Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 04:36
Behavioral task
behavioral1
Sample
2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 761KB
- Sample260714-e8rdnsgw7z
- SHA256 e6e174309fcfc65b391c17c7931df04a0804a41f9025e87d8d1c2062b8c825ac
- MD5 092c34b69d2a7f21fcb0427c16282a13
- SHA1 cbd69488fd6b4325dcd9541c9c3c1705df82e14e
- SHA512 6f4d3233e41b68bb8ab7f691283e54c00f0487ba6a9dc2cc5de6226be351fc6b099d1f45fff3479f850ca3477235c02d5edc6ab3bf9f4448a33e6a49d4f41900
- SSDEEP 12288:KSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:RvO2xJKRw2kOkxSkW298B
- TLSH T110F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/3744-0-0x00000000009F0000-0x0000000000A7C000-memory.dmp UPX behavioral2/files/0x000a000000011390-2.dat UPX behavioral2/memory/3860-3-0x0000000000750000-0x00000000007DC000-memory.dmp UPX behavioral2/memory/3744-25-0x00000000009F0000-0x0000000000A7C000-memory.dmp UPX behavioral2/memory/3860-26-0x0000000000750000-0x00000000007DC000-memory.dmp UPX behavioral2/memory/3860-44-0x0000000000750000-0x00000000007DC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3860 b2a76112 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 20 223.5.5.5 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 1 114.114.114.114 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 2 223.5.5.5 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 19 114.114.114.114 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b2a76112 File created C:\Windows\SysWOW64\b2a76112 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 b2a76112 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b2a76112 -
resource yara_rule behavioral2/memory/3744-0-0x00000000009F0000-0x0000000000A7C000-memory.dmp upx behavioral2/files/0x000a000000011390-2.dat upx behavioral2/memory/3860-3-0x0000000000750000-0x00000000007DC000-memory.dmp upx behavioral2/memory/3744-25-0x00000000009F0000-0x0000000000A7C000-memory.dmp upx behavioral2/memory/3860-26-0x0000000000750000-0x00000000007DC000-memory.dmp upx behavioral2/memory/3860-44-0x0000000000750000-0x00000000007DC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4215a8 b2a76112 File opened for modification C:\Windows\401940 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b2a76112 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b2a76112 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b2a76112 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b2a76112 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b2a76112 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b2a76112 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b2a76112 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b2a76112 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b2a76112 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b2a76112 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3860 b2a76112 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 3744 2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3860 b2a76112 Token: SeTcbPrivilege 3860 b2a76112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_092c34b69d2a7f21fcb0427c16282a13_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
C:\Windows\Syswow64\b2a76112C:\Windows\Syswow64\b2a761121⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4215a8
- Size 1KB
- SHA256 d30b888ac2a6d06239dae61a8c3335f741bbf1e54547796e368885eb7d68c437
- MD5 a1bfcd961642e1a1fe80bb020a0e31f5
- SHA1 1634befdeb18cd9fe9a2a4c18ea4fa97a91e7025
- SHA512 ec0c7bcf637737b136b8c05b7ddb4554a2fee43007b6456dc454b73d8a52b6f2c63d092dd8a70f8934b8b469d39a7f9b201c4f32df5638670af626aa69d79c64
- TLSH T1B911E239B9EC30E096BE2A9DEB86C888B536B0330544905A05DB39DB60D79AC5C1643D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\b2a76112
- Size 761KB
- SHA256 a3910a78e623ef646a4abd637385423cd2b072e0bba1ba19a9b76ccf6c03dd7a
- MD5 0eb8842cc033b073164e83dec44c4de6
- SHA1 16e74e9731bb2bd6bcc7f64532d45bd461f5b6f8
- SHA512 8b76d6437312dc774757460aa9a522c0a8344067df9cef59a75b6a93935ca5b602b463f598f5460b0aa309df9cf5f8fcf63745d109f45e142bdd16d8ae2d14d5
- SSDEEP 12288:XSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:ivO2xJKRw2kOkxSkW298B
- TLSH T199F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH