Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target 2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe
- Size 1.3MB
- Sample260710-dcpdrsct8j
- SHA256 53c428380bc61067b717b88fc3e7b0915cb2039de54ec1aa84547bb659dae64e
- MD5 6dd876dd0099e03ff7840a40a411e581
- SHA1 c54ef802b20fc2fc64344030787cafeb9e4ca955
- SHA512 28e5cb648d7cdaed1bec59cb63484ed668d998143ab42fdef20d51e35f8b1aedeab14937051aea49a57126092b5ea8ce05df9d694afc3675c53fda48f364eb45
- SSDEEP 24576:yCx+ds2shQb206BvBPbfFT1R6eUBxXhT2oZl+fTbV7Jn3o0E+I5VaMU+:hdTBpL56eUBLTjgZE+I5VC+
- TLSH T129557D61B702C035EDA304B1897E47AE95246F61032655C7F3D43C6A2FB66E32B37A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 5668 3096 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\DOMStorage\softonic.com 2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\DOMStorage 2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\DOMStorage\softonic.com\NumberOfSubdomains = "1" 2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 5c0000000100000004000000000800000b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f57f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa467e00000001000000080000000080826f22e7dc01030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E 2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3096 2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe 3096 2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_6dd876dd0099e03ff7840a40a411e581_coinminer_elex_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:3096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 30402⤵
- Program crash
PID:5668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3096 -ip 30961⤵PID:1712