Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/05/2026, 00:30
Behavioral task
behavioral1
Sample
2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 766KB
- Sample260510-ath2jaft3s
- SHA256 787d9d31af976482745f78588121e735feafcc5a74f6f8692de3f36085087b9b
- MD5 2d771e14efe17ce9c7a3e62e10b9e312
- SHA1 4dc964c05a37848ff6eba63f3c498cd923898113
- SHA512 36104cfcc4eb8a090363a338128d52812b5ce7b79c203f6937c293af03d4eada377eb12b3797dafa432270ae2afefe3183643ad781eaf9dcea1c4d378f2e0357
- SSDEEP 12288:BSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:IvO2xJKRw2kOkx2LFRvcUV
- TLSH T1EBF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/5112-0-0x00000000005C0000-0x000000000064C000-memory.dmp UPX behavioral2/files/0x0016000000025a2d-2.dat UPX behavioral2/memory/3280-7-0x00000000005D0000-0x000000000065C000-memory.dmp UPX behavioral2/memory/5112-18-0x00000000005C0000-0x000000000064C000-memory.dmp UPX behavioral2/memory/3280-19-0x00000000005D0000-0x000000000065C000-memory.dmp UPX behavioral2/memory/3280-24-0x00000000005D0000-0x000000000065C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3280 c08f5e9 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 2 223.5.5.5 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 14 114.114.114.114 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 15 223.5.5.5 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\c08f5e9 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c08f5e9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c08f5e9 -
resource yara_rule behavioral2/memory/5112-0-0x00000000005C0000-0x000000000064C000-memory.dmp upx behavioral2/files/0x0016000000025a2d-2.dat upx behavioral2/memory/3280-7-0x00000000005D0000-0x000000000065C000-memory.dmp upx behavioral2/memory/5112-18-0x00000000005C0000-0x000000000064C000-memory.dmp upx behavioral2/memory/3280-19-0x00000000005D0000-0x000000000065C000-memory.dmp upx behavioral2/memory/3280-24-0x00000000005D0000-0x000000000065C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5784f0 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\3827a0 c08f5e9 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c08f5e9 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c08f5e9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c08f5e9 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c08f5e9 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c08f5e9 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c08f5e9 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c08f5e9 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c08f5e9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c08f5e9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c08f5e9 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3280 c08f5e9 3280 c08f5e9 3280 c08f5e9 3280 c08f5e9 3280 c08f5e9 3280 c08f5e9 3280 c08f5e9 3280 c08f5e9 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 5112 2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3280 c08f5e9 Token: SeTcbPrivilege 3280 c08f5e9
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_2d771e14efe17ce9c7a3e62e10b9e312_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
C:\Windows\Syswow64\c08f5e9C:\Windows\Syswow64\c08f5e91⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3280
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c08f5e9
- Size 766KB
- SHA256 3eb58da209733b48f6f0afa6f97b32605ab051e8354df92d7c1f75dfedf4c02d
- MD5 cf3e797472de01e0038176fa816055fb
- SHA1 220844e241587b6cb16d9fa32151a87d1b0b3f11
- SHA512 430d6b0bb7a0466af5eec68727cfe42d8b79b130c641a72a5a2a075cbb438c5949adf2e762baf46c0ebda1c4c5b28d39776155b16cc94a9bcb91f58f2e540fab
- SSDEEP 12288:rSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:evO2xJKRw2kOkx2LFRvcUV
- TLSH T13BF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH