28ed21196fbdccf5b32a0ea9d6ce4b65fe76455674749611a353e1258cb60c10

General

Target
2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Size 871KB
Sample260418-djsd1afw4y
SHA256 28ed21196fbdccf5b32a0ea9d6ce4b65fe76455674749611a353e1258cb60c10
MD5 46bf3944be05ceb50b5e594ba041a1fe
SHA1 3e5b20cfcd7acc28eb342f8ee636872a509b1ac8
SHA512 a1e4ebec81fb385459353d6ce55c956df612bb844b1c151eb9dfb15f185535e47fe9b42cc9177c963e5ee1dbd52b9d66a9fe8d15aded61a26ac545b3c6e6538e
SSDEEP 12288:hSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:ovO2xJKRI2FOkx2LFEvcU6UQOJdT
TLSH
T136156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Custom signature

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000004ec-2.dat	CryptoLocker_rule2

Custom signature

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000004ec-2.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1244	dc568a28

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Destination IP	6	223.5.5.5	2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Destination IP	36	114.114.114.114	2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Destination IP	41	223.5.5.5	2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dc568a28	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	dc568a28
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	dc568a28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\154c38	dc568a28
File opened for modification	C:\Windows\22c9e0	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc568a28

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dc568a28
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	dc568a28
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	dc568a28
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dc568a28
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dc568a28
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dc568a28
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	dc568a28
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	dc568a28
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dc568a28

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1244	dc568a28
1244	dc568a28
1244	dc568a28
1244	dc568a28
1244	dc568a28
1244	dc568a28
1244	dc568a28
1244	dc568a28
1244	dc568a28
1244	dc568a28
1244	dc568a28
1244	dc568a28
2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Token: SeTcbPrivilege	2032	2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Token: SeDebugPrivilege	1244	dc568a28
Token: SeTcbPrivilege	1244	dc568a28

C:\Users\Admin\AppData\Local\Temp\2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_46bf3944be05ceb50b5e594ba041a1fe_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\Syswow64\dc568a28
C:\Windows\Syswow64\dc568a28
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

154c38

Path C:\Windows\154c38
Size 506B
SHA256 e5e7dd54e24ad7af1964eb310227ee83bbd550d8dae68cfb9a779d644adee219
MD5 0a7b34da9b508ad1c2ffa41ef472d561
SHA1 329a901fbd000d8ee356db785906b3305c7aa08c
SHA512 5951ca9b65815aa03bd5943fc07313f7e97b9c0e271fe249911ef236831318c590e3a1d7809352a861ab27870d037858b8d787e1d09eaf2a43d68617ac0fbfe5
TLSH
T1BDF0C97DFD3A22B9099A9EAA471BF6441035912DE00B611569E6FDB089C22EBDE03028
MD5 SHA1 SHA512 TLSH

Submit Download

dc568a28

Path C:\Windows\SysWOW64\dc568a28
Size 871KB
SHA256 2957b24febc4d9ff8ead317d62f49d8430e60d5f24c7a786cfc1a2640a75f55a
MD5 54ccd4d613fbc0058ae3808c70013de4
SHA1 9309918c72839f7d46e67e8756dc3fe33d6b8a94
SHA512 0866f2afbec5c6535faa0a3a3f1f8f508bded64d15799ae694f95ee3522956dd97c92d67f7b6c9c8ea58410557e6476dc12bacf10a2b0e0c7a935b2050a0bd10
SSDEEP 12288:bSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:uvO2xJKRI2FOkx2LFEvcU6UQOJdT
TLSH
T1B3156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-4-0x0000000000420000-0x0000000000483000-memory.dmp

Download

memory/2032-0-0x0000000000580000-0x00000000005E3000-memory.dmp

Download

memory/2032-18-0x0000000000CE0000-0x0000000000D05000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads