12f275583b14bd9b234951c329394bab37ac630ce83821aa5b2d7ec1f96686bf

General

Target
2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Size 395KB
Sample260511-bj98pshs7t
SHA256 12f275583b14bd9b234951c329394bab37ac630ce83821aa5b2d7ec1f96686bf
MD5 76c1f217ff2874ab788e845f4a335617
SHA1 d758f4dc52da1d5f205ec3b8bae2c0f7d3f7e027
SHA512 9fddfc508d2f4c0882b53b5c47f0adcc3ca90300c33fb49bf229ec718464b25ffac5f693f0224d6384388fd794ef2c4e0766d87fa55f99b3a5203462bbd7a359
SSDEEP 6144:dwdK91cVMoSTZu05LOY0ftLy+mgFScEOkCybEaQRXr9HNdvOaxy8K:dn9OVKk05aY0ftLy+MOkx2LIaxy
TLSH
T16F846D2AF6A0D076C4B79578C49257A6FBB1742137204ACFA390475A1F637E2BE3630D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4468	4b9c93ab

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	41	223.5.5.5	416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	3	114.114.114.114	416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	4	223.5.5.5	416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	39	114.114.114.114	416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	4b9c93ab
File created	C:\Windows\SysWOW64\4b9c93ab	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	4b9c93ab
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1	4b9c93ab

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\4c7e68	4b9c93ab
File opened for modification	C:\Windows\71f40	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b9c93ab

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	4b9c93ab
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	4b9c93ab
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	4b9c93ab
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	4b9c93ab
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	4b9c93ab
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	4b9c93ab
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	4b9c93ab
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	4b9c93ab
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	4b9c93ab

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA	4b9c93ab
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037	4b9c93ab

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
4468	4b9c93ab
416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	416	2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4468	4b9c93ab
Token: SeTcbPrivilege	4468	4b9c93ab

C:\Users\Admin\AppData\Local\Temp\2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_76c1f217ff2874ab788e845f4a335617_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:416

C:\Windows\Syswow64\4b9c93ab
C:\Windows\Syswow64\4b9c93ab
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4b9c93ab

Path C:\Windows\SysWOW64\4b9c93ab
Size 395KB
SHA256 464865b77cf78e8939a31460af16c2c2c3ef9adb76bd80be038dc174a7473055
MD5 a13762fe37f06f35a7239c008d7650fb
SHA1 c4fde6e7125f22851d99f83cca4c6c69af2e1e86
SHA512 fda0e9bf44a3389fe780ac0969f9244cc3a800a8c53dccf4d86ac38acecb1ac78f732570fad54c99bd63c6f907011326e482cb0b0ca94d0d9d83467bec035905
SSDEEP 6144:fwdK91cVMoSTZu05LOY0ftLy+mgFScEOkCybEaQRXr9HNdvOaxy8K:fn9OVKk05aY0ftLy+MOkx2LIaxy
TLSH
T182846D2AF6A0D076C4B79578C49257A6FBB1742137204ACFA390475A1F637E2BE3630D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-0-0x00000000006E0000-0x0000000000743000-memory.dmp

Download

memory/4468-4-0x0000000000FD0000-0x0000000001033000-memory.dmp