Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 22:16
Behavioral task
behavioral1
Sample
2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe
- Size 618KB
- Sample260415-1636caaz8p
- SHA256 2dbc138c518035af8fb7ace970f4bc6f68df7964a4212d1a14beefd337c1554b
- MD5 4f86304a21add096d0859e78d9a77093
- SHA1 3d0828877a17db0559270646e5bc93b318204ad2
- SHA512 cdda956e4bb043d99c6632b899122c640240492b7911efb60e713e66e48a74d8296718dc8a0d7e1f5875e2d5b4fab1a9281f0f03e3082f7893a1f57d227bf8d8
- SSDEEP 12288:pqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:pjHPOSOkx2LFscUQPxW
- TLSH T1D5D47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/4424-0-0x0000000000EE0000-0x0000000000F69000-memory.dmp UPX behavioral1/files/0x000a00000001f15c-2.dat UPX behavioral1/memory/4824-4-0x0000000000E10000-0x0000000000E99000-memory.dmp UPX behavioral1/memory/4424-23-0x0000000000EE0000-0x0000000000F69000-memory.dmp UPX behavioral1/memory/4824-25-0x0000000000E10000-0x0000000000E99000-memory.dmp UPX behavioral1/memory/4424-37-0x0000000000EE0000-0x0000000000F69000-memory.dmp UPX behavioral1/memory/4824-38-0x0000000000E10000-0x0000000000E99000-memory.dmp UPX behavioral1/memory/4424-49-0x0000000000EE0000-0x0000000000F69000-memory.dmp UPX behavioral1/memory/4424-54-0x0000000000EE0000-0x0000000000F69000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 4824 f6e6be68 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe Destination IP 4 223.5.5.5 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe Destination IP 43 114.114.114.114 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe Destination IP 46 223.5.5.5 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f6e6be68 File created C:\Windows\SysWOW64\f6e6be68 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache f6e6be68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData f6e6be68 -
resource yara_rule behavioral1/memory/4424-0-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/files/0x000a00000001f15c-2.dat upx behavioral1/memory/4824-4-0x0000000000E10000-0x0000000000E99000-memory.dmp upx behavioral1/memory/4424-23-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/memory/4824-25-0x0000000000E10000-0x0000000000E99000-memory.dmp upx behavioral1/memory/4424-37-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/memory/4824-38-0x0000000000E10000-0x0000000000E99000-memory.dmp upx behavioral1/memory/4424-49-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx behavioral1/memory/4424-54-0x0000000000EE0000-0x0000000000F69000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4bbd90 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\5296b0 f6e6be68 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6e6be68 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f6e6be68 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f6e6be68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" f6e6be68 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing f6e6be68 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f6e6be68 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f6e6be68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" f6e6be68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" f6e6be68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" f6e6be68 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4824 f6e6be68 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe Token: SeTcbPrivilege 4424 2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe Token: SeDebugPrivilege 4824 f6e6be68 Token: SeTcbPrivilege 4824 f6e6be68
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_4f86304a21add096d0859e78d9a77093_amadey_coinminer_elex_remcos_smoke-loader.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
C:\Windows\Syswow64\f6e6be68C:\Windows\Syswow64\f6e6be681⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\f6e6be68
- Size 618KB
- SHA256 8fd235bfab1b2f2ac2335917d92931e6e26c69ddeaeb4031259ad36057e838e8
- MD5 7bbc081f2c500eb4c79ac371877c0291
- SHA1 dfb017ee0de592b7a1187ee5bb8fdb7d89884607
- SHA512 9b14e6b6708cd4f8ac2b147e99c4e036367fc1c5cb8c20e086d0f18723a439d751e0c53775535bc2e6a33c11104839c812a0509d0d3ff8e34ddb9c86f99ceb95
- SSDEEP 12288:VqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:VjHPOSOkx2LFscUQPxW
- TLSH T151D47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH