Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 03:11
Behavioral task
behavioral1
Sample
2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 560KB
- Sample260629-dpvrbac13q
- SHA256 0d1d284d0e733f02d77e85a459b14012a01001df8e81b2805f25866e846dc86c
- MD5 c332e1c481ca429168709795513e239d
- SHA1 2a6029830df6eb95a3d7bbf4fd7a1d7c94baebc8
- SHA512 77dc2ad269a0624c7c4904a54dc29e08f2602dd0d6e1e868100850a163767fabe77bb15880d569ad5f6aa79c234b63f4f8bf398c305fe5e1ca1fbc35d9f16779
- SSDEEP 12288:c3Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:QVOL4/gPXKCOkx2LFR
- TLSH T127C46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/2388-0-0x0000000000810000-0x000000000089C000-memory.dmp UPX behavioral2/memory/3208-3-0x0000000000DE0000-0x0000000000E6C000-memory.dmp UPX behavioral2/files/0x00190000000118e0-2.dat UPX behavioral2/memory/2388-20-0x0000000000810000-0x000000000089C000-memory.dmp UPX behavioral2/memory/3208-21-0x0000000000DE0000-0x0000000000E6C000-memory.dmp UPX behavioral2/memory/3208-36-0x0000000000DE0000-0x0000000000E6C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3208 d7fec8ed - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 122 223.5.5.5 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 233 114.114.114.114 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 291 223.5.5.5 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 374 114.114.114.114 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 35 114.114.114.114 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 234 223.5.5.5 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 320 114.114.114.114 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 1 114.114.114.114 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 2 223.5.5.5 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 121 114.114.114.114 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 290 114.114.114.114 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 36 223.5.5.5 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 89 114.114.114.114 3208 d7fec8ed Destination IP 90 223.5.5.5 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 177 114.114.114.114 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 178 223.5.5.5 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 321 223.5.5.5 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Destination IP 375 223.5.5.5 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d7fec8ed File created C:\Windows\SysWOW64\d7fec8ed 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d7fec8ed File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d7fec8ed -
resource yara_rule behavioral2/memory/2388-0-0x0000000000810000-0x000000000089C000-memory.dmp upx behavioral2/memory/3208-3-0x0000000000DE0000-0x0000000000E6C000-memory.dmp upx behavioral2/files/0x00190000000118e0-2.dat upx behavioral2/memory/2388-20-0x0000000000810000-0x000000000089C000-memory.dmp upx behavioral2/memory/3208-21-0x0000000000DE0000-0x0000000000E6C000-memory.dmp upx behavioral2/memory/3208-36-0x0000000000DE0000-0x0000000000E6C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\28e228 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File opened for modification C:\Windows\36ec10 d7fec8ed - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d7fec8ed Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d7fec8ed Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d7fec8ed Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d7fec8ed Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d7fec8ed Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d7fec8ed Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d7fec8ed Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d7fec8ed Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d7fec8ed Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d7fec8ed - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3208 d7fec8ed 3208 d7fec8ed 3208 d7fec8ed 3208 d7fec8ed 3208 d7fec8ed 3208 d7fec8ed 3208 d7fec8ed 3208 d7fec8ed 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Token: SeTcbPrivilege 2388 2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe Token: SeDebugPrivilege 3208 d7fec8ed Token: SeTcbPrivilege 3208 d7fec8ed
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_c332e1c481ca429168709795513e239d_amadey_coinminer_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
C:\Windows\Syswow64\d7fec8edC:\Windows\Syswow64\d7fec8ed1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d7fec8ed
- Size 560KB
- SHA256 dcbb23a46f2c8d6e2adb8b90357ac62836c6596205a30e5fe09284508297369c
- MD5 cea4c4b57ee33f53119c5fb0a3b8d34e
- SHA1 0de34b51aad04a0248db43596e04417368aecdd1
- SHA512 cf00d387117a9d064b47c56cbf7550f1d208f6a343375881ec6c6070a8ecea525c01ddfc2c6ad37c014c5291747e05a80dc64017e4aa386c6299d85e0b479ac7
- SSDEEP 12288:43Sgbu4VOGWPSqt6IpouYgCEmx1z725uRG9OArjlI6YeLm08XsOkx2LIa+y:sVOL4/gPXKCOkx2LFR
- TLSH T13CC46D2AB6E0D076C4B79574C4A256A6FFB1B43127204ACF6390475A1F637E2BE3530E
- MD5 SHA1 SHA512 SSDEEP TLSH