a8c4ff4788fccdca6fa6a2537a4c85fd2a3acf7a41415c7f30088f2cbbff39ca

General

Target
2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
Size 395KB
Sample260528-kn1phaaz9l
SHA256 a8c4ff4788fccdca6fa6a2537a4c85fd2a3acf7a41415c7f30088f2cbbff39ca
MD5 b76ae5d42f9443e8931b4597d9a413cb
SHA1 0f493ca67cf85d40716d81e1b863543a9f2a0984
SHA512 2a388dc7347aef02c506e739e1eafa0ff480fca931128abce5b07ad6e5b1fdd2fe7ff3af279a60b0e255642ffaebb013b88ada33ad0cf9c7b0bbab81933e852c
SSDEEP 6144:CcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:CCSvO2x9mONvKRILSFnOkx2LIa
TLSH
T118846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4468	d297264c

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	5	114.114.114.114	2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
Destination IP	9	223.5.5.5	2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
Destination IP	47	114.114.114.114	2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
Destination IP	57	223.5.5.5	2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	d297264c
File created	C:\Windows\SysWOW64\d297264c	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	d297264c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	d297264c

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\2b24b0	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\4c7e68	d297264c

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d297264c

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	d297264c
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	d297264c
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	d297264c
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	d297264c
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	d297264c
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	d297264c
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	d297264c
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	d297264c
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	d297264c

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4468	d297264c
4468	d297264c
4468	d297264c
4468	d297264c
4468	d297264c
4468	d297264c
4468	d297264c
4468	d297264c
4468	d297264c
4468	d297264c
4468	d297264c
4468	d297264c
2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
Token: SeTcbPrivilege	2520	2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
Token: SeDebugPrivilege	4468	d297264c
Token: SeTcbPrivilege	4468	d297264c

C:\Users\Admin\AppData\Local\Temp\2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_b76ae5d42f9443e8931b4597d9a413cb_amadey_coinminer_elex_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\Syswow64\d297264c
C:\Windows\Syswow64\d297264c
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d297264c

Path C:\Windows\SysWOW64\d297264c
Size 395KB
SHA256 6d2b852c8ec95c164e073f61e7e5f82aadfb1aedce7dc606123d2a4ed85e9464
MD5 d349299cbf3422aa5f5b6a76a6d45b6d
SHA1 c6115a5b0f31fe396d248e9d6151b0d3f5227073
SHA512 b4fe14802f144a1ae349b4aa1a5ccda4afecb4f574eed0ab2ad4aaa3f61a864a59edaef80191e5779eeb71b224a53d9cb90fbe7003cbda8f059db770a6d9fd7e
SSDEEP 6144:9cbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:9CSvO2x9mONvKRILSFnOkx2LIa
TLSH
T198846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2520-0-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/4468-4-0x0000000000400000-0x0000000000463000-memory.dmp