urelas | 52ae5ad6d2b02ff759492335cc17ece0e1a5d4633c14010eacb4ca99357421b5

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_d645d87188033e8a4aa330998a5ff14a_elex_rhadamanthys_stop.exe
Size 175KB
Sample261111-xb5txabs5n
SHA256 52ae5ad6d2b02ff759492335cc17ece0e1a5d4633c14010eacb4ca99357421b5
MD5 d645d87188033e8a4aa330998a5ff14a
SHA1 c9b744740078a0148c1b7dd77f3c10279c0ca484
SHA512 5221f03fa42b0e2c0717f058494150c849f4866b8cc91da20cbc7c5458e47dd727b6b5f7e2a3362be96ef38dc1fc145771919fae2f74104a4ab1267b6e2ae11e
SSDEEP 1536:JF02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7p2XY:wuYndSW7gILCLIPtqVu5Dqpxhz2o
TLSH
T1610407107640C476F36907314916EAF14969AD396AE8E98FF3B87E391D312C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

121.88.5.183
121.88.5.184
218.54.28.139

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
2920	opert.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	2026-11-10_d645d87188033e8a4aa330998a5ff14a_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1348	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	opert.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	opert.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_d645d87188033e8a4aa330998a5ff14a_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	opert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2920	1272	2026-11-10_d645d87188033e8a4aa330998a5ff14a_elex_rhadamanthys_stop.exe	88
PID 1272 wrote to memory of 1348	1272	2026-11-10_d645d87188033e8a4aa330998a5ff14a_elex_rhadamanthys_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-10_d645d87188033e8a4aa330998a5ff14a_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_d645d87188033e8a4aa330998a5ff14a_elex_rhadamanthys_stop.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\opert.exe
  "C:\Users\Admin\AppData\Local\Temp\opert.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217
MD5 6735bbe93159782090eb9c49dde676c6
SHA1 6edec7009f27d90d36081a9d4a05fc6e6bde28e2
SHA512 8c85cef74bcd042b528424c1b99149bf5374c428f61a5f3c99e4f42460453b7a36cd0edbf8f76a042432800ee93916a7650b55e41d06f51566ad2cf3d69be696
TLSH
T13CF012C110B7F0077123B201C504033437D3ECCD00438DD5069A73398A35C6C4514178
MD5 SHA1 SHA512 TLSH

Submit Download

opert.exe

Path C:\Users\Admin\AppData\Local\Temp\opert.exe
Size 175KB
SHA256 4fa239adf7b47f105b4b4dbb81c13b39414360a9fa2d889016ce2705fef40d77
MD5 9af21edfa4c4f02d146b871dbe2c1e23
SHA1 bba2ae7b5c10b2cc99b9a75f15a93c2c2cb09a43
SHA512 66aba7699cd47aee553a9929d09194226f1a8f9e5b71e300dedf26391f0edc6e6f890a9326142b1959db1211176fef0637309a38c45cf903442649137cd9baba
SSDEEP 1536:JF02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7p2Xo:wuYndSW7gILCLIPtqVu5Dqpxhz2Y
TLSH
T1DF0407107640C476F36907314916EAF14969AD396AE8E98FF3B87E391D312C39A7324F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sanfdr.bat

Path C:\Users\Admin\AppData\Local\Temp\sanfdr.bat
Size 342B
SHA256 420fbe26ba96033e2a00040027a006c46e3a2dfb2941c0aee86cd1c76678ebe3
MD5 394560c3b78ec983aa3548cdf53dadae
SHA1 53f8afa9aee5fc360e3138ae660ba6fbea0eb25f
SHA512 cf83363401a61f858ec82bdcef5252ff8e39e80c5707112dadf5983f071b1c8392b62a7ad9bdc90c2cd58e5bbd5344edcf9c01f1037be2a4eb3a4d8404c72b44
TLSH
T102E02600228ADA1A060CE03B0EFAA14CC4E119BC6A863F089721CA8861C692EF683712
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1272-0-0x0000000000CF0000-0x0000000000D1F000-memory.dmp

Download

memory/1272-1-0x0000000000D04000-0x0000000000D05000-memory.dmp

Download

memory/1272-21-0x0000000000CF0000-0x0000000000D1F000-memory.dmp

Download

memory/2920-12-0x0000000000A50000-0x0000000000A7F000-memory.dmp

Download

memory/2920-14-0x0000000000A64000-0x0000000000A65000-memory.dmp

Download

memory/2920-24-0x0000000000A50000-0x0000000000A7F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads