Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system - submitted
10/05/2026, 01:37
Behavioral task
behavioral1
Sample
2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 560KB
- Sample260510-b136qaaz2p
- SHA256 f543b54ea2d6cb4fdfda34ab2e1701e068ac0ab4640d43d966b8be9e56a01c6d
- MD5 d71cc35277ffb76b2364218f2ee48e30
- SHA1 d414e2685a146c66ba6ed880d2db2df94a1aa417
- SHA512 fb90d9e8a76aa5223f881bc758143f50936df71f8e45face30b437413c2d33e2a73d70d512ec68f63f9b5d908dec69676a2e50db4f50e0f98d3c067ca8d1b98d
- SSDEEP 6144:qWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRXr9HNdvOa+y8K:qkCO2zVPX7vf1LKlIsOkx2LIa+y
- TLSH T1D2C47C2AF6A0C036C4779574C4A257AAFFB1B42127204ACFA390475A1F637E2BE7531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/4976-0-0x0000000000ED0000-0x0000000000F5C000-memory.dmp UPX behavioral2/files/0x002100000002adee-2.dat UPX behavioral2/memory/3176-4-0x0000000000620000-0x00000000006AC000-memory.dmp UPX behavioral2/memory/4976-18-0x0000000000ED0000-0x0000000000F5C000-memory.dmp UPX behavioral2/memory/3176-19-0x0000000000620000-0x00000000006AC000-memory.dmp UPX behavioral2/memory/3176-32-0x0000000000620000-0x00000000006AC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3176 bc967d28 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 3 223.5.5.5 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 36 114.114.114.114 3176 bc967d28 Destination IP 37 223.5.5.5 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 40 114.114.114.114 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 41 223.5.5.5 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\bc967d28 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 bc967d28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 bc967d28 -
resource yara_rule behavioral2/memory/4976-0-0x0000000000ED0000-0x0000000000F5C000-memory.dmp upx behavioral2/files/0x002100000002adee-2.dat upx behavioral2/memory/3176-4-0x0000000000620000-0x00000000006AC000-memory.dmp upx behavioral2/memory/4976-18-0x0000000000ED0000-0x0000000000F5C000-memory.dmp upx behavioral2/memory/3176-19-0x0000000000620000-0x00000000006AC000-memory.dmp upx behavioral2/memory/3176-32-0x0000000000620000-0x00000000006AC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\365fd0 bc967d28 File opened for modification C:\Windows\5530e0 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc967d28 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bc967d28 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bc967d28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bc967d28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bc967d28 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bc967d28 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bc967d28 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bc967d28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bc967d28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bc967d28 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3176 bc967d28 3176 bc967d28 3176 bc967d28 3176 bc967d28 3176 bc967d28 3176 bc967d28 3176 bc967d28 3176 bc967d28 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 4976 2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3176 bc967d28 Token: SeTcbPrivilege 3176 bc967d28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_d71cc35277ffb76b2364218f2ee48e30_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976
-
C:\Windows\Syswow64\bc967d28C:\Windows\Syswow64\bc967d281⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\bc967d28
- Size 560KB
- SHA256 9e0fc85a1a64d36ba6ad918472f253baca0963739e707681835ebfcaf8bc3ca3
- MD5 ce4b6a052ce892382de335db1d60dc5b
- SHA1 ac4c67004ede27305b0cf6cfe2de488cdde9d3b5
- SHA512 ad7d476c4d065b2d5c6d776beb3ef0280188a1a4fa188079e142b841e7fe98d993326ea930a56e823adb11bec567db0dbc2c6588f1e423e56766197b29900edc
- SSDEEP 6144:jWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRXr9HNdvOa+y8K:jkCO2zVPX7vf1LKlIsOkx2LIa+y
- TLSH T108C47C2AF6A0C036C4779574C4A257AAFFB1B42127204ACFA390475A1F637E2BE7531D
- MD5 SHA1 SHA512 SSDEEP TLSH