Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 02:48
Behavioral task
behavioral1
Sample
2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 560KB
- Sample260416-dagadaev8m
- SHA256 74fb37f464f902589e0a11cebc04cc67afb3f5a88c926595c8247d7abb111e63
- MD5 d80f656ae3c31612f83a3ce319fdfb1a
- SHA1 b3a35758000ea72e5765eb1444f5be3cf7927e4a
- SHA512 3783c7e29a2b8539bb5cc9522106dd39ea7755032ddc5993aa4d51859857cdf3547955a3d881f2a81c833c8a849589cc16ca4b6f026934d6e1be663a5fbf8e07
- SSDEEP 6144:hgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:hI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T197C48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/2848-0-0x00000000006C0000-0x000000000074C000-memory.dmp UPX behavioral2/files/0x00120000000256b8-2.dat UPX behavioral2/memory/2292-4-0x0000000000A20000-0x0000000000AAC000-memory.dmp UPX behavioral2/memory/2848-17-0x00000000006C0000-0x000000000074C000-memory.dmp UPX behavioral2/memory/2292-19-0x0000000000A20000-0x0000000000AAC000-memory.dmp UPX behavioral2/memory/2292-43-0x0000000000A20000-0x0000000000AAC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 2292 683c7cc8 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 9 223.5.5.5 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 1 114.114.114.114 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 2 223.5.5.5 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 8 114.114.114.114 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 683c7cc8 File created C:\Windows\SysWOW64\683c7cc8 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 683c7cc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 683c7cc8 -
resource yara_rule behavioral2/memory/2848-0-0x00000000006C0000-0x000000000074C000-memory.dmp upx behavioral2/files/0x00120000000256b8-2.dat upx behavioral2/memory/2292-4-0x0000000000A20000-0x0000000000AAC000-memory.dmp upx behavioral2/memory/2848-17-0x00000000006C0000-0x000000000074C000-memory.dmp upx behavioral2/memory/2292-19-0x0000000000A20000-0x0000000000AAC000-memory.dmp upx behavioral2/memory/2292-43-0x0000000000A20000-0x0000000000AAC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\273d68 683c7cc8 File opened for modification C:\Windows\30c240 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 683c7cc8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 683c7cc8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 683c7cc8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 683c7cc8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 683c7cc8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 683c7cc8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 683c7cc8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 683c7cc8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 683c7cc8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 683c7cc8 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2292 683c7cc8 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 2848 2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 2292 683c7cc8 Token: SeTcbPrivilege 2292 683c7cc8
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_d80f656ae3c31612f83a3ce319fdfb1a_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
C:\Windows\Syswow64\683c7cc8C:\Windows\Syswow64\683c7cc81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\273d68
- Size 916B
- SHA256 cb47e8590e7e21bc256707acd7804d652a874603c2671685c54a1bbd091b194b
- MD5 56d194ca04dd4501ae2642ce53ece3db
- SHA1 e2d96c50e891a70054f00d11083effccf9d80051
- SHA512 5a881b0b455838888442dd425eeeed021c63d8cc9f00b8df20e6ea43c205827f1af723c7c8395178c145e1f107b0a50e181b73e1a564381c2949d7ef613a84e2
- TLSH T11B1197FB30DA5B7788618EA5530392CA7211F04AE42772FA7DC16187251723ACCBBA03
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\683c7cc8
- Size 560KB
- SHA256 c17259b3e19f8a5589e15953eb0b082227e768234c84f4396ff2e2b694f2a1fe
- MD5 6a8772ccdfb7edb781eeca93896692de
- SHA1 18296e7e3a45d1d7cabe7da1a552d3a625aaa5e6
- SHA512 ddf89fdafa9442e9324a05e9c925edef227a350f7c09825bb087fdc0621ad901f4f6b9bac0a99a2c4d43548913cbceb7b27b478a630282667d387c6b7046e01a
- SSDEEP 6144:Tgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:TI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T1B8C48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA7D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH