Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
10/05/2026, 01:53
General
- Target 2026-05-10_3239dc3f5d441908e766f6bb3c584448_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadam.exe
- Size 2.0MB
- Sample260510-ca533ags4v
- SHA256 0d3ad696282fb88e7a1ea057771aef88e02edad3b1004f9d066187f3a202a155
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_3239dc3f5d441908e766f6bb3c584448_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadam.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_3239dc3f5d441908e766f6bb3c584448_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadam.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\@AE2B70.tmp.exe"C:\Users\Admin\AppData\Local\Temp\@AE2B70.tmp.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 23967⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe10⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_3239dc3f5d441908e766f6bb3c584448_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadam.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_3239dc3f5d441908e766f6bb3c584448_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadam.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 4284⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4452 -ip 44521⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-05-10_3239dc3f5d441908e766f6bb3c584448_amadey_coinminer_darpapox_elex_jaku_nymaim_remcos_rhadam.exe
39A9.tmp
@AE2B70.tmp.exe
tmp2E5F.tmp
tmp2E70.tmp
tmp2E71.tmp
tmp2E81.tmp
tmp2E82.tmp
tmp2E83.tmp
tmp2F01.tmp
wtmps.exe
launch.exe
WdExt.exe
Admin0.bat
Admin0.bat
Admin1.bat
Admin2.bat
mydll.dll
mscaps.exe
memory/1120-273-0x0000000000780000-0x0000000000787000-memory.dmp
memory/1120-272-0x0000000000620000-0x0000000000740000-memory.dmp
memory/1588-288-0x0000000000570000-0x0000000000576000-memory.dmp
memory/1588-289-0x0000000000590000-0x0000000000597000-memory.dmp
memory/2080-134-0x0000000002A40000-0x0000000002A7B000-memory.dmp
memory/2396-250-0x0000000000590000-0x0000000000596000-memory.dmp
memory/2396-249-0x0000000000830000-0x0000000000950000-memory.dmp
memory/2396-251-0x00000000005F0000-0x00000000005F7000-memory.dmp
memory/3268-1-0x0000000000820000-0x0000000000940000-memory.dmp
memory/3268-2-0x0000000000400000-0x0000000000461000-memory.dmp
memory/3268-0-0x0000000000400000-0x0000000000461000-memory.dmp
memory/4452-229-0x0000000000400000-0x0000000000461000-memory.dmp
memory/4452-228-0x0000000000820000-0x0000000000940000-memory.dmp
memory/4452-61-0x0000000000400000-0x0000000000461000-memory.dmp
memory/4548-20-0x0000000010000000-0x0000000010015000-memory.dmp
memory/4548-156-0x0000000000870000-0x0000000000990000-memory.dmp
memory/4548-158-0x0000000000620000-0x0000000000627000-memory.dmp
memory/4548-157-0x0000000000590000-0x0000000000596000-memory.dmp
memory/4808-247-0x0000000010000000-0x0000000010015000-memory.dmp
memory/4808-256-0x0000000000510000-0x0000000000516000-memory.dmp
memory/4808-255-0x00000000006F0000-0x0000000000810000-memory.dmp
memory/5908-274-0x0000000000750000-0x0000000000870000-memory.dmp
memory/5948-267-0x0000000010000000-0x0000000010015000-memory.dmp
memory/5948-270-0x0000000000730000-0x0000000000850000-memory.dmp
memory/5948-271-0x00000000001F0000-0x00000000001F6000-memory.dmp