Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 11:42
General
- Target 2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
- Size 3.1MB
- Sample260420-nvanfads7t
- SHA256 59c8fc8fe3fb09c043e4b71cd1b15b70efd0532fa40e78275eea3e1739955099
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 23 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/224-88-0x000001CF686B0000-0x000001CF68716000-memory.dmp
memory/224-89-0x000001CF686B0000-0x000001CF68716000-memory.dmp
memory/224-87-0x000001CF684B0000-0x000001CF68587000-memory.dmp
memory/332-223-0x000001B9A17B0000-0x000001B9A17BC000-memory.dmp
memory/332-201-0x00007FF7BEF00000-0x00007FF7BF0EF000-memory.dmp
memory/332-153-0x000001B9A1E50000-0x000001B9A1EB6000-memory.dmp
memory/332-152-0x000001B9A1E50000-0x000001B9A1EB6000-memory.dmp
memory/332-151-0x00007FF7BEF00000-0x00007FF7BF0EF000-memory.dmp
memory/692-197-0x00000220009B0000-0x0000022000B51000-memory.dmp
memory/692-178-0x00007FF73AA50000-0x00007FF73AB3A000-memory.dmp
memory/692-97-0x0000022000900000-0x0000022000966000-memory.dmp
memory/692-95-0x00007FF73AA50000-0x00007FF73AB3A000-memory.dmp
memory/692-96-0x0000022000900000-0x0000022000966000-memory.dmp
memory/724-0-0x0000000002AC0000-0x0000000002BF2000-memory.dmp
memory/724-116-0x00000000011E0000-0x000000000128F000-memory.dmp
memory/724-1-0x0000000002D00000-0x0000000002D69000-memory.dmp
memory/724-6-0x0000000002D00000-0x0000000002D69000-memory.dmp
memory/860-173-0x00007FF627BC0000-0x00007FF627FE9000-memory.dmp
memory/860-169-0x000001FCB51E0000-0x000001FCB5246000-memory.dmp
memory/860-177-0x00007FF627BC0000-0x00007FF627FE9000-memory.dmp
memory/860-174-0x000001FCB51E0000-0x000001FCB5246000-memory.dmp
memory/860-168-0x000001FCB51E0000-0x000001FCB5246000-memory.dmp
memory/860-176-0x000001FCB4A40000-0x000001FCB4BE1000-memory.dmp
memory/932-25-0x00007FF6D1160000-0x00007FF6D1244000-memory.dmp
memory/932-103-0x00007FF6D1160000-0x00007FF6D1244000-memory.dmp
memory/932-26-0x0000025AB74C0000-0x0000025AB7526000-memory.dmp
memory/932-27-0x0000025AB74C0000-0x0000025AB7526000-memory.dmp
memory/932-28-0x0000025AB74C0000-0x0000025AB7526000-memory.dmp
memory/1484-104-0x0000000000400000-0x000000000054A000-memory.dmp
memory/1484-105-0x0000000000880000-0x00000000008E9000-memory.dmp
memory/1484-110-0x0000000000880000-0x00000000008E9000-memory.dmp
memory/1484-181-0x0000000000400000-0x000000000054A000-memory.dmp
memory/1540-34-0x00007FF781AE0000-0x00007FF781D68000-memory.dmp
memory/1540-36-0x0000025C4BDA0000-0x0000025C4BE06000-memory.dmp
memory/1540-35-0x0000025C4BDA0000-0x0000025C4BE06000-memory.dmp
memory/1540-40-0x0000025C4BDA0000-0x0000025C4BE06000-memory.dmp
memory/1540-42-0x0000025C4B5B0000-0x0000025C4B751000-memory.dmp
memory/1540-43-0x00007FF781AE0000-0x00007FF781D68000-memory.dmp
memory/2112-48-0x0000021FBF2B0000-0x0000021FBF316000-memory.dmp
memory/2112-47-0x0000021FBF2B0000-0x0000021FBF316000-memory.dmp
memory/2112-46-0x0000021FBF0B0000-0x0000021FBF187000-memory.dmp
memory/2148-296-0x000002E168660000-0x000002E168670000-memory.dmp
memory/2148-297-0x000002E168660000-0x000002E168670000-memory.dmp
memory/2304-203-0x000001C5EADB0000-0x000001C5EAE16000-memory.dmp
memory/2304-204-0x00007FF601250000-0x00007FF60177B000-memory.dmp
memory/2304-202-0x000001C5EADB0000-0x000001C5EAE16000-memory.dmp
memory/2304-278-0x00007FF601250000-0x00007FF60177B000-memory.dmp
memory/2748-15-0x0000024E68610000-0x0000024E68676000-memory.dmp
memory/2748-17-0x0000024E68610000-0x0000024E68676000-memory.dmp
memory/2748-14-0x00007FF6DE960000-0x00007FF6DEA47000-memory.dmp
memory/2748-74-0x00007FF6DE960000-0x00007FF6DEA47000-memory.dmp
memory/3008-211-0x00007FF7A3CA0000-0x00007FF7A3E2F000-memory.dmp
memory/3008-159-0x00007FF7A3CA0000-0x00007FF7A3E2F000-memory.dmp
memory/3008-161-0x0000025B89E60000-0x0000025B89EC6000-memory.dmp
memory/3008-160-0x0000025B89E60000-0x0000025B89EC6000-memory.dmp
memory/3084-214-0x0000018149030000-0x0000018149096000-memory.dmp
memory/3084-219-0x00007FF64C8E0000-0x00007FF64CA1B000-memory.dmp
memory/3084-215-0x0000018149030000-0x0000018149096000-memory.dmp
memory/3084-279-0x00007FF64C8E0000-0x00007FF64CA1B000-memory.dmp
memory/3196-230-0x000001916B590000-0x000001916B5A0000-memory.dmp
memory/3196-225-0x00007FF7D99E0000-0x00007FF7D9D34000-memory.dmp
memory/3196-226-0x000001916A630000-0x000001916A696000-memory.dmp
memory/3196-283-0x00007FF7D99E0000-0x00007FF7D9D34000-memory.dmp
memory/3196-246-0x000001916B7C0000-0x000001916B7D0000-memory.dmp
memory/3196-286-0x0000019174E30000-0x0000019174E38000-memory.dmp
memory/3196-262-0x0000019173B80000-0x0000019173B88000-memory.dmp
memory/3196-224-0x000001916A630000-0x000001916A696000-memory.dmp
memory/3296-54-0x00000254A0AD0000-0x00000254A0BA7000-memory.dmp
memory/3296-56-0x00000254A0CD0000-0x00000254A0D36000-memory.dmp
memory/3296-55-0x00000254A0CD0000-0x00000254A0D36000-memory.dmp
memory/3304-126-0x000001C760720000-0x000001C760786000-memory.dmp
memory/3304-187-0x00007FF76DCD0000-0x00007FF76E13D000-memory.dmp
memory/3304-210-0x00007FF76DCD0000-0x00007FF76E13D000-memory.dmp
memory/3304-208-0x000001C760720000-0x000001C760786000-memory.dmp
memory/3304-127-0x00007FF76DCD0000-0x00007FF76E13D000-memory.dmp
memory/3304-125-0x000001C760720000-0x000001C760786000-memory.dmp
memory/3368-144-0x0000010A1EA70000-0x0000010A1EAD6000-memory.dmp
memory/3368-198-0x00007FF6D6830000-0x00007FF6D6B54000-memory.dmp
memory/3368-143-0x0000010A1EA70000-0x0000010A1EAD6000-memory.dmp
memory/3368-142-0x00007FF6D6830000-0x00007FF6D6B54000-memory.dmp
memory/3444-76-0x00000193F7230000-0x00000193F7296000-memory.dmp
memory/3444-193-0x00000193F6960000-0x00000193F6B01000-memory.dmp
memory/3444-194-0x00000193F6BE0000-0x00000193F6BEC000-memory.dmp
memory/3444-167-0x00007FF66AB30000-0x00007FF66AC44000-memory.dmp
memory/3444-75-0x00007FF66AB30000-0x00007FF66AC44000-memory.dmp
memory/3444-77-0x00000193F7230000-0x00000193F7296000-memory.dmp
memory/4068-117-0x0000015692E40000-0x0000015692EA6000-memory.dmp
memory/4068-118-0x0000015692E40000-0x0000015692EA6000-memory.dmp
memory/4068-119-0x00007FF63F230000-0x00007FF63F2D8000-memory.dmp
memory/4068-183-0x00007FF63F230000-0x00007FF63F2D8000-memory.dmp
memory/4564-192-0x00007FF6C0280000-0x00007FF6C075D000-memory.dmp
memory/4564-271-0x00007FF6C0280000-0x00007FF6C075D000-memory.dmp
memory/4564-188-0x0000018BB08D0000-0x0000018BB0936000-memory.dmp
memory/4564-186-0x0000018BB08D0000-0x0000018BB0936000-memory.dmp
memory/4684-69-0x0000022F579B0000-0x0000022F57A16000-memory.dmp
memory/4684-71-0x00007FF743590000-0x00007FF7436F8000-memory.dmp
memory/4684-64-0x0000022F579B0000-0x0000022F57A16000-memory.dmp
memory/4684-63-0x0000022F579B0000-0x0000022F57A16000-memory.dmp
memory/4684-62-0x00007FF743590000-0x00007FF7436F8000-memory.dmp
memory/4696-182-0x00007FF71D5F0000-0x00007FF71D8AE000-memory.dmp
memory/4696-267-0x00007FF71D5F0000-0x00007FF71D8AE000-memory.dmp
memory/5080-195-0x00007FF67E0D0000-0x00007FF67E17B000-memory.dmp
memory/5080-136-0x00000193DED70000-0x00000193DEDD6000-memory.dmp
memory/5080-135-0x00000193DED70000-0x00000193DEDD6000-memory.dmp
memory/5080-134-0x00007FF67E0D0000-0x00007FF67E17B000-memory.dmp