Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/07/2026, 22:03
Behavioral task
behavioral1
Sample
2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe
- Size 2.0MB
- Sample260710-1yn2fset9w
- SHA256 ec5b5df0538dcf23902b6b68b8629d037b10dd91864eb711e456411ea1f6dec2
- MD5 b9a1a10b7df7410eb9683e6797a14e1d
- SHA1 48ab832324f31f4fddfa4d0d20c42fb766c7bb49
- SHA512 6850b62a416ae630cd98f6bf6bff5920d0245649ef7c46a77aa954eb707328c5a4b3d37b431ee02caf13480b938907abd671b73257719813a97ab3fdb533e98b
- SSDEEP 24576:z3NnPAGMEEvzJlDPUTivmucfc0TJJlBJG9cgOGomNJid0Tqw+ITe:JPAGcvbPKJk0TvVHgOGf00ThxTe
- TLSH T1BFA56B1073E0C532E4F7167089BA66B44ABABC625B32D2CF664837DD4E367C09A3475B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/4192-0-0x0000000000400000-0x0000000000410000-memory.dmp UPX behavioral1/memory/4192-1-0x0000000000400000-0x0000000000410000-memory.dmp UPX behavioral1/files/0x00010000000081ea-6.dat UPX behavioral1/memory/4192-22-0x0000000000400000-0x0000000000410000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wermgr.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\dialer.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\finger.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\compact.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\efsui.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\expand.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\write.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\setup16.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\notepad.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\mmc.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\where.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\whoami.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\attrib.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\runas.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\print.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe -
resource yara_rule behavioral1/memory/4192-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4192-1-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00010000000081ea-6.dat upx behavioral1/memory/4192-22-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\r\securekernel.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\f\DeviceCredentialDeployment.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\f\DTUHandler.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\r\autochk.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.1_none_d333642c61130785\rrinstaller.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\r\FileExplorer.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\MoUsoCoreWorker.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_vmconnect6.3_31bf3856ad364e35_10.0.19041.1_none_5c4ad75abbc47892\vmconnect6.3.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_6b92f924ed7df79b\fixmapi.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.84_none_9e56f6c66f3fd630\mfpmp.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.1266_none_d375b5361b806b32\f\WpcTok.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.1151_none_f7be996d8409bfa1\wsl.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\f\SearchApp.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9c79736d61efaf52\imecfmui.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_08acfd4a9926561a\r\wermgr.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.19041.1_none_ad4ed32c0facc27c\w32tm.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\perfmon.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\f\StartMenuExperienceHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.19041.1_none_8dec776522fcecde\wbemtest.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.19041.1_none_18e6b82c93a9c5f6\xcopy.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_dc7caa836f08ad57\f\regedit.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\f\WerFaultSecure.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\mmgaserver.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\iisreset.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.746_none_eaf7a50dc46d5592\Utilman.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\ssh.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\r\Dism.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.19041.1_none_2fe41983d5cad0a7\DevicePairingWizard.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_8a11dbe22c9bf6e1\msfeedssync.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\rdpshell.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.19041.1_none_31431424ec14de3f\RdpSa.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.906_none_066336a1b904a848\r\taskhostw.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.1_none_cc9d1ee374152f46\UserAccountBroker.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\f\convertvhd.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\r\vmms.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.19041.1_none_49c7a9c019150ac4\MdSched.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.19041.84_none_dc38e61c21c1b710\NetEvtFwdr.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_f4a35974d85ff180\SettingSyncHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..tofservice-oposhost_31bf3856ad364e35_10.0.19041.1_none_3d1291badd9e7f22\OposHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\fltMC.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\relog.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_69775cdd639910cb\PATHPING.EXE 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_6e05a6bb2291b4c6\IMESEARCH.EXE 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\f\lpkinstall.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1052_none_648fbf276da33ed4\NcsiUwpApp.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\r\wpnpinst.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\f\DataExchangeHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_dc8146375466099a\f\DWWIN.EXE 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.1_none_1655d5e596a1ade0\netbtugc.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.1_none_8bd71d601a2cdd3f\TSTheme.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\f\fltMC.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\r\msra.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\f\EaseOfAccessDialog.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\HvsiSettingsWorker.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9064b8c1b47576c0\iscsicli.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1266_none_92496ac84272f5f1\f\LegacyNetUXHost.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\pcwrun.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\tracerpt.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_f2fa56e679b879d1\icacls.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.423_none_0b0196a3d38fda4e\OOBENetworkConnectionFlow.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\r\WSCollect.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\MsSense.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard_31bf3856ad364e35_10.0.19041.1_none_061d84508b376f80\WmsDashboard.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\r\AtBroker.exe 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_b9a1a10b7df7410eb9683e6797a14e1d_coinminer_elex_memery_rhadamanthys_stop_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4192
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 4.9MB
- SHA256 55fca322e70cc974d54d360c4676aaac952f52c856271efedb5bd199ccfd1307
- MD5 874d099784f1b94a28abcdb0cc4a8f2c
- SHA1 fa96ea757279a674acfef7c8fafef07f5f751e2d
- SHA512 fd298d1bce643cb4e99426f2f2a4233eb9916691e65c6a5d5d080032055f6497f581e7f9ef03dd9865c5ba0ceb87e771f1e10ea07ac515301d5f11a4e6f8b109
- SSDEEP 49152:JPAGcvbPKJk0TvVHgOGf00ThxTJCG8qJpuUcmUmujq2r8gr/vrhLO+vKXjZJP71E:VQoHgO5o5CbhLajkWHEsr37
- TLSH T121368E11A7B8C0A5C0FAC1798577AA52E6727C0E8731E2DB469076AF0F377D09E39712
- MD5 SHA1 SHA512 SSDEEP TLSH