Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/05/2026, 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
- Size 395KB
- Sample260510-e3sdsabx8j
- SHA256 fc8de9f3c913c7b1cc1901e7b39aac550e14d74293d422dafe448bde73c920e8
- MD5 0887680144ccf2a4fd4617d3f9177484
- SHA1 f7fe5e4c602187057a47cc4d5fc6af1b3445f350
- SHA512 97c1f77af7a377c566da8da8cb971649398971ffece2222685b0329287106bf210279f964008de4e905860fb4e367c395d88b82cfe4cbfa6273cd143cf1efbd9
- SSDEEP 6144:5QtK91cOo9qoiTpppLeIUfdLyO2QFicEOkCybEaQRXr9HNdvOaxy8K:539OFaPpKIUfdLyO8Okx2LIaxy
- TLSH T16D847D2AB7A0D076C4B79579C49247AAFEB1B42137204ACFA390475A1F237E2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2540 36737bde - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe Destination IP 2 223.5.5.5 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe Destination IP 5 114.114.114.114 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe Destination IP 6 223.5.5.5 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\36737bde 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 36737bde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 36737bde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 36737bde File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 36737bde - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2b7c58 36737bde File opened for modification C:\Windows\4a4d68 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36737bde - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 36737bde Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 36737bde Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 36737bde Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 36737bde Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 36737bde Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 36737bde Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 36737bde Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 36737bde - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 2540 36737bde 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe Token: SeTcbPrivilege 4340 2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 2540 36737bde Token: SeTcbPrivilege 2540 36737bde
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_0887680144ccf2a4fd4617d3f9177484_amadey_coinminer_elex_graphican_remcos_rhadamanthys_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
C:\Windows\Syswow64\36737bdeC:\Windows\Syswow64\36737bde1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\36737bde
- Size 395KB
- SHA256 942d9deb39f43564a38d9cb6c9d655d3fcd83c70b120a998d090f29d0ceb6b9f
- MD5 64bbf54107ff3667d8efc4f85e8880b5
- SHA1 e440417d3b6d122e5bd0bcb9ccf870a3a9130964
- SHA512 a321160de275a6688174a4713932b4a5e65d71c629bab3da7f89f27b8c18e9ad5689d1371e8e39429cc2c3189a76507bc98071209f3c10a66cc1a77616b7d1f0
- SSDEEP 6144:/QtK91cOo9qoiTpppLeIUfdLyO2QFicEOkCybEaQRXr9HNdvOaxy8K:/39OFaPpKIUfdLyO8Okx2LIaxy
- TLSH T11E847D2AB7A0D076C4B79579C49247AAFEB1B42137204ACFA390475A1F237E2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH