Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 07:23
Behavioral task
behavioral1
Sample
2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe
- Size 74KB
- Sample260503-h777ksds21
- SHA256 998f69bb7f119375840c6973e4c46e80e513f09bf4cbd2626cad25cfe6c69be1
- MD5 06f7d8672b94d6e71cfcfc3a298cb3aa
- SHA1 2472d1d85e56631a82c85bc866460d17840d94ae
- SHA512 9bde902a598a319f134971560b7bc638cdcc0044cf877910266569909e06cf40d084214a3015a795b08d0b1e61bf7e9a9406d57b2290f9c539547ad00d54ab89
- SSDEEP 1536:HEq3GcOMXUdeHXUdekLaTMSFWjXUdeSFhNGpWSNNxEycf0sgTZlwlYML9KGR:HEqyLaTC0FhNGpWSNNxpsSM0i
- TLSH T19373EA9C75D85652EA4341B386F3F8F1BF787ED514304236D289F9F72A821A2F12E264
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/4728-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral1/files/0x00020000000229c0-5.dat UPX behavioral1/memory/4728-2816-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral1/memory/4728-2817-0x0000000000400000-0x000000000040A000-memory.dmp UPX - Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification \??\c:\Program Files\desktop.ini 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\$Recycle.Bin\S-1-5-21-643422742-1162610606-620613169-1000\desktop.ini 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-643422742-1162610606-620613169-1000\desktop.ini 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\desktop.ini 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe -
resource yara_rule behavioral1/memory/4728-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x00020000000229c0-5.dat upx behavioral1/memory/4728-2816-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/4728-2817-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Input.Manipulations.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\manifest.json 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\micaut.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\wab32res.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationCore.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\jfxswt.jar 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\hr.txt 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\msadrh15.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Design.Editors.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fil_FEMININE.pak 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Internet Explorer\images\bing.ico 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\management-agent.jar 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\chrome_installer.log 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\msado20.tlb 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fa_FEMININE.pak 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Xaml.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipscht.xml 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fa.pak 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\README.html 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\xerces.md 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\joni.md 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\msvcp140.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2192 4728 WerFault.exe 83 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 9802⤵
- Program crash
PID:2192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4728 -ip 47281⤵PID:3176
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 1.9MB
- SHA256 11500f54c6f01094c71ee85a94f17138f1ce35724f981417d3bb03a72abbc4e0
- MD5 3a078624e3fe5d59e7536e5bf985919d
- SHA1 4fc15e8f6345075a5a674e589b7ca24f1934e684
- SHA512 d0dbba96e28c232f7f782f7a01b6b61fc5f980bf85bdd94b43d7240a71b7680a60b0af779d13a61773252721f142ceb03e69f1ca8476c6346e714799c30ed5b2
- SSDEEP 24576:gaTC0FhNGpWOs1ezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7:gaT/FhNGpWOs4zTxMtpzpDBGyo
- TLSH T110953B6AF6748270D0B7C075C5E2AB9AEE7134864B30A6C753859B7D2F13AF6C539320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\sunec.dll
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512