Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 14:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-09_2f7d520b15a2b10c1efb257bcd33ace4_coinminer_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-09_2f7d520b15a2b10c1efb257bcd33ace4_coinminer_elex_rhadamanthys_stop.exe
- Size 6.1MB
- Sample260709-sbe62adt41
- SHA256 21394cf67c63f8a2d8daa3aecb7fac002bc34d82fecad93ee008328ef58c0056
- MD5 2f7d520b15a2b10c1efb257bcd33ace4
- SHA1 646deb550fae93c9495cf9b1fefbc5f913dd9b8e
- SHA512 883d4a5b8a1709242b0f2bf79ca12a33779508d595e536f62b9add3b762eca52b3a0f09389e771dea1aa2538042f01534c00cb0435414ec2fbf66dc82d21d2ea
- SSDEEP 196608:h+3JB2I27byCtiC5UaYtCukb/jrd7QhmjM7cD54ha:hakI27lV5zw+b/ZQU47c94ha
- TLSH T16E563301777FC97FD609807980CD7A23FA321C224ED695173C4AFADD6A30A659C3A396
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/files/0x000d00000001c5c5-4.dat UPX behavioral2/memory/1436-9-0x0000000000400000-0x000000000057E000-memory.dmp UPX behavioral2/memory/1436-264-0x0000000000400000-0x000000000057E000-memory.dmp UPX behavioral2/memory/1436-265-0x0000000000400000-0x000000000057E000-memory.dmp UPX behavioral2/memory/1436-268-0x0000000000400000-0x000000000057E000-memory.dmp UPX behavioral2/memory/1436-269-0x0000000000400000-0x000000000057E000-memory.dmp UPX - Executes dropped EXE 2 IoCs
pid Process 1436 irsetup.exe 6060 NetGameCarClient.exe - Loads dropped DLL 1 IoCs
pid Process 6060 NetGameCarClient.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral2/files/0x000d00000001c5c5-4.dat upx behavioral2/memory/1436-9-0x0000000000400000-0x000000000057E000-memory.dmp upx behavioral2/memory/1436-264-0x0000000000400000-0x000000000057E000-memory.dmp upx behavioral2/memory/1436-265-0x0000000000400000-0x000000000057E000-memory.dmp upx behavioral2/memory/1436-268-0x0000000000400000-0x000000000057E000-memory.dmp upx behavioral2/memory/1436-269-0x0000000000400000-0x000000000057E000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\NetGameCar\skin\gamepath_d.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\startgame_n.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\driver\Win32\NGC2010.cat irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\skin\login_n.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\setting_n.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\unspeed_n.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\zlib.dll irsetup.exe File created \??\c:\Program Files\NetGameCar\zlib.dll irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\skin\mygames_d.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\smartroute_1.dll irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\msvcm80.dll irsetup.exe File created \??\c:\Program Files\NetGameCar\driver\Win32\NGC2010.exe irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\menu2_n.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\skin\menu4_d.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\menu6_n.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\skin\minimize_n.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\kczx_close_n.png irsetup.exe File created \??\c:\Program Files\NetGameCar\gamelist_local.htm irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\skin\psw_n.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\vpnlist.bin irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\images\li_icon.gif irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\1373910087_refresh.bin irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\RvKernel.exe irsetup.exe File created \??\c:\Program Files\NetGameCar\Microsoft.VC80.CRT.manifest irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\menu1_n.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\skin\menu3_n.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\startgame_s_n.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\NGCAU.exe irsetup.exe File created \??\c:\Program Files\NetGameCar\ngcAd.exe irsetup.exe File created \??\c:\Program Files\NetGameCar\driver\Win64\NGC2010.exe irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\menu4_d.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\qqmsg_d.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\mygames_n.png irsetup.exe File created \??\c:\Program Files\NetGameCar\StartGame.exe irsetup.exe File created \??\c:\Program Files\NetGameCar\NetGameCarClient.exe irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\images\loading.gif irsetup.exe File created \??\c:\Program Files\NetGameCar\images\loading.gif irsetup.exe File created \??\c:\Program Files\NetGameCar\ca.crt irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\driver\Win32\NGC2010.exe irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\gamelist_d.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\skin\speed_n.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\speed_n.png irsetup.exe File created \??\c:\Program Files\NetGameCar\driver\Win64\Install.bat irsetup.exe File created \??\c:\Program Files\NetGameCar\NGC.ico irsetup.exe File created \??\c:\Program Files\NetGameCar\doyo_3031_s.exe irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\Uninstall\uninstall.xml irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\msvcr80.dll irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\ngcPing.exe irsetup.exe File created \??\c:\Program Files\NetGameCar\driver\Win32\NGC2010.sys irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\driver\Win64\NGC2010.sys irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\login_d.png irsetup.exe File created \??\c:\Program Files\NetGameCar\skin\psw_n.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\driver\Win32\Install.bat irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\Uninstall\uninstall.dat irsetup.exe File created \??\c:\Program Files\NetGameCar\AU.ini irsetup.exe File created \??\c:\Program Files\NetGameCar\driver\Win32\NGC2010.cat irsetup.exe File created \??\c:\Program Files\NetGameCar\driver\Win64\NGC2010.cat irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\skin\selectnode_n.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\driver\Win32\Uninstall.bat irsetup.exe File created \??\c:\Program Files\NetGameCar\bd.ini irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\skin\startgame_s_d.png irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\ca.crt irsetup.exe File created \??\c:\Program Files\NetGameCar\dwOpenVpn.exe irsetup.exe File opened for modification \??\c:\Program Files\NetGameCar\driver\Win64\NGC2010.cat irsetup.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ÍøÓο쳵\uninstall.exe irsetup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_2f7d520b15a2b10c1efb257bcd33ace4_coinminer_elex_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language irsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NetGameCarClient.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ irsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ irsetup.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 6060 NetGameCarClient.exe 6060 NetGameCarClient.exe 6060 NetGameCarClient.exe 6060 NetGameCarClient.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 6060 NetGameCarClient.exe 6060 NetGameCarClient.exe 6060 NetGameCarClient.exe 6060 NetGameCarClient.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1436 irsetup.exe 1436 irsetup.exe 6060 NetGameCarClient.exe 6060 NetGameCarClient.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1436 2524 2026-07-09_2f7d520b15a2b10c1efb257bcd33ace4_coinminer_elex_rhadamanthys_stop.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_2f7d520b15a2b10c1efb257bcd33ace4_coinminer_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_2f7d520b15a2b10c1efb257bcd33ace4_coinminer_elex_rhadamanthys_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:653858 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2026-07-09_2f7d520b15a2b10c1efb257bcd33ace4_coinminer_elex_rhadamanthys_stop.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2786392678-1011493168-3329660577-1000"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
C:\PROGRA~1\NETGAM~1\NetGameCarClient.exeC:\PROGRA~1\NETGAM~1\NETGAM~1.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\NETGAM~1\SPORDER.DLL
- Size 11KB
- SHA256 aa7db6f720c50f0705f36165c738ae5dbac3c348e814e81dfa6b018277663870
- MD5 471789f182c0b60304ce19f023d8911d
- SHA1 2c5e44949734650d50a6b8a47a73ee2296eb1bf7
- SHA512 c8cf49f5814375f9f72884f9753f08244f3af7ed26fa414e986ec367789e7135cccb2a4758139dd2157a3d982beea1fe99855796e2e4e050ba8c6d12be36205d
- SSDEEP 96:Jj+/KIx7DQc/+4JovNZ4xYPxY3yFDieEW+ZlEWJUVff:x+/FDQc24QNZ4xYPxYAkWYEWJCf
- TLSH T1E132941337A4DFB6E15A2B703F763626943A3824457C811776283D1918B3628DD34BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\NetGameCar\NetGameCarClient.exe
- Size 8.6MB
- SHA256 e7b83cf983aefe04e604dccfdf9ddc5c8b32eebe9d0b75ae2c3ebda44f668a22
- MD5 dfa17c9651f0361bfb26783e482d3dcf
- SHA1 d6c43e97d8c9d3bc6f1c5895cd109286173e9899
- SHA512 93028194f9c9853b18e7cfa0d7df6b266fccaed0e72077cb8eb64243c8d05a574f5f63268902d218f699a7ef21f8d6acdb2388beea79d4d275541ffb188f0bd7
- SSDEEP 98304:6GLPoecsVNGt9cBRhSmDT3n6RtrxKb7XARuk1IeBer:tLge1VNGt9shSMT36RtrCXAH1Iec
- TLSH T1BA96A307B175452EE2E65933CB5EC550DCD9BAE1DED0850F299C6E082A34A8024EFFDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\NetGameCar\Uninstall\uninstall.xml
- Size 22KB
- SHA256 f53d3286e250b755031a87d5be4f60d3b00b36e4efb197872ccdd1397472a88f
- MD5 d9fed5168699dbdcae4937bf6d3b42f2
- SHA1 73a21317edf42c1ef34609f835c97756b1a52261
- SHA512 637c8be48378dbcf7cb8c95922ddb344c1d79602b01837a3a315a04fb61fa1697011e49eaad17c7bb4d4dad1ebcbe963322afca53c1f05cfaaa60a316d273073
- SSDEEP 192:GVFHm8cVFHq5VFHrVFHmVFH4VFH/VFH/VFHNVFHRVFHuVFH9VFHrVFHfnVFHqVFj:/6AhpIjFX
- TLSH T1B4A2B66CD8DCDE2FDEE976FB3580352C5812D25A15961881C692C2CB94C3861BEF2FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\NetGameCar\Uninstall\uninstall.xml
- Size 28KB
- SHA256 1e73ef707acfee2ddd60278eba17db33f556bdbcd6bbef2846dfa613d90b15ef
- MD5 7c1478c86a4a0471f6188bf70baacdc1
- SHA1 63ca8b14fbee4aa97ab691cf1684112f05ce4e1c
- SHA512 fbed644a3596465327f628dc81b4f752eb7aa4f680466b65e2df9c8cdddd000b234144b5accb0c888dab9abb2fbb8ebe7f304d3a531ba08920d9e8a6ceca70a4
- SSDEEP 192:uVFHm8cVFHq5VFHrVFHmVFH4VFH/VFH/VFHNVFHRVFHuVFH9VFHrVFHfnVFHqVF/:H6AhpIjFHxcCP
- TLSH T144D21D6CC8DCDE2FEEE6B5FF3580352C5822C34A15A51881C295C18B94C2965BEF2FB5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG
- Size 40KB
- SHA256 b6e11c5104aafd18909c1bb8086daca004bc091c7e03a2426990dea35bc3b0f5
- MD5 19759c8389aa9f4d3bbb28d0973fdbf9
- SHA1 63544807bda911ccae4c7debe8059e97c3ff6da7
- SHA512 8a6881a803759beaf03e5fc4c7cbc1f99d6bf6175a5ca0eb2e3bcfbf27d0800ea03bdaf37d534652a61a95a1bc5188f5bdd522251ae1d9bbbf5d34c61ba6c2fb
- SSDEEP 768:Voq2qBVhZvdwLk2IZa30TwqDmFgxEdAMjcrzy:i7W9vdYk83KwqiCQey
- TLSH T1F913BE108BE2BDE0E4D5A2358CB4D641E7326F0369635EA3386C7956BF327E10DDE14A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.JPG
- Size 63KB
- SHA256 b447fbdee4df6bab06c3d075935e878c28e318c718ac9a880f8cffcc10f97e38
- MD5 cc0671c5fc18fb9bc0f420e13833a7c9
- SHA1 39ce94de39ea4eccb69928c121a9e0f5cb148997
- SHA512 7076b33019c165000eaf055c8362ff524438930177536029ba3044f21fa799fc4de32c5ec404e72b145c92c1d4af22bc3300796ef36d5df7a63b378a88dbda5c
- SSDEEP 1536:0PJrEKW+JH710bTwCvExtfogYqEeksqliVbL702:SQoUcx6gYqEepVb3V
- TLSH T1EE53E1201FCB7D70F1E6C634841DE686E2629B43D6B36E543A7D5800BF6C3A24CE9746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
- Size 562KB
- SHA256 d2e97cdb120c1a88340553db0de85b525b2f3fae163715c789dc1ba3f76b72a1
- MD5 2a6851974cff57bee62a83c52ce68863
- SHA1 c3b22bb00c555274d6413ae48e3ed82103462ff6
- SHA512 25e1a733873f8ab294a281ec658c117d8c93b89ab63a73f199d9b53b25738e3f906822fd5915f360c24bcc9ad1672520e8d8e0964e06624e59750b2d176c2f5a
- SSDEEP 12288:IvlsT6mYXYzYXcZtC1SCOGO1omJ1aa97pfxyuK+i3O:ITCMXuthC1jc1a05AuL
- TLSH T1A0C42380AF792D7CC19C4673456358226B727D22DF890B42039AFEEF5D70B92DD2B146
- MD5 SHA1 SHA512 SSDEEP TLSH