urelas | 157398f99c8f9f606584e0b11db8cbaf0ee832afafcc7fa3f5dde10bbbaf58fd

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_537899fcf7fa103badbad016386bd949_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 396KB
Sample261113-pgalysbx6k
SHA256 157398f99c8f9f606584e0b11db8cbaf0ee832afafcc7fa3f5dde10bbbaf58fd
MD5 537899fcf7fa103badbad016386bd949
SHA1 8b9c43217e3455c55edda1147052d3ade1fafc83
SHA512 7206f5f1a1fe3160623b5c1fd3984f164ac9afbe628caf5ecb07209ea9b0398b536c82aa74c44e29e452ae5f24beb4a8cc694bff5ea8ad6ff9fe6224dbe8357f
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBdC:yIfBoDWoyFboU6hAJQnr8
TLSH
T1D984BD253240C436F32A0B354456EAB149A9BC3915D9E48FF778BE7A5E311938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution urelas trojan

Malware Config

Extracted

Family

urelas

218.54.31.165
218.54.31.226

Signatures

Family: Urelas
Urelas is a trojan targeting card games.
trojan urelas

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	ulpoku.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	2026-11-11_537899fcf7fa103badbad016386bd949_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	xivos.exe

Executes dropped EXE 3 IoCs

pid	Process
372	xivos.exe
3276	ulpoku.exe
2848	mecid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2508	cmd.exe
3316	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ulpoku.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ulpoku.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mecid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_537899fcf7fa103badbad016386bd949_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xivos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ulpoku.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe
2848	mecid.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 372	4668	2026-11-11_537899fcf7fa103badbad016386bd949_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	85
PID 4668 wrote to memory of 2508	4668	2026-11-11_537899fcf7fa103badbad016386bd949_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	86
PID 372 wrote to memory of 3276	372	xivos.exe	88
PID 3276 wrote to memory of 2848	3276	ulpoku.exe	98
PID 3276 wrote to memory of 3316	3276	ulpoku.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-11-11_537899fcf7fa103badbad016386bd949_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_537899fcf7fa103badbad016386bd949_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Temp\xivos.exe
  "C:\Users\Admin\AppData\Local\Temp\xivos.exe" hi
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Users\Admin\AppData\Local\Temp\ulpoku.exe
    "C:\Users\Admin\AppData\Local\Temp\ulpoku.exe" OK
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\mecid.exe
      "C:\Users\Admin\AppData\Local\Temp\mecid.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_vslite.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 412B
SHA256 6f5650ce5d646c20767144827a0487108b4bb353610143198795c302991311f3
MD5 a565df827ea75bdf01375adc23879b5d
SHA1 cddcfbd6ccfbe55ac4fc91ddc12bc34665376d50
SHA512 47dd22ff8f3ebd430fa78240eb2540586f54450a82eb886967a16c9ebfd27649705a693068b1df536760bee1127a331f9e550973ea1997be0401a1b720ffcadf
TLSH
T1E9E09242429FDA3B058CD02F19B9698E819489BA7FC737B47721C26D51D689FB4A3A02
MD5 SHA1 SHA512 TLSH

Submit Download

_vslite.bat

Path C:\Users\Admin\AppData\Local\Temp\_vslite.bat
Size 224B
SHA256 d9fe995df8ed9638e51ca62fb00ca6ac0b9dc4ab25ab3fc40f5f60ec7dd9e403
MD5 41b4d23409e9495255613dd5b1a9d052
SHA1 a407aa0b43e06b7e1e6eaf5cb5844c29a10e9200
SHA512 44b1435a7ca65eac1076ceb8c287ba238310293bdf0f33bd2adcaaf3e7c17c0b0fd8428883095d5a16c20a6efe920e3f301f5fe86426b8082a0a0fca5909e800
TLSH
T123D0C75181D6E75F444C902B07B9618DC1755CAD3F473B11972AC44C61C541DF5C7341
MD5 SHA1 SHA512 TLSH

