Analysis
- max time kernel
150s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
14/04/2026, 14:35
Behavioral task
behavioral1
Sample
2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe
- Size 3.9MB
- Sample260414-rx93vsdt4p
- SHA256 bf3cbace81e39e67d34f5cb082868e09770c8fe9441ff508ef6ed2abcb7ec6c8
- MD5 419441d04403a4bd28add43986a097df
- SHA1 67abf2afbcca5ff5643eea077c314737f0f68f56
- SHA512 ff10bffbf0382b7b5bbe61ce824c67de8190f1f312d834131e2430802894a83a6e60b8787f5c6af959bf80249af2590c6e73dfab127fbe3ddbfe7c367ad9297e
- SSDEEP 49152:HYcMgYcMtHtYcMgYcMtHVYcMhnYcMnPji0Aj:H5J5e5J525en5Ujo
- TLSH T11D166C01B7EB813AECB30A7889B666759735BE154B20C6CF03607E5E3E726C19D34366
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 3 IoCs
resource yara_rule behavioral2/memory/3884-14-0x0000000000400000-0x0000000000424000-memory.dmp family_soulclose behavioral2/memory/2476-16-0x0000000000400000-0x0000000000424000-memory.dmp family_soulclose behavioral2/memory/2476-31-0x0000000000400000-0x0000000000424000-memory.dmp family_soulclose - UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/3884-0-0x0000000000400000-0x0000000000424000-memory.dmp UPX behavioral2/files/0x001d00000002b453-9.dat UPX behavioral2/memory/3884-14-0x0000000000400000-0x0000000000424000-memory.dmp UPX behavioral2/memory/2476-16-0x0000000000400000-0x0000000000424000-memory.dmp UPX behavioral2/files/0x000300000002a19d-26.dat UPX behavioral2/memory/2476-31-0x0000000000400000-0x0000000000424000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 2476 CCTV.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf CCTV.exe File created C:\autorun.inf CCTV.exe File opened for modification F:\autorun.inf CCTV.exe File created F:\autorun.inf CCTV.exe -
resource yara_rule behavioral2/memory/3884-0-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/files/0x001d00000002b453-9.dat upx behavioral2/memory/3884-14-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/2476-16-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/files/0x000300000002a19d-26.dat upx behavioral2/memory/2476-31-0x0000000000400000-0x0000000000424000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe CCTV.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaw.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe CCTV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe CCTV.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe CCTV.exe File opened for modification C:\Program Files\7-Zip\7zG.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe CCTV.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe CCTV.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\CCTV.exe CCTV.exe File created C:\Windows\CCTV.exe 2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe File opened for modification C:\Windows\CCTV.exe 2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3884 2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe 2476 CCTV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3884 wrote to memory of 776 3884 2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe 79 PID 3884 wrote to memory of 2476 3884 2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stopkill.bat2⤵
- System Location Discovery: System Language Discovery
PID:776
-
-
C:\Windows\CCTV.exeC:\Windows\CCTV.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2476
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.4MB
- SHA256 59256eaf3b672ab3c8d26a7832eb5b1d37109402f4f960da94c6aa615e23b40a
- MD5 59c3f2205fd1fc683551c65efd8b15b2
- SHA1 cf8eef699384fc3a938c17f0d7f60778ead571a5
- SHA512 e7d1c0b186a066509d1ae8752e910a952800dfe95d83025d5868021974965a3e27d36d22a76ee0a841bd0ebd5c5217acca6f6c87ce2e320d78be4a8f330aa058
- SSDEEP 49152:HYcMgYcMtHtYcMgYcMtHVYcMhnYcMnPji0AjKPji0Aj:H5J5e5J525en5Ujo8jo
- TLSH T16F266C01B7EB813AECB34AB889B66669E7357E150730C6CF0350BE5D3E726C19935362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-14_419441d04403a4bd28add43986a097df_amadey_coinminer_elex_emotet_smoke-loader_stopkill.bat
- Size 304B
- SHA256 d9dd67169f198bebacf122839700e6f7e171a51893ec6999d5106fa06caa421e
- MD5 24fa6ee6427fd05d17416cf88f971a08
- SHA1 ebaf3e1d5f9c410ecd397f3991959e8d46ec7f34
- SHA512 9dcd5f22d541a4eca3f93355993b458c1fad97b438191545576abdc4e45a1d308e66fa2d7c66d388fb62a89a3e67f2b7b83f910c09e9d7eeeb2763dac72e441a
- TLSH T136E0C24E2166DFAA65C4E94F46FA684CC29026A32E863776B531C1FC6AD24D9B152202
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\CCTV.exe
- Size 3.9MB
- SHA256 bf3cbace81e39e67d34f5cb082868e09770c8fe9441ff508ef6ed2abcb7ec6c8
- MD5 419441d04403a4bd28add43986a097df
- SHA1 67abf2afbcca5ff5643eea077c314737f0f68f56
- SHA512 ff10bffbf0382b7b5bbe61ce824c67de8190f1f312d834131e2430802894a83a6e60b8787f5c6af959bf80249af2590c6e73dfab127fbe3ddbfe7c367ad9297e
- SSDEEP 49152:HYcMgYcMtHtYcMgYcMtHVYcMhnYcMnPji0Aj:H5J5e5J525en5Ujo
- TLSH T11D166C01B7EB813AECB30A7889B666759735BE154B20C6CF03607E5E3E726C19D34366
- MD5 SHA1 SHA512 SSDEEP TLSH