0d784f56886d132e62adad4afe092c6cb0dd14bc87f6e79fe470b632add79ce2

General

Target
2026-07-11_8b0c7af3e983a803882f3146315bfad6_amadey_coinminer_elex_mespinoza_remcos_smoke-loader.exe
Size 4.9MB
Sample260711-p7ptkabs2n
SHA256 0d784f56886d132e62adad4afe092c6cb0dd14bc87f6e79fe470b632add79ce2
MD5 8b0c7af3e983a803882f3146315bfad6
SHA1 dc6577e174ea8d76fd6b0e50b088253e6db4c8f5
SHA512 5da1fafe440ab9881f9a460ed9c04fed6c92f95eb80144b84f513e49f18fb73d23e31dce5e7d851824b77b1a605bc10770c0db577281963ff685c56eeb3cdccf
SSDEEP 98304:Sdy38GGP3TF2mj30s5XuBN8mFDfBj7QhsccWDh7F2XVEaAJnFAq8dsEYeJNuZHsX:8yKmRpzccUhoe3KZdyZHsX
TLSH
T19A36DFC07361F828E75A05B0487976F8466626313314E8EFBECB76C2196D3D5ADB0E36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4272	wnetwatcher_setup.exe

Loads dropped DLL 2 IoCs

pid	Process
4272	wnetwatcher_setup.exe
4272	wnetwatcher_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_8b0c7af3e983a803882f3146315bfad6_amadey_coinminer_elex_mespinoza_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wnetwatcher_setup.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x001500000001c430-4.dat	nsis_installer_1
behavioral2/files/0x001500000001c430-4.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4272	3216	2026-07-11_8b0c7af3e983a803882f3146315bfad6_amadey_coinminer_elex_mespinoza_remcos_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_8b0c7af3e983a803882f3146315bfad6_amadey_coinminer_elex_mespinoza_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_8b0c7af3e983a803882f3146315bfad6_amadey_coinminer_elex_mespinoza_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\7zS09CFEED9\wnetwatcher_setup.exe
  .\wnetwatcher_setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wnetwatcher_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS09CFEED9\wnetwatcher_setup.exe
Size 543KB
SHA256 9816f6b622361a5e833ebee0d1be9c710978a6df4f752cad16c3eb7aae5be0c3
MD5 1fd286dc1164ae4d497025acaeb38264
SHA1 24e5e9c5ace133f3a7d578db5dd520d1cc719c75
SHA512 4b2d666f9a8810cded4a0d17804cfa6eba7cecab0cbb20d175192e6b074ac3f78fb2c03be461b81dd3fc890168876e5821de3ee35f18d9d3822f7227a036a54b
SSDEEP 6144:QXp75Mk6qxuRWvqoS4TvxIA3PvDozQ/TrzIY3MLILXVYfYkhpEvI7fNEGJYkUA4b:UP6bRX54NHESTYY3ML/YWbL2WYSQ
TLSH
T113C4231C35C5D036D2A56530064A6FF792BABE2E6A61320B37AC5FF776712478C298C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl9EA9.tmp\InstallOptions.dll
Size 14KB
SHA256 426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088
MD5 3809b1424d53ccb427c88cabab8b5f94
SHA1 bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e
SHA512 626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee
SSDEEP 192:i6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxT7K72dwF7dBdcQOz:i6JaVh4I5rpPbT7+BdhO
TLSH
T13D523A51778888F3E792053EB45237079F9D5226B8929ED1CA331FC22D2B19E2FB1302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl9EA9.tmp\StartMenu.dll
Size 7KB
SHA256 ac53840d019b746ab5dabaa40d7720c9a4487c861b155926454bf8b10bd0963d
MD5 8262fbc2a172ff04146e7587649d7091
SHA1 628be3fede2a79d4b321b12f979711caf77e8a7e
SHA512 8e11f1f1811a424b1ae5ab8e064d5313adc118ee7607f6a6f9b9976647ca6c91496133d5575d4737386a1485f39cf6fd074dbfd619807f42fe148a640186f639
SSDEEP 96:Z+rBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tXGhEl5VN:Z+FepxPE1r8/FtmCDtWg5v
TLSH
T1F0E1F87AF7C044F3D68B43702863BB17EB669A211725B163992716CAB5C24E3DC34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsl9EA9.tmp\ioSpecial.ini
Size 421B
SHA256 38d4e6d729bea785ffb6144bddf0dbc4a3a329cb89ebfea3519822f089b8a97c
MD5 b6d4c062fe7f8c3ec599cbae68dd5390
SHA1 f641df2c028c19f3626159f011a45f6dae175686
SHA512 fb513d2a0bab0b682945b6b1a54aa637057c86356048130611ba61193294f0667ef25093ca88e4640b2fdee832267b27816d7023edd1b02c482cf94398206747
TLSH
T172E02BC8805A92250420A5079AFA3B9657E01E708B023DF6F5325C87778CCE689DDA82
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsl9EA9.tmp\ioSpecial.ini
Size 732B
SHA256 de9cbc5a4307e798549c71e972223844b5bb720fe1ce184779e515471d17f584
MD5 6200a3c003092f7b1687f64150bb0263
SHA1 ac693e06dca456237dbcddb53e53024ca846477e
SHA512 0423e46bc8500d8522d43f110b8092dc4c16dc94c50010b7df141dfadce0153dd16675321bc636837a9f21af0a9d6376c7ed5900f0116ea0a8f02e66593ee882
TLSH
T1A601C088849FE328042051ABA5FD37A14BE01C3C4B123DF7F0669886638DDD34AEDDD2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsl9EA9.tmp\ioSpecial.ini
Size 771B
SHA256 4e3b4fcf00d50199a4fd13120c44b97bd8b123b52c209c24a2a6fde31088a4bf
MD5 6418aa43034235d8e4a072480351941e
SHA1 5bd1022ebb61ca803b11e5daa22d9198e3243fc4
SHA512 396cefb8b6be580dd104bab368f1792ce1522b36762e4c1f83fbd7f5c2cbf547a50ef5078a8309166430a5711691b14a9af03ac020ca4b7d45dfaf577164a607
TLSH
T17301D0C8409FE365441411ABA1FA37A157D01C3C4B123CF6F0569886638DDD389DDDE2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads