e71ba7fb3442c8f60ffcf2c35f2462258bb977ebc5f4cb247ecb41ffe493ec89

General

Target
2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
Size 511KB
Sample260701-fa8ezaev7j
SHA256 e71ba7fb3442c8f60ffcf2c35f2462258bb977ebc5f4cb247ecb41ffe493ec89
MD5 61cff38ab2dab973d7d08230196cdd1b
SHA1 6865b4ca16574880bba2db525a430f84e06c3929
SHA512 598d2c1676cb581f599b51cc11685e00dd4a13f54ff1e10ed08faa3735b1c0a012a7f6cc91dec178416d7e5e92c22bd0d9bee3988d4495d4bc97c08a22b3e32b
SSDEEP 6144:tLcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:tSvO2x9mONvKRILSFnOkx2LIax5F0
TLSH
T1BFB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4152	e2050426

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	2	114.114.114.114	4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
Destination IP	4	223.5.5.5	4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
Destination IP	37	114.114.114.114	4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
Destination IP	39	223.5.5.5	4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	e2050426
File created	C:\Windows\SysWOW64\e2050426	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	e2050426
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	e2050426

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\471570	e2050426
File opened for modification	C:\Windows\50e068	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2050426

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	e2050426
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	e2050426
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	e2050426
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	e2050426
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	e2050426
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	e2050426
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	e2050426
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	e2050426
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	e2050426

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4152	e2050426
4152	e2050426
4152	e2050426
4152	e2050426
4152	e2050426
4152	e2050426
4152	e2050426
4152	e2050426
4152	e2050426
4152	e2050426
4152	e2050426
4152	e2050426
4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
Token: SeTcbPrivilege	4724	2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
Token: SeDebugPrivilege	4152	e2050426
Token: SeTcbPrivilege	4152	e2050426

C:\Users\Admin\AppData\Local\Temp\2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_61cff38ab2dab973d7d08230196cdd1b_amadey_coinminer_elex_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Windows\Syswow64\e2050426
C:\Windows\Syswow64\e2050426
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

471570

Path C:\Windows\471570
Size 506B
SHA256 d75f226b899011b35f3b4e63fb57dd96e5c4a4d131d7a53e22e77a578c489dae
MD5 6d5288a34584e614128f6dc39816602e
SHA1 f88277b2e2f460c7c3e777c0beebaf573f39ad4e
SHA512 c25a670865fe2cbed05dc02ebf3320bf61c38f452c2318b34dc534bc4e8e26a9beed86ab90ed6a3cb52ac4872cb9110177990fb88b90e27613c03540a875c113
TLSH
T189F0C93BE82E6251298A2FB29D132A4A2C8BA239834753052D82B2630CC32666B57414
MD5 SHA1 SHA512 TLSH

Submit Download

e2050426

Path C:\Windows\SysWOW64\e2050426
Size 511KB
SHA256 38ecfd97ef9452d7b9394a3455c0d937f43564b09d005897bcb56021939938d7
MD5 a29e91a9e70d0d8ef2d77d961304bc29
SHA1 d739300791cda48c3619b9b50ac3a53da6faaddd
SHA512 8b76b8d6ae93cbf9156ee8c8eba80a27aa697bc558118e7dabee76c97b5f32f814ffd17fc4a9b7253ad3b10278cf5e8780f21ac29e11e79204072ed5ac58c54f
SSDEEP 6144:NcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:NSvO2x9mONvKRILSFnOkx2LIax5F0
TLSH
T15BB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4152-4-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/4724-0-0x0000000000400000-0x0000000000463000-memory.dmp