Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 374KB
- Sample260423-cffqcsf16y
- SHA256 67d129728ab7a1c3e8e988f02b4cce18e2d58a7cbe55303d57a9ad682065896f
- MD5 4b7346e479c13d60ac94d34efb0e5c2f
- SHA1 93ffed9f38b3d5ed6b54890b1c3c99e5232c786b
- SHA512 e6aa78f8fe5ef0069974ebd94249c71678c9b7a20ae4f2c5e9af43a3604b9a0b6a268a87a171300571cb023056628b837f45ac2c9af45a07da2a06655568794e
- SSDEEP 6144:/cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:/SvO2x9mONvKRILSFnOkx2LIa
- TLSH T18D846D2AF6A0D076C4779579C4A247AAFBB1742137208ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2132 ace3ba6f - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 2 223.5.5.5 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 21 114.114.114.114 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 22 223.5.5.5 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ace3ba6f File created C:\Windows\SysWOW64\ace3ba6f 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ace3ba6f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ace3ba6f - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\248028 ace3ba6f File opened for modification C:\Windows\2eb450 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ace3ba6f - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ace3ba6f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ace3ba6f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ace3ba6f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ace3ba6f Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ace3ba6f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ace3ba6f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ace3ba6f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ace3ba6f Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ace3ba6f - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2132 ace3ba6f 2132 ace3ba6f 2132 ace3ba6f 2132 ace3ba6f 2132 ace3ba6f 2132 ace3ba6f 2132 ace3ba6f 2132 ace3ba6f 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 2728 2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 2132 ace3ba6f Token: SeTcbPrivilege 2132 ace3ba6f
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_4b7346e479c13d60ac94d34efb0e5c2f_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
C:\Windows\Syswow64\ace3ba6fC:\Windows\Syswow64\ace3ba6f1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ace3ba6f
- Size 374KB
- SHA256 233d38da55cc90eddb448ad6f5b16c313aa77acb6ab557efcbd65e89ea1889bb
- MD5 ac3868fcc2f2b5840d8bb6da98cec4a4
- SHA1 3bc0ff5648cdd2d22fa5cf19641f0fb4604cc9b0
- SHA512 d7aed18506ad652cdce702e13c8ec296d1626b19808363630d8bc7205f7b9ab5e9a9a59376e187e491ba90dec788e86d165cb8be33bfb766103a2bc74116aabd
- SSDEEP 6144:AcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:ASvO2x9mONvKRILSFnOkx2LIa
- TLSH T1D1846D2AF6A0D076C4779579C4A247AAFBB1742137208ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH