Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/05/2026, 04:28
Behavioral task
behavioral1
Sample
2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 560KB
- Sample260505-e3pmwsct6q
- SHA256 985fdca10fcb2a7b89d6c54e34783addcd531b531f99eac0ca29f9aeba6d3808
- MD5 ecd22c4030ee5bd631514dd38ad4aaa7
- SHA1 5d711f5ebf665a65e6d189b48395aebbc91dc069
- SHA512 43543570f8b957731f8e38492accd6076b59cd7492639aec62c9c86ed06cd84c4e7faa1a49ae28d6a0b4f3928c0928d366f09214a94d922fb78d0a9be26d6cdb
- SSDEEP 6144:eWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:ekCO2zVPX7vf1LKlIsOkxHy
- TLSH T185C47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D40B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/4144-0-0x0000000000010000-0x000000000009C000-memory.dmp UPX behavioral2/files/0x000e0000000262c0-2.dat UPX behavioral2/memory/2140-3-0x0000000000120000-0x00000000001AC000-memory.dmp UPX behavioral2/memory/4144-10-0x0000000000010000-0x000000000009C000-memory.dmp UPX behavioral2/memory/2140-11-0x0000000000120000-0x00000000001AC000-memory.dmp UPX behavioral2/memory/2140-30-0x0000000000120000-0x00000000001AC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 2140 ec4130de - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 2 223.5.5.5 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 19 114.114.114.114 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 21 223.5.5.5 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ec4130de File created C:\Windows\SysWOW64\ec4130de 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ec4130de File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ec4130de -
resource yara_rule behavioral2/memory/4144-0-0x0000000000010000-0x000000000009C000-memory.dmp upx behavioral2/files/0x000e0000000262c0-2.dat upx behavioral2/memory/2140-3-0x0000000000120000-0x00000000001AC000-memory.dmp upx behavioral2/memory/4144-10-0x0000000000010000-0x000000000009C000-memory.dmp upx behavioral2/memory/2140-11-0x0000000000120000-0x00000000001AC000-memory.dmp upx behavioral2/memory/2140-30-0x0000000000120000-0x00000000001AC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\24a338 ec4130de File opened for modification C:\Windows\46f260 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec4130de - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ec4130de Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ec4130de Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ec4130de Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ec4130de Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ec4130de Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ec4130de Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ec4130de Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ec4130de Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ec4130de - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2140 ec4130de 2140 ec4130de 2140 ec4130de 2140 ec4130de 2140 ec4130de 2140 ec4130de 2140 ec4130de 2140 ec4130de 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 4144 2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 2140 ec4130de Token: SeTcbPrivilege 2140 ec4130de
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_ecd22c4030ee5bd631514dd38ad4aaa7_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
C:\Windows\Syswow64\ec4130deC:\Windows\Syswow64\ec4130de1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ec4130de
- Size 560KB
- SHA256 6fceed997b9ea583f6070833c2c758d83ed2ce2afdc9efad5e355e58d0aff807
- MD5 c2bb4f8fc3a301037b5e00f651fd1b94
- SHA1 e9115ef5150efb2b023c7bc043ae8f4610de1887
- SHA512 c22f24704eae13100a89d36f6b8efd7391caa6db4f19780f6573d14f6b9a27bfc41915289ecea2eb12f80bb3e0bc273b5162ef2a312fcb3a4eb63d647dba2f7b
- SSDEEP 6144:EWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:EkCO2zVPX7vf1LKlIsOkxHy
- TLSH T102C47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D00B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH