f112f646226a0448c0d7af72cf4ef131d27130ffa7daffd0540ce3035f54a711

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe
Size 1.5MB
Sample260711-sa5ejaey3x
SHA256 f112f646226a0448c0d7af72cf4ef131d27130ffa7daffd0540ce3035f54a711
MD5 e7df772189dcc00989ade8c33c86d8d9
SHA1 5f7b2db7753bc90aad67c11d300e6295a61b457e
SHA512 700b5250c5606dc67b1d8a56064872fa848124564471bed622036b8c62868d3f6f6d8c8f7ae0db802a871983e3543df28f1210f0075e9bbf472afead520c9d16
SSDEEP 24576:tROIXNWO23lN/OVxXSdsWpqU5fK5IEAV8FojIRg4n9HQrEcA:tMI9WVFmXS5qhc8FoMV91cA
TLSH
T15065E1123DB291BAE5A702F50D6C4E8ADC14DC150BDF26E72BC8905B4E6A9D73835E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/5352-0-0x0000000000400000-0x0000000000579000-memory.dmp	UPX
behavioral2/memory/5352-4-0x0000000000400000-0x0000000000579000-memory.dmp	UPX

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5352 set thread context of 2260	5352	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe	89

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5352-0-0x0000000000400000-0x0000000000579000-memory.dmp	upx
behavioral2/memory/5352-4-0x0000000000400000-0x0000000000579000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5352 wrote to memory of 2260	5352	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe	89
PID 5352 wrote to memory of 2260	5352	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe	89
PID 5352 wrote to memory of 2260	5352	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe	89
PID 5352 wrote to memory of 2260	5352	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe	89
PID 5352 wrote to memory of 2260	5352	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe	89
PID 5352 wrote to memory of 2260	5352	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe	89
PID 5352 wrote to memory of 2260	5352	2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Users\Admin\AppData\Local\Temp\2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-11_e7df772189dcc00989ade8c33c86d8d9_coinminer_elex_stop.exe" Track="0001000000"
  2⤵
  PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-1-0x0000000000400000-0x00000000004EA000-memory.dmp

Download

memory/5352-0-0x0000000000400000-0x0000000000579000-memory.dmp

Download

memory/5352-4-0x0000000000400000-0x0000000000579000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads