973d6da9ef8205f2c2551c126dd74164f5f8cfba639bbc0190840f5184759f03

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
Size 618KB
Sample260420-rtcm7ac16q
SHA256 973d6da9ef8205f2c2551c126dd74164f5f8cfba639bbc0190840f5184759f03
MD5 cb3d042e8b1caa3c98629622cb6d9607
SHA1 2206e043c563ea01f08fac7f1258e099e13d3c2c
SHA512 23714f3d8492b1f1e06be31e44c090146764e4a6595e2ecbccee3906e2afcb5453472670fc99030ebb7f391c7dcf68973cfd33a13c5af5fcd6e766c2b9cb0385
SSDEEP 12288:mqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:mjHPOSOkx2LFscUQPxW
TLSH
T120D47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware trojan upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral1/memory/4756-0-0x0000000000F80000-0x0000000001009000-memory.dmp	UPX
behavioral1/memory/4884-4-0x0000000000AC0000-0x0000000000B49000-memory.dmp	UPX
behavioral1/files/0x000a00000002166e-3.dat	UPX
behavioral1/memory/4756-10-0x0000000000F80000-0x0000000001009000-memory.dmp	UPX
behavioral1/memory/4884-13-0x0000000000AC0000-0x0000000000B49000-memory.dmp	UPX
behavioral1/memory/4756-35-0x0000000000F80000-0x0000000001009000-memory.dmp	UPX
behavioral1/memory/4884-37-0x0000000000AC0000-0x0000000000B49000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
4884	4d00f6fe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
Destination IP	4	223.5.5.5	4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
Destination IP	33	114.114.114.114	4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
Destination IP	39	223.5.5.5	4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1	4d00f6fe
File created	C:\Windows\SysWOW64\4d00f6fe	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	4d00f6fe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	4d00f6fe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4756-0-0x0000000000F80000-0x0000000001009000-memory.dmp	upx
behavioral1/memory/4884-4-0x0000000000AC0000-0x0000000000B49000-memory.dmp	upx
behavioral1/files/0x000a00000002166e-3.dat	upx
behavioral1/memory/4756-10-0x0000000000F80000-0x0000000001009000-memory.dmp	upx
behavioral1/memory/4884-13-0x0000000000AC0000-0x0000000000B49000-memory.dmp	upx
behavioral1/memory/4756-35-0x0000000000F80000-0x0000000001009000-memory.dmp	upx
behavioral1/memory/4884-37-0x0000000000AC0000-0x0000000000B49000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\539da8	4d00f6fe
File opened for modification	C:\Windows\516ca8	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d00f6fe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	4d00f6fe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	4d00f6fe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	4d00f6fe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	4d00f6fe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	4d00f6fe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	4d00f6fe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	4d00f6fe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	4d00f6fe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	4d00f6fe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA	4d00f6fe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c000000010000000400000080010000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa2000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037	4d00f6fe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4884	4d00f6fe
4884	4d00f6fe
4884	4d00f6fe
4884	4d00f6fe
4884	4d00f6fe
4884	4d00f6fe
4884	4d00f6fe
4884	4d00f6fe
4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
Token: SeTcbPrivilege	4756	2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4884	4d00f6fe
Token: SeTcbPrivilege	4884	4d00f6fe

C:\Users\Admin\AppData\Local\Temp\2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_cb3d042e8b1caa3c98629622cb6d9607_amadey_coinminer_elex_remcos_smoke-loader.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\Syswow64\4d00f6fe
C:\Windows\Syswow64\4d00f6fe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d00f6fe

Path C:\Windows\SysWOW64\4d00f6fe
Size 618KB
SHA256 5c0d21d6f8d47060000ed4bb873c4238a9e91af69c72cf88cbb91b2e58b5d4f2
MD5 388471ae6a4210b6a5b3d81dbebac4a9
SHA1 e565779814b41d7bb9b14ac930ac6e80d8c16ec9
SHA512 a6608a51bfe29827b4d203c322d2f5f6bf6e245fef15a00e841649b832d0e27ee405fc248ba0690ed975743daee59906f991d8c6f9f6c84c3aea0e1efd181a5a
SSDEEP 12288:vqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:vjHPOSOkx2LFscUQPxW
TLSH
T18CD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4756-0-0x0000000000F80000-0x0000000001009000-memory.dmp

Download

memory/4756-10-0x0000000000F80000-0x0000000001009000-memory.dmp

Download

memory/4756-12-0x0000000000A30000-0x0000000000A93000-memory.dmp

Download

memory/4756-35-0x0000000000F80000-0x0000000001009000-memory.dmp

Download

memory/4756-36-0x0000000000A30000-0x0000000000A93000-memory.dmp

Download

memory/4756-47-0x0000000000A30000-0x0000000000A93000-memory.dmp

Download

memory/4884-4-0x0000000000AC0000-0x0000000000B49000-memory.dmp

Download

memory/4884-13-0x0000000000AC0000-0x0000000000B49000-memory.dmp

Download

memory/4884-14-0x0000000000A30000-0x0000000000A93000-memory.dmp

Download

memory/4884-30-0x0000000000A30000-0x0000000000A93000-memory.dmp

Download

memory/4884-37-0x0000000000AC0000-0x0000000000B49000-memory.dmp

Download