urelas | 9bc3d6cc96c6d08856e12e44877362989942bca9ed64c3a5b144fbdd2b7cfaef

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/11/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_c562c6318fbd788687f16f8347577c41_amadey_elex_smoke-loader_stop.exe
Size 584KB
Sample261112-g28eqaev9y
SHA256 9bc3d6cc96c6d08856e12e44877362989942bca9ed64c3a5b144fbdd2b7cfaef
MD5 c562c6318fbd788687f16f8347577c41
SHA1 954d442b3b923a3a979f198ad602b7d311343f12
SHA512 5af8ded881bbfa7b7faf39a4cbbed980c0ebe8c78bb886fdcf28344d682b8164ea2409267f44b02a53626e1cb892806cf72862437fcdc08425179c3ba7c34a0a
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgto:SnPfQpziAkI09HLMgG
TLSH
T191D4C0243B90C072E3662B754896F7B516BA7C345A64968FF3A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Executes dropped EXE 1 IoCs

pid	Process
5844	syovz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syovz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_c562c6318fbd788687f16f8347577c41_amadey_elex_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 5844	4352	2026-11-11_c562c6318fbd788687f16f8347577c41_amadey_elex_smoke-loader_stop.exe	89
PID 4352 wrote to memory of 6092	4352	2026-11-11_c562c6318fbd788687f16f8347577c41_amadey_elex_smoke-loader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-11_c562c6318fbd788687f16f8347577c41_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_c562c6318fbd788687f16f8347577c41_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\syovz.exe
  "C:\Users\Admin\AppData\Local\Temp\syovz.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uinsey.bat

Path C:\Users\Admin\AppData\Local\Temp\_uinsey.bat
Size 358B
SHA256 f0814b4dd16546e12b39f6efdace2f9c670ee64d7f2eb9f7140e7d6f225a37d5
MD5 59ca1bf1da3833d8bb81c559b1e24f0b
SHA1 d5424fe4a555bd6e9193fbf96bfb94381ea72b2b
SHA512 6b7532ce5a58d14094ea84ce0caf6091c2fcee81a893f66007b0489ac46ad8e999e6b5efa4dadac0ee12290c81dc6ba9e4af6763fd4c901eabfff06533f2eb78
TLSH
T115E0260142AFEEAE0004D02B0AB77D8EC1A04CED3F833BB47221C59C63D08ADB8D3246
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 7a997b973a4c614fc1a342dd4ad26722f332a757512b07dc2b467f64aa058f18
MD5 34b8bfec274686926bfee6f2d82c56a4
SHA1 f420b835c0c0bd6a0dbae7e44794e01905e06ec4
SHA512 d8800bd2f60cb629b3ce54bb2e48c7f4570021fdc355e0396da10a1b8fbc336c8209f183c5f7480fc4779d305031a1d2c00414437d43a3c5bed44a7ba8d8e60e
TLSH
T159F08CC21020B0043202F632C38023E00B830C9803878D80030576B04937A1C40543A3
MD5 SHA1 SHA512 TLSH

Submit Download

syovz.exe

Path C:\Users\Admin\AppData\Local\Temp\syovz.exe
Size 584KB
SHA256 0a59d32ea0a75177edc7a87a2870d079354e2dad5c6c154780c79fde108c6321
MD5 a3c64e254a9d307519d9c52fed07bacb
SHA1 ed0ecf9bfb9e97c7c8b4d9bfd28cdc721eed5b7a
SHA512 b0c20c2ed4c478cd3dac4a154aff3731ffd85b588bc33fc2ba38efa6b350b0acc3ae19eca402b35571aea9018cd9df8a64ca8603cb3a7619424a1e1e6b1d4313
SSDEEP 12288:SccNvdRExZGe+Q1nzPqmoWkI09HPZkiMgtk:SnPfQpziAkI09HLMgq
TLSH
T1B1D4C0243B90C072E3662B754896F7B516BA7C345A64968FF3A43B399E301934B2734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4352-0-0x0000000001000000-0x00000000010CF000-memory.dmp

Download

memory/4352-1-0x0000000001029000-0x000000000102A000-memory.dmp

Download

memory/4352-21-0x0000000001000000-0x00000000010CF000-memory.dmp

Download

memory/5844-12-0x0000000000230000-0x00000000002FF000-memory.dmp

Download

memory/5844-18-0x0000000000259000-0x000000000025A000-memory.dmp

Download

memory/5844-24-0x0000000000230000-0x00000000002FF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads