Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 06:48
Behavioral task
behavioral1
Sample
2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 761KB
- Sample260416-hktexag14k
- SHA256 80e710da13bf84b0e3746909cf99acf371ae0d5e80046a0a243ade63ec02279a
- MD5 184fb9e66afcb6687e55265e3c1323e5
- SHA1 e3bb650cae7ddcd6129bca38e8f8b4530c2e9c25
- SHA512 70ef31d26021fff4488fa2f2cf38784d9eb33523eae38d81a8173db78e8565f8535af48a9c772c5207cbb416adcbc6f661702c9907dade9785dec49feca2ff40
- SSDEEP 12288:mSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:FvO2xJKRw2kOkxSkW298B
- TLSH T129F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/8-0-0x00000000002E0000-0x000000000036C000-memory.dmp UPX behavioral2/memory/5100-4-0x0000000000390000-0x000000000041C000-memory.dmp UPX behavioral2/files/0x0010000000027002-3.dat UPX behavioral2/memory/8-15-0x00000000002E0000-0x000000000036C000-memory.dmp UPX behavioral2/memory/5100-16-0x0000000000390000-0x000000000041C000-memory.dmp UPX behavioral2/memory/5100-36-0x0000000000390000-0x000000000041C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 5100 fe32acdc - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 50 114.114.114.114 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 83 114.114.114.114 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 143 223.5.5.5 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 1 114.114.114.114 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 2 223.5.5.5 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 51 223.5.5.5 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 84 223.5.5.5 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 142 114.114.114.114 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 26 114.114.114.114 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 27 223.5.5.5 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C fe32acdc File created C:\Windows\SysWOW64\fe32acdc 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 fe32acdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fe32acdc -
resource yara_rule behavioral2/memory/8-0-0x00000000002E0000-0x000000000036C000-memory.dmp upx behavioral2/memory/5100-4-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0010000000027002-3.dat upx behavioral2/memory/8-15-0x00000000002E0000-0x000000000036C000-memory.dmp upx behavioral2/memory/5100-16-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/memory/5100-36-0x0000000000390000-0x000000000041C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\575058 fe32acdc File opened for modification C:\Windows\2310 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe32acdc - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fe32acdc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fe32acdc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fe32acdc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fe32acdc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fe32acdc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fe32acdc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fe32acdc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fe32acdc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fe32acdc - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5100 fe32acdc 5100 fe32acdc 5100 fe32acdc 5100 fe32acdc 5100 fe32acdc 5100 fe32acdc 5100 fe32acdc 5100 fe32acdc 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 8 2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 5100 fe32acdc Token: SeTcbPrivilege 5100 fe32acdc
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_184fb9e66afcb6687e55265e3c1323e5_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
-
C:\Windows\Syswow64\fe32acdcC:\Windows\Syswow64\fe32acdc1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\fe32acdc
- Size 761KB
- SHA256 fd93d1cbf746c88c9b2366eb4ffbd321f3ec5547c1bfac57024ea2b1c0b66046
- MD5 a401198d2ecb19b8f1d9f34c7a072c49
- SHA1 871a692674b63da8122b40612685fac8ddf9c939
- SHA512 18abf4e8f07c15306e3b5bdbeb722a614c8c4730246b3b7ee285448618cc9482e431167a0f32d99cb87bed19b6ea5c245ffd89598ba87f543f7f8893a1af4b88
- SSDEEP 12288:BSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:IvO2xJKRw2kOkxSkW298B
- TLSH T158F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH