Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 07:23
Behavioral task
behavioral1
Sample
2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe
- Size 74KB
- Sample260503-h777ksds21
- SHA256 998f69bb7f119375840c6973e4c46e80e513f09bf4cbd2626cad25cfe6c69be1
- MD5 06f7d8672b94d6e71cfcfc3a298cb3aa
- SHA1 2472d1d85e56631a82c85bc866460d17840d94ae
- SHA512 9bde902a598a319f134971560b7bc638cdcc0044cf877910266569909e06cf40d084214a3015a795b08d0b1e61bf7e9a9406d57b2290f9c539547ad00d54ab89
- SSDEEP 1536:HEq3GcOMXUdeHXUdekLaTMSFWjXUdeSFhNGpWSNNxEycf0sgTZlwlYML9KGR:HEqyLaTC0FhNGpWSNNxpsSM0i
- TLSH T19373EA9C75D85652EA4341B386F3F8F1BF787ED514304236D289F9F72A821A2F12E264
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/436-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000200000002a1c1-5.dat UPX behavioral2/memory/436-4081-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/memory/436-4082-0x0000000000400000-0x000000000040A000-memory.dmp UPX - Drops desktop.ini file(s) 5 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-600123060-2148212387-2211176695-1000\desktop.ini 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-600123060-2148212387-2211176695-1000\desktop.ini 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\desktop.ini 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe -
resource yara_rule behavioral2/memory/436-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000200000002a1c1-5.dat upx behavioral2/memory/436-4081-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/436-4082-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\7-Zip\Lang\mng2.txt 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Controls.Ribbon.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Forms.Primitives.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\libpng.md 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Configuration.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\TipRes.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Concurrent.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\System\msadc\msdaremr.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-CN.pak 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\sunmscapi.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\WindowsFormsIntegration.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Json.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\ReachFramework.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Encoding.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ro.pak 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\gu_FEMININE.pak 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationClientSideProviders.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Design.resources.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1052 436 WerFault.exe 78 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_06f7d8672b94d6e71cfcfc3a298cb3aa_coinminer_conti_elex.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 5042⤵
- Program crash
PID:1052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 436 -ip 4361⤵PID:2196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 1.9MB
- SHA256 11500f54c6f01094c71ee85a94f17138f1ce35724f981417d3bb03a72abbc4e0
- MD5 3a078624e3fe5d59e7536e5bf985919d
- SHA1 4fc15e8f6345075a5a674e589b7ca24f1934e684
- SHA512 d0dbba96e28c232f7f782f7a01b6b61fc5f980bf85bdd94b43d7240a71b7680a60b0af779d13a61773252721f142ceb03e69f1ca8476c6346e714799c30ed5b2
- SSDEEP 24576:gaTC0FhNGpWOs1ezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7:gaT/FhNGpWOs4zTxMtpzpDBGyo
- TLSH T110953B6AF6748270D0B7C075C5E2AB9AEE7134864B30A6C753859B7D2F13AF6C539320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512