7c019db2e775e9afa3159779affcf5e087e020277a885a88e76ea4fda0d0bf63

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_829811b144373830621f5f0245589303_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Size 519KB
Sample260710-pyxstabx4r
SHA256 7c019db2e775e9afa3159779affcf5e087e020277a885a88e76ea4fda0d0bf63
MD5 829811b144373830621f5f0245589303
SHA1 4b9e34723f77f46c3415c34c7e4fc07b4962653c
SHA512 ee6a0b9a780376ce5ca6ba2eae308d45b973e9dedc587312fe32de74b5fecd69cea3c3fd3ab9a8361868ee90b6ce7d3a1d754d588954a69eae626d6f91fc77ee
SSDEEP 6144:FIxqd1cx30oGz9ZNLSsMvpLSCSHMFdir7cEOkCybEaQRXr9HNdvOa:FDdOxWrN2sMvpLSCEjOkx2LIa
TLSH
T14DB47D2AF6A0C076C4B795B5C5A24AA6FBB1743227204ACFA39047571F637D2BE3530D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/2152-0-0x0000000000A70000-0x0000000000AFA000-memory.dmp	UPX
behavioral2/memory/2152-1-0x0000000000A70000-0x0000000000AFA000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2152-0-0x0000000000A70000-0x0000000000AFA000-memory.dmp	upx
behavioral2/memory/2152-1-0x0000000000A70000-0x0000000000AFA000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4592	2152	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_829811b144373830621f5f0245589303_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_829811b144373830621f5f0245589303_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_829811b144373830621f5f0245589303_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 472
  2⤵
  - Program crash
  PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2152 -ip 2152
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-0-0x0000000000A70000-0x0000000000AFA000-memory.dmp

Download

memory/2152-1-0x0000000000A70000-0x0000000000AFA000-memory.dmp