Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 20:43
Behavioral task
behavioral1
Sample
2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe
- Size 64KB
- Sample260701-zhzbtaev2n
- SHA256 351755276c7bf31628f5239f8b2a9b959fecdf2bb44df37ed502be6323392ccc
- MD5 c786dc06adc7b37fcaa5665ed24e0748
- SHA1 58918031f3ce4c9e485a24ee8f6cf7b673226f09
- SHA512 33ad6f6e9b198aa88584bb5a6177abe7f274bd9bf60175581d5393807e93bdb1042c58d97e1a37a3b29b915c14b21f2c4f276d5a10388016433f489aeeeff6dd
- SSDEEP 1536:cEq3G4ObXUdeHXUdekLaTMSFWjXUdeSFhNGpWSNNxEycf0sgTZlwl8:cEqbLaTC0FhNGpWSNNxpsO
- TLSH T1DA53B89D75D85A51DA4281B7C6F3F8F1AF746ED504300236F28DF9F72B920A2B12E264
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x000200000001b305-5.dat UPX behavioral2/memory/3776-4146-0x0000000000400000-0x000000000040C000-memory.dmp UPX - Drops desktop.ini file(s) 5 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-1086369643-1618123105-2567081378-1000\desktop.ini 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-1086369643-1618123105-2567081378-1000\desktop.ini 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File created \??\c:\Program Files\desktop.ini 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe -
resource yara_rule behavioral2/files/0x000200000001b305-5.dat upx behavioral2/memory/3776-4146-0x0000000000400000-0x000000000040C000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\System\de-DE\wab32res.dll.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\System\msadc\msadco.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\README.txt 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationClient.resources.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es_FEMININE.pak 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\CompressComplete.ADTS 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.resources.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\jce.jar 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File created \??\c:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\qps-ploc\tipresx.dll.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ur-PK\tipresx.dll.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.Extensions.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\micaut.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\tr_FEMININE.pak 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\id-ID\tipresx.dll.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Internet Explorer\en-US\iexplore.exe.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.X509Certificates.dll 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\de_FEMININE.pak 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1520 3776 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_c786dc06adc7b37fcaa5665ed24e0748_coinminer_conti_elex.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 10042⤵
- Program crash
PID:1520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3776 -ip 37761⤵PID:2380
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 1.9MB
- SHA256 6844db8f6d62d15bdd9fc712f9a91e0ad906539f25bc7bf9208fed5ab1b9460d
- MD5 cea7023e414225499ba15fddc234e9d3
- SHA1 f72b29bf606d2a1ea24d4f2894459bcfde5a0583
- SHA512 9f27255210682738e4bb70c24e8ec5f9b5200a88e78c63507f0e5e1149dedd80b04a639bffc0103c74f3d47c0be169aba151a302fd49abdf9a6772804bb7a650
- SSDEEP 24576:KaTC0FhNGpWOsWezTxNGDd6nCtpzxTuh8WpkPpz6ylzGlvGkw7:KaT/FhNGpWOsxzTxMtpzpDBGyo
- TLSH T1BC953B5AF6748270D0B7C075C5E2ABAAEE7134864B30A6C75285DB7D2F13AF6C539320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\LockUse.emf
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512
- Path C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_F_COL.HXK
- Size 119B
- SHA256 4a4c9f290dadb6052556670faf60e07f0cc3c6f5a7b478d2da2234be8ea5508b
- MD5 da7c482f5358bd9da5bbfe76e3447a8e
- SHA1 dc0e0a748e790dc04133c65b52cd69b1676bd9c2
- SHA512 e9bb5f64535ebed8a4f38bc4144b3dc4dedcf6a3010a87a0cfa2306fbdc5ce8d3e9fd00ad9ae019548b3085edca33283c507325a6c484f66b484778a035878bc
- TLSH T1AEB09B0126155D7284505F74D717C8396F58231655B4454454E14D5745CE455475C174
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_K_COL.HXK
- Size 118B
- SHA256 641723ac1f2a767466006fb811f8140370ef9f2904398ee77f160c0e7bda7ba0
- MD5 805ae32d41bd54cee2613872031b2c20
- SHA1 5c2201ef44d4c345c2ad40bf67c3cb5f17509bad
- SHA512 a40328c1800ff312c79e873b9cdc1cc8fd4b61629fcf379257401b167c45fa53c3a019eb1bc6fb55ae8e9e74b9ad8e226163d75918f564e787f57696670688b0
- TLSH T11DB09B0126155D7285605E70DB17C8395F78231255B4454454E1495745DE455475C264
- MD5 SHA1 SHA512 TLSH