d4ed2e30e9888f3c57e16043155320f32689ef84edea6bc76ced9a72bcaca539

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe
Size 3.5MB
Sample260530-nap8dscy7k
SHA256 d4ed2e30e9888f3c57e16043155320f32689ef84edea6bc76ced9a72bcaca539
MD5 8d2bd24c1d53193600e23f1a76bcd3fc
SHA1 89cb05eac7a5931ee7933a297fc8e4278aafc4a7
SHA512 4e74a622e055619ecc040f9bd9044c126dac4adc13b671dd18928f885ae10600bc72b8e19d9e1789eeacafbc321092119cf0d75c526485872bc53fcb0850e1d6
SSDEEP 98304:SWkCqdJywOnEP7MHHQjgV4rAGEI0F1ZRg2MB:SEqdILnEP7MHtZLg2MB
TLSH
T1830602617390C035C75304B09E6ACBB99275F6A94B3285C3A3D05F1EAF74DD26B3A21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4839CB99-22A3-4F95-9972-8E35BB52DF38}\Implemented Categories\{2211057D-0906-49DF-ABF4-37652C71E0F2}	2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4839CB99-22A3-4F95-9972-8E35BB52DF38}	2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4839CB99-22A3-4F95-9972-8E35BB52DF38}\Implemented Categories	2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4839CB99-22A3-4F95-9972-8E35BB52DF38}\Implemented Categories\{2211057D-0906-49DF-ABF4-37652C71E0F2}\uuid = "a801a193528d811a36ffa04456f751b6"	2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4839CB99-22A3-4F95-9972-8E35BB52DF38}\IMPLEMENTED CATEGORIES\{2211057D-0906-49DF-ABF4-37652C71E0F2}	2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4839CB99-22A3-4F95-9972-8E35BB52DF38}\Implemented Categories\{2211057D-0906-49DF-ABF4-37652C71E0F2}\svrid	2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_8d2bd24c1d53193600e23f1a76bcd3fc_coinminer_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installconfig.xml

Path C:\Users\Admin\AppData\Local\Temp\~e580f6c\installconfig.xml
Size 10KB
SHA256 1ed20fcb425bcb9c26b91aba90a9334f3ec98ed90802d2db1556968005822b39
MD5 a80445893a2805bf600d0ace5744af44
SHA1 be31969ad2e4b9617a06c154ffeacec5e9036fc4
SHA512 3bf0783ac26207881b5c1b5ee94caee4c25b77af93d1607de19591320f2690430079f0a5f292143bd7c882d6b65a4a9586109eba5feb9058ac85bdcfbe798859
SSDEEP 96:HVvoOBLlTDhHO7pKGjlqaghv00B7Zc4oI8zKeC9OQQnZVAus5CBe7L:VoahLW8BbkI8zKGQQnZfI
TLSH
T1B42273B5F56D6C14C67C3B7335BE682A128BBE8EC544D2D2A4FF3A028053960D6746CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40.png

Path C:\Users\Admin\AppData\Local\Temp\~e580f6c\res\40.png
Size 509B
SHA256 d33d7d08642ec5a861e649525af7c776e076864305a451c8cd943c26d8c602d2
MD5 07b93e4303598ed7bc8020b10109c86c
SHA1 a0fcf8c5ea8001a7cea7aa93b52d3c1fe990536a
SHA512 114da8edf5cc980d1879f7251ca30e73d1add9f9ab761e22311e389deb2e7aed967171eb40796124162b37d67ea7d0fcec405695253cffb9723d3c3fa906e6fe
TLSH
T15DF05493ABD1FD7D67B2627954C9B000FA6AA71EC23B710C1C46D77577B18C68C449C2
MD5 SHA1 SHA512 TLSH

Submit Download

58.png

Path C:\Users\Admin\AppData\Local\Temp\~e580f6c\res\58.png
Size 71KB
SHA256 5d164333ecb9fd845d1edf95685f10a6b554b37c8fabbe2f307549ca42c4a9ea
MD5 86d7fde8aa4ec916e65566418a0e358e
SHA1 4c64c1bbb8c65730afb45f1e1f5c1f2868bff25d
SHA512 caeedee0b36b6a50645e4a08f0b8ce0df948f0f7804b3675a8a9bfd8b63a295885fc16dfdca00dca6a6dceb63157dd7a4914e67ab03bf6982570f64f5a564698
SSDEEP 1536:p7777777777wrl5LbNWPv+KzdSEoSMDD+RTTNrznWy3PcVYmZ00TSgik:p7777777777wr8+UdSmTlDWpYmq0T5ik
TLSH
T18563F101EB478AF6D99EA7951B7BF873BFDF7292803D0908200AE5D83545F8443859FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1620-0-0x0000000000400000-0x000000000052F000-memory.dmp

Download

memory/1620-43-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/1620-50-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads