Analysis

  • max time kernel
    150s
  • max time network
    111s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 16:03

General

  • Target
    2026-07-11_7b0398b61680608071d40733243872af_coinminer_elex_stop.exe
  • Size 1.5MB
  • Sample260711-thrdbagt3w
  • SHA256 3b48a5eda931454ba58431a90ac977c34fa6779b2cd4cf0a6c3e7ef82e821a21
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 3 IoCs
  • UPX dump on OEP (original entry point) 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_7b0398b61680608071d40733243872af_coinminer_elex_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_7b0398b61680608071d40733243872af_coinminer_elex_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 1668
      2⤵
      • Program crash
      PID:5852
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 236 -p 3500 -ip 3500
    1⤵
      PID:5352

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          style-ie7.css

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\css\style-ie7.css
          • Size 904B
          • SHA256 a7b66e20140881d7b57009fc22647b005c0a94515d66af57367302a34227c66b
          • MD5 SHA1 SHA512 TLSH

          style.css

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\css\style.css
          • Size 7KB
          • SHA256 a36ef31ded506a805e2fc72a2b6df81d6a37693e170ff4d016a61d0428c95276
          • MD5 SHA1 SHA512 SSDEEP TLSH

          AgreementScreen.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\AgreementScreen.jpg
          • Size 9KB
          • SHA256 1f4b39dda7a2c4181c7164cdd35e60d04cd232208613bf2bef99b9450ff3915b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          CatalogueScreen.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\CatalogueScreen.jpg
          • Size 18KB
          • SHA256 621cdb5117b14db8804bc9fd2472b00c0d809a97975b443400a0b901d7452910
          • MD5 SHA1 SHA512 SSDEEP TLSH

          DownloadsScreen.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\DownloadsScreen.jpg
          • Size 15KB
          • SHA256 5cda60d4abb1d57b6f10e0d91d4f9a8100d95aaa1ac118d218f981b71c6154c1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          FeaturesScreen.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\FeaturesScreen.jpg
          • Size 12KB
          • SHA256 3e5faa57bfc6def55ae8052f5aa8efc258a3ad8f3cb9b40691a8b565071fba04
          • MD5 SHA1 SHA512 SSDEEP TLSH

          InstallScreen.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\InstallScreen.jpg
          • Size 16KB
          • SHA256 5808ddc486e21f939ef8613b5793fa64f2c2491a76455dfb1a184ef04c04292b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Marker.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\Marker.jpg
          • Size 771B
          • SHA256 99793d62273ab6b91ec41fb4fa9ff08f91661a3ddb85fa128e1724f1572d7134
          • MD5 SHA1 SHA512 TLSH

          MediaLibraryScreen.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\MediaLibraryScreen.jpg
          • Size 15KB
          • SHA256 d1c443a32e41d0e54b26f3d775342ccd963892c82a8ef651280f2d8d4612566e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MediaPlayerScreen.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\MediaPlayerScreen.jpg
          • Size 10KB
          • SHA256 b5beb00448cd2f9bb8c148ddaa20f97474a41fb965b60bb5ac3181924c1e5e27
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SearchScreen.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\SearchScreen.jpg
          • Size 24KB
          • SHA256 459ffe46bd712ad7300627dc062e97b25902d0fc1945c1002f2ddd29b383f64d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          TabBg.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\TabBg.jpg
          • Size 1KB
          • SHA256 6ff2ede122e7a8c88cddf2074ef64a191501b8cdb2d007a7acbf9fdcbe1b15a2
          • MD5 SHA1 SHA512 TLSH

          check.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\check.jpg
          • Size 1KB
          • SHA256 2e19f60efa95f693c0b1a00605df9e4d2ab22bb2b388f828118f5a91396635d2
          • MD5 SHA1 SHA512 TLSH

          header_cycle_arrows_shape.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\header_cycle_arrows_shape.jpg
          • Size 2KB
          • SHA256 a2c2c1fd5f0273adf862bfdb3d2539e8f278792ea85d70e91ef0b1d1cba1adfa
          • MD5 SHA1 SHA512 TLSH

          installbutton.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\installbutton.jpg
          • Size 367B
          • SHA256 db4a08aca4e4a97db0dd3caed7d660b4f5028597f1583e604a2918b1eaf4dc83
          • MD5 SHA1 SHA512 TLSH

          installbutton_l.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\installbutton_l.jpg
          • Size 426B
          • SHA256 8678cf45d43468579793cc89bc4c31b566606c678fcda80990d6c895f8cf528f
          • MD5 SHA1 SHA512 TLSH

          loadinfo1.gif

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\loadinfo1.gif
          • Size 6KB
          • SHA256 8e828b825886d6cffcbd968c323287a676586eda096db4eee58957ade5dfcd20
          • MD5 SHA1 SHA512 SSDEEP TLSH

          logo.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\logo.jpg
          • Size 2KB
          • SHA256 e34901a370661bb015b7ebd6d5ce33ae4dbff08f12dfbb65b7d3f8cc48fd288e
          • MD5 SHA1 SHA512 TLSH

          menuBg.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\menuBg.jpg
          • Size 2KB
          • SHA256 35a2ac79c81dfb8c3ccb23713b3ca93d3713542f822aa46f0d63c7b473b11499
          • MD5 SHA1 SHA512 TLSH

          next.jpg

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\next.jpg
          • Size 664B
          • SHA256 ecc4d9ba2c50cdecfd3fb4c9089be82ba897857721d394e5c953a7d1d469f885
          • MD5 SHA1 SHA512 TLSH

          index.html

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html
          • Size 8KB
          • SHA256 bfe1156a7ac9dc1f43ed3eb207749edfec973f5e8da106cbd419b21160db2033
          • MD5 SHA1 SHA512 SSDEEP TLSH

          DD_belatedPNG.js

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\scripts\DD_belatedPNG.js
          • Size 5KB
          • SHA256 8c61dcfbc3dda3c82b2bbe977d816ed71cfb98a12545f2b2b1d218178e13b238
          • MD5 SHA1 SHA512 SSDEEP TLSH

          jquery.js

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\scripts\jquery.js
          • Size 89KB
          • SHA256 c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
          • MD5 SHA1 SHA512 SSDEEP TLSH

          scripts.js

          • Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\scripts\scripts.js
          • Size 2KB
          • SHA256 59b68cf699583328272a78d8b88eeb1a2552c5cac76410e3ed513c7df075d665
          • MD5 SHA1 SHA512 TLSH

          memory/3500-0-0x0000000000400000-0x0000000000586000-memory.dmp

          memory/3500-1-0x000000000047A000-0x000000000047B000-memory.dmp

          memory/3500-2-0x0000000000400000-0x0000000000586000-memory.dmp

          memory/3500-203-0x0000000000400000-0x0000000000586000-memory.dmp