Submit Download

golfinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Size 512B
SHA256 6beb563130971cfcef675fd8245f712ddbddaaaa0e9e06de8779181ebdfa633b
MD5 301f6d397277df6139168da544f99df6
SHA1 a19d054b234db92df5fa4970e3aafc7c2221f8ee
SHA512 382be426b5021939dd7ef93eff6eade8d345d99cbdb44706fb8b68e252b699f99ef97a60bf02f558056f683d93296a30ba25700bfe010283b1c52284e4013fd1
TLSH
T1C7F02BDD30B0F1303401EE21F3C41F161B83AD8C26CB9E88844870B04877DDC4840213
MD5 SHA1 SHA512 TLSH

Submit Download

mecid.exe

Path C:\Users\Admin\AppData\Local\Temp\mecid.exe
Size 223KB
SHA256 91812aa1475653e226303ff20c1f231f3920b817a1a0dd343078752ca19f8181
MD5 1b138046159dfae3193b587349962d97
SHA1 5121e5f49cd14e3a5936aacf883ff34087bd74dd
SHA512 aec61b96ee258ea09b22139955012c835f830b183b077addbf5898c4bffa1abb7f50ac1c5c5a969232f7e8a7f6a087d1b4d289933797b61cda4e63d36a525127
SSDEEP 6144:PWnFhYfH3TkoCwAyfrgjtM9/WWVGix77p3l:unFhSIkAyDgjtS/FZD
TLSH
T11324E042AA018888F38C4B316A17FAE449858D3C59D5F51FF5BCBD362D3628729B708F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ulpoku.exe

Path C:\Users\Admin\AppData\Local\Temp\ulpoku.exe
Size 396KB
SHA256 9274f7bc0358fb15828d54b889e5c99fccc25daa6c36b95970c8069aacd00f80
MD5 1735b94453be146d76a6044e2ed92c1a
SHA1 a5e7b44dc11e6c163051c106a2d1d0dd3b7c459c
SHA512 79a352f41d7f41d0c201c451b9b47b9fc5be3acceab2a9b06c8a4ec0147695e1bf56466fb62d1ebc97ca12ffbac99d519f4e44c459d67a27f2a813455cc7f3e9
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBdw:yIfBoDWoyFboU6hAJQnrq
TLSH
T19484BD253140C436F32A0B354456EAB149A9BC3915D9E48FF778BE7A5E311938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xivos.exe

Path C:\Users\Admin\AppData\Local\Temp\xivos.exe
Size 396KB
SHA256 1be3e9b9fd2e097eb6209b7c9ec63f181d779f275caf17a3d91282b63d68b3b1
MD5 31c968599b4b2ef10d6e9ba318935f56
SHA1 12bba32fce9ea81470f9a33236febc0e9c94875f
SHA512 c0f60ae6a18e22409a850b0c715c9982974b597e60bbb9e8cefc6da9c7777faef8197fae965a10d23c37d0fb6f7e88099835225a68b3067c3dc25c3e680e1484
SSDEEP 6144:y5SXvBoDWoyLYyzbpPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrBd/:yIfBoDWoyFboU6hAJQnrJ
TLSH
T19384BD253140C436F32A0B354456EAB149A9BC3915D9E48FF778BE7A5E311938B3B24F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/372-14-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/372-10-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/372-27-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2848-46-0x0000000000460000-0x0000000000500000-memory.dmp

Download

memory/2848-40-0x0000000000460000-0x0000000000500000-memory.dmp

Download

memory/2848-45-0x0000000000460000-0x0000000000500000-memory.dmp

Download

memory/2848-47-0x0000000000460000-0x0000000000500000-memory.dmp

Download

memory/2848-48-0x0000000000460000-0x0000000000500000-memory.dmp

Download

memory/2848-49-0x0000000000460000-0x0000000000500000-memory.dmp

Download

memory/3276-29-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3276-28-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3276-43-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4668-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4668-1-0x000000000041C000-0x000000000041D000-memory.dmp

Download

memory/4668-18-0x0000000000400000-0x0000000000467000-memory.dmp

Download