Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 14:17
Behavioral task
behavioral1
Sample
2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe
- Size 576KB
- Sample260712-rl1eaadv6v
- SHA256 b630eb0da84e8e7776d199864ea887c79b91ed29c8231a5d145f77f1e38e1799
- MD5 11a2f9e80e0ca96c88a83555328941c0
- SHA1 0cdbcd4e1d68c7659748800bc7a1f42e5dba9753
- SHA512 71725956e63c83dfaeb7445d8abcb1d47c44f3d840fc8763184aa0344897b97e79530dfd61688fae9feba741f0b8103fdf60771e5ac5bce11b6df4615560772c
- SSDEEP 12288:fqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:fjHPOSOkx2LFscUQPK
- TLSH T162C47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/3940-0-0x0000000000740000-0x00000000007C9000-memory.dmp UPX behavioral1/files/0x000a0000000004e9-2.dat UPX behavioral1/memory/4372-4-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral1/memory/3940-12-0x0000000000740000-0x00000000007C9000-memory.dmp UPX behavioral1/memory/4372-15-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral1/memory/3940-30-0x0000000000740000-0x00000000007C9000-memory.dmp UPX behavioral1/memory/4372-31-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral1/memory/3940-41-0x0000000000740000-0x00000000007C9000-memory.dmp UPX behavioral1/memory/3940-43-0x0000000000740000-0x00000000007C9000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 4372 dc127e08 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe Destination IP 4 223.5.5.5 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe Destination IP 32 114.114.114.114 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe Destination IP 36 223.5.5.5 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dc127e08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dc127e08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 dc127e08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dc127e08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 dc127e08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE dc127e08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dc127e08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 dc127e08 File created C:\Windows\SysWOW64\dc127e08 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies dc127e08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 dc127e08 -
resource yara_rule behavioral1/memory/3940-0-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral1/files/0x000a0000000004e9-2.dat upx behavioral1/memory/4372-4-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral1/memory/3940-12-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral1/memory/4372-15-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral1/memory/3940-30-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral1/memory/4372-31-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral1/memory/3940-41-0x0000000000740000-0x00000000007C9000-memory.dmp upx behavioral1/memory/3940-43-0x0000000000740000-0x00000000007C9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4ad9a8 dc127e08 File opened for modification C:\Windows\437448 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc127e08 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dc127e08 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" dc127e08 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" dc127e08 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" dc127e08 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" dc127e08 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" dc127e08 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dc127e08 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dc127e08 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ dc127e08 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4372 dc127e08 4372 dc127e08 4372 dc127e08 4372 dc127e08 4372 dc127e08 4372 dc127e08 4372 dc127e08 4372 dc127e08 4372 dc127e08 4372 dc127e08 4372 dc127e08 4372 dc127e08 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe Token: SeTcbPrivilege 3940 2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe Token: SeDebugPrivilege 4372 dc127e08 Token: SeTcbPrivilege 4372 dc127e08
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_11a2f9e80e0ca96c88a83555328941c0_amadey_coinminer_elex_remcos_smoke-loader.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
C:\Windows\Syswow64\dc127e08C:\Windows\Syswow64\dc127e081⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4ad9a8
- Size 506B
- SHA256 46633ffdfa8c1f2b470ed884406a1ebe5309bef2914f9fd1079e738c87a71b4b
- MD5 ee5b24b569a31967712f444955ccd418
- SHA1 6f135046faf155cbedaa0d82d1ecbd10632c871a
- SHA512 f971b57d15a2cab7cde9f9d1b5be3fdcdb247e0e6b7831c5fbdbd72a0682ab7973f79d63cf5f59ebfb9ac7f2fb6d7b89361c4f61d21f883c443e1f28fe2c5b77
- TLSH T1BDF0057995623EFD0FDD56F2460718551026102EC01F10E2FDC0F3460C632675D03609
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\dc127e08
- Size 576KB
- SHA256 fd8be0a94e66450b5f7a22cd5d8ea1a009cbecf45c34b04cbc8a4fb1c789258d
- MD5 7e06a1d4fa8e7a753607c6e0106a7ed1
- SHA1 81f9dffab106a85e052ca9bdfbd1258eabffd1bf
- SHA512 c249c4744ca076ff55dd69a2734804056df4709d13b9bf379d8f94b89ca158b32eb31e56d26b815152679d017e74ff7e5ce1f223f127daddd68539411523fd28
- SSDEEP 12288:pqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:pjHPOSOkx2LFscUQPK
- TLSH T1DDC47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH