Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 08:07
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
- Size 1.3MB
- Sample260420-jz97msgx6y
- SHA256 d8444717f8927a6c22f9289c3e75db40af0587de9428cecedeb46232d2dd239f
- MD5 84867c5578d52e7369ab5ae624adf324
- SHA1 9aa50c82830934d353817d7299ab5a0acec70005
- SHA512 87c89c459d4e9bd53ddf251a8852ab8cd908974bf059996cae96f38c7a792cfa82e68b6c37ffe4e5654a6254f3333f7283cac0e7431905a338aa85bc8421f364
- SSDEEP 24576:KvO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:KHHKO29QG56/OJdJCXDrsl
- TLSH T1C0559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000a00000002275b-2.dat CryptoLocker_rule2 - Custom signatureDetection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000a00000002275b-2.dat CryptoLocker_set1 - Executes dropped EXE 1 IoCs
pid Process 3060 876131f4 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 6 223.5.5.5 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe Destination IP 42 114.114.114.114 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe Destination IP 43 223.5.5.5 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe Destination IP 3 114.114.114.114 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\876131f4 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 876131f4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 876131f4 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\346368 876131f4 File opened for modification C:\Windows\53d240 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 876131f4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 876131f4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 876131f4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 876131f4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 876131f4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 876131f4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 876131f4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 876131f4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 876131f4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 876131f4 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 3060 876131f4 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe Token: SeTcbPrivilege 4896 2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe Token: SeDebugPrivilege 3060 876131f4 Token: SeTcbPrivilege 3060 876131f4
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_84867c5578d52e7369ab5ae624adf324_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
C:\Windows\Syswow64\876131f4C:\Windows\Syswow64\876131f41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\346368
- Size 1012B
- SHA256 8eb3f51bdbeeb284662c72f85a91d48246e0bf8a6d5907c71b186cf4b99b2fa3
- MD5 3e3bfd0aa699b8569c3e6c5abaf09eb9
- SHA1 28749676a471eec831848116832f12fcabfcce04
- SHA512 c2c6c6559271cf63f21d42b7568fa798a9ebe3047b00ebf927d031b5601bbc09a929d1e16df176a1e204f5ed4817a2058fdafb1f96423302426b71ce3ae06f83
- TLSH T18E11EF3FE82AA396CBFE1EF65B17686B311A611DC51B2BA63AC1F10505971525F0300A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\876131f4
- Size 1.3MB
- SHA256 d06f6791bde83da8216bcf6b2e947a96a90810278a6d52af4e1ee6a6f9e6003b
- MD5 d6d316380afcdb0487f0cee363ce31bc
- SHA1 282abdea5b55c088bb8ac8b3f5e92eb8637bfe63
- SHA512 0145cec013f2f2fcc6efe3afc2049cb695016adc682c33151d91ed8e5e29bf4a5600d8670319edc3e3b8449d1574ba47980df668db6ba1e847fe93fa4c0f4529
- SSDEEP 24576:nvO2xJKRI2FOkx2LFEvcU6UQOJdBqsCPhH9Do2sl:nHHKO29QG56/OJdJCXDrsl
- TLSH T100559E32A6808036E5B3467586FA57BAA5257C215321E1CF73C47A2E1FB37D3A93170E
- MD5 SHA1 SHA512 SSDEEP TLSH