d32e0cfd94b870605d00b5482c5efadbd1fbb68a9e170c38a26b8430fd73410a

General

Target
2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Size 2.0MB
Sample260503-fdaccaft7p
SHA256 d32e0cfd94b870605d00b5482c5efadbd1fbb68a9e170c38a26b8430fd73410a
MD5 151067360d95af0f88cb764398a451ae
SHA1 5adf56c5e7a039046b8888490b306fb613f1d9be
SHA512 8fcaa3e4fcbdb29d76686069f7ae3c22e84487c4cb71b071ebc00ce1e249a3d9c5cb8f961b6f9804ccf3c07a74158d8c90cf837c413ab08c48698d42ed1a936d
SSDEEP 49152:6HHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:6nKdVkOhCXHHFZMjHfUKkVi
TLSH
T126A57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024425-2.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024425-2.dat	CryptoLocker_set1

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024425-2.dat	UPX

Executes dropped EXE 1 IoCs

pid	Process
2632	7e0e26

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Destination IP	4	223.5.5.5	1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Destination IP	40	114.114.114.114	1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Destination IP	41	223.5.5.5	1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	7e0e26
File created	C:\Windows\SysWOW64\7e0e26	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	7e0e26
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	7e0e26

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\2d0f90	7e0e26
File opened for modification	C:\Windows\1f3a40	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e0e26
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	7e0e26
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	7e0e26
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	7e0e26
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	7e0e26
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	7e0e26
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	7e0e26
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	7e0e26
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	7e0e26
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	7e0e26

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2632	7e0e26
2632	7e0e26
2632	7e0e26
2632	7e0e26
2632	7e0e26
2632	7e0e26
2632	7e0e26
2632	7e0e26
2632	7e0e26
2632	7e0e26
2632	7e0e26
2632	7e0e26
1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Token: SeTcbPrivilege	1824	2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Token: SeDebugPrivilege	2632	7e0e26
Token: SeTcbPrivilege	2632	7e0e26

C:\Users\Admin\AppData\Local\Temp\2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_151067360d95af0f88cb764398a451ae_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\Syswow64\7e0e26
C:\Windows\Syswow64\7e0e26
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7e0e26

Path C:\Windows\SysWOW64\7e0e26
Size 2.0MB
SHA256 d9fdd62b05c6a376505814b3dbbdfd0bc526549256767a62edbb93aa9f62cb77
MD5 f8bf2347c83208cc903953063b7a2668
SHA1 b62407b9a86e422dcf6f270210bdac1a1add6857
SHA512 2e378756f91310d213d62c0f29c38c2648c485e31248617dbfb9b4526acdd09f60d1a9e8a3d8da97bf314a91fc549fbf239129feb0c04f9ee2872032469c5057
SSDEEP 49152:7HHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:7nKdVkOhCXHHFZMjHfUKkVi
TLSH
T196A57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1824-0-0x00000000007A0000-0x0000000000803000-memory.dmp

Download

memory/2632-4-0x0000000000BB0000-0x0000000000C13000-memory.dmp