb1dfbf73dd16b4f28e6
SHA1 825713d14ee83bc3bc56776f26a7733748970be4
SHA512 ec4b2729361be95f4080b3f3a0106cbd714225731d63c1b7962b43a603af57e106889a90c9f48b3d69b014ba9f6a42df0aec4e8fa3f538965f0260c7d4e0c1df
TLSH
T141E02602C0BFDE1A0884A43B42BA19CED069086F2F8B2700A709C64C61C115FF9F3701
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-0-0x0000000000A20000-0x0000000000C4C000-memory.dmp

Download

memory/1004-1-0x0000000000B3B000-0x0000000000B3C000-memory.dmp

Download

memory/1004-20-0x0000000000A20000-0x0000000000C4C000-memory.dmp

Download

memory/3320-12-0x0000000000D50000-0x0000000000F7C000-memory.dmp

Download

memory/3320-21-0x0000000000E6B000-0x0000000000E6C000-memory.dmp

Download

memory/3320-24-0x0000000000D50000-0x0000000000F7C000-memory.dmp

Download

memory/3320-25-0x0000000000D50000-0x0000000000F7C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads