urelas | 07de10a398bb280300326bb8a0c54012c1db004a2f85525ddb1b961d794d11ae

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 21:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_c07b1a454d8cc10639107dd377f2a4da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 786KB
Sample261111-z6psaaca69
SHA256 07de10a398bb280300326bb8a0c54012c1db004a2f85525ddb1b961d794d11ae
MD5 c07b1a454d8cc10639107dd377f2a4da
SHA1 f09682cfd31495750f1d96e84bb2a56dd6910f50
SHA512 ce6259bb76e81a4c0df03da318f3674ab94d05fd3c0fb0e94bd3e5e291414c18a130e00664dbe5db58304e3829d319c406bd2fdcacda9f9e53a2425aa98946a1
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEg1:d7dLBftJLW5YUWLrkJB0PJg1
TLSH
T1E30501213580C43AF71A07354441EAE44E7ABC7B18D1A65FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Custom signature

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/3324-0-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x002200000001c549-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4668-14-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3324-22-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5212-33-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4668-32-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5212-34-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5212-53-0x0000000000400000-0x00000000004CB000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 3 IoCs

pid	Process
4668	wicif.exe
5212	hofume.exe
5084	peiki.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1540	cmd.exe
2872	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	hofume.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	hofume.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hofume.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	peiki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_c07b1a454d8cc10639107dd377f2a4da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wicif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe
5084	peiki.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 4668	3324	2026-11-10_c07b1a454d8cc10639107dd377f2a4da_amadey_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3324 wrote to memory of 1540	3324	2026-11-10_c07b1a454d8cc10639107dd377f2a4da_amadey_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 4668 wrote to memory of 5212	4668	wicif.exe	93
PID 5212 wrote to memory of 5084	5212	hofume.exe	95
PID 5212 wrote to memory of 2872	5212	hofume.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-11-10_c07b1a454d8cc10639107dd377f2a4da_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_c07b1a454d8cc10639107dd377f2a4da_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\wicif.exe
  "C:\Users\Admin\AppData\Local\Temp\wicif.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Users\Admin\AppData\Local\Temp\hofume.exe
    "C:\Users\Admin\AppData\Local\Temp\hofume.exe" OK
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\peiki.exe
      "C:\Users\Admin\AppData\Local\Temp\peiki.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 384B
SHA256 ab098113e99aabba73a9bbea00533e28e13f129f131f8ad521ba5c643c12aece
MD5 2a023cb6cdef861cbdc603cd2279d60e
SHA1 a3cb2a57f07509a92d4ca9492a2d67b3a1b0da71
SHA512 9dd1870b3f9a03bafbcc236b8424f2dd45b7129a487c62eb8d240e22c0b73917cbe409d79dec1c735fbd64ddfdc71ebe1e8396560d58bf09fbc2c9e2afd3e1d3
TLSH
T127E06803A06EDF2E0608C02F0DF6644D842249A93E8A3B667710C2CC61D542FF192262
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 1be45245cbbac3443ec0088424974f984885b10f33f0f5f931a1d66c7b0ac095
MD5 0970fbbb823f8f40484dd121ee53574f
SHA1 97bd11bd54fe899541b42bd24554559d85810269
SHA512 8be3cbd21244adedeee07d978f0757f696edc60e3e301a8e9f8b4a8c6918ca2e2a7abb02f3b9288f9a008d1f28a2a3c460e99f1b21b57ea61e07632369d7df9c
TLSH
T17BD0C71241DAE75F0448902B0AB5A38DC0B54C5C3F473B119B25C44C22C141DFDC7352
MD5 SHA1 SHA512 TLSH

Submit Download

gbp.ini

Path C:\Users\Admin\AppData\Local\Temp\gbp.ini
Size 104B
SHA256 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
MD5 dbef593bccc2049f860f718cd6fec321
SHA1 e7e9f8235b4eb70aa99dd2c38009f2152575a8d0
SHA512 3e87c661c343b72f5dff4587b99688dbf655be9d6d903a75151bd9f204f55858e90388591f660bcbded5278ef94e322bf3e7c57374c9b16fce1eef7082395a2a
MD5 SHA1 SHA512

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 826af39418c6bf69f34f9f358b6b156a7afbccaf4bc29a6818e83b6ec9b43a8c
MD5 b30915c84096b8f7fa5ec97402661090
SHA1 6c4f634460f3344fc9825d2c44846c3f4cd9eecd
SHA512 47eb08de95e7fb6034d64410eeca2700bcb03eb2de737409c433da5830e0376d14241693fe750aa744a8d51f7cf970cd563135a4a13091a6367bf3b8fadc0b09
TLSH
T1B8F09BD22176F1553712F213D7A41FDA37D34D591D83DC500409B1714EB5C5C44843A6
MD5 SHA1 SHA512 TLSH

Submit Download

peiki.exe

Path C:\Users\Admin\AppData\Local\Temp\peiki.exe
Size 601KB
SHA256 a98c34e7bf3f8dbffda859c369d3fe86512b4f57df42a22fa42083e6ee9b84ac
MD5 0093af42473b2e1fad5624f9f9b444d2
SHA1 f06f5c56290a4499953aa336df22a1f07be7292e
SHA512 d392a19116ecf84f7c04b7ec71f8d9d4da56f39aaaea5bc9c346b0b0c7072999c93a567f8e0875739fb75988bd8807ce23f9a9b3eef286c4a98b1e75b76182af
SSDEEP 12288:g0/ofE9N0dFaDXAm8Ip9lNfgK4eLS9xHAyZq/G7yq/yWq4qe4MJuC6Pmm:gBfCIFaUmplN4K/sxgyZ9u2JpL4MJuC+
TLSH
T14DD4238FE3953634FD09673398FE83211128AEDC46854D9272D729CAD6B718F8F68708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wicif.exe

Path C:\Users\Admin\AppData\Local\Temp\wicif.exe
Size 786KB
SHA256 13dde2d1a118095198371d3e49c30fe99d15983f153e43ddc440b225efc8fe03
MD5 44e06481659b3381b9c3874a335844b4
SHA1 29a8fd35a7a151311ab5eeaf9ae960c79f30d0bd
SHA512 bcccd31a31fe490598434d03c1ef6e3e0d20fef16263255ee7290abe87685599908de7e9dd4e976c397813c37024f4c98b5949e2656e1269a45c6007a3108df8
SSDEEP 12288:d7dL4AkwWNk82HAEGfKKBhVGT5OY8pgA65t8mv5pThkJ8HxW0d8GYEg8:d7dLBftJLW5YUWLrkJB0PJg8
TLSH
T1290501213580C43AF71A07354441EAE44E7ABC7B18D1A64FFB787D36A9320579B3B28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3324-3-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/3324-22-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3324-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4668-32-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/4668-14-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5084-45-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/5084-56-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/5212-34-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5212-33-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/5212-53-0x0000000000400000-0x00000000004CB000-memory.dmp

Download