b6735dd8800d23810b295857ef5360e605f3bf1de0cf18d682d9101529817bab

General

Target
2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Size 3.3MB
Sample260715-mnj3vsdw41
SHA256 b6735dd8800d23810b295857ef5360e605f3bf1de0cf18d682d9101529817bab
MD5 0a4226e1d88242f91b4effa7501eef60
SHA1 a252c384e7772357131a1c12c9d5ba7b2928d671
SHA512 dea4f2c4ef5c88b048be3fd381cf87d9e9e5df9b49c344df3bc14387801a1cff3e0768e4a0c9cebff33c48262ba37309ebabdea414f7903972f17fef75d81b59
SSDEEP 24576:SvO2xJKRI2dOkx2LFAC///wjHPOnOkx2LFhJbKkKF/eMNPjxdnQbzU:SHHKO2FQN///wTGHQd9KFeMxQbzU
TLSH
T157F54B12FB90C636D16A573048AB439A6BB5FD405B128BDF62D4B31F0F732869E31E58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000242c3-2.dat	UPX

Executes dropped EXE 1 IoCs

pid	Process
1456	8a0b7bc4

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	45	223.5.5.5	2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Destination IP	3	114.114.114.114	2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Destination IP	4	223.5.5.5	2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Destination IP	38	114.114.114.114	2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	8a0b7bc4
File created	C:\Windows\SysWOW64\8a0b7bc4	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	8a0b7bc4
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	8a0b7bc4

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\18ed60	8a0b7bc4
File opened for modification	C:\Windows\2b9f68	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a0b7bc4

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	8a0b7bc4
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	8a0b7bc4
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	8a0b7bc4
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	8a0b7bc4
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	8a0b7bc4
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	8a0b7bc4
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	8a0b7bc4
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	8a0b7bc4
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	8a0b7bc4

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
1456	8a0b7bc4
2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	2548	2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	1456	8a0b7bc4
Token: SeTcbPrivilege	1456	8a0b7bc4

C:\Users\Admin\AppData\Local\Temp\2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_0a4226e1d88242f91b4effa7501eef60_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\Syswow64\8a0b7bc4
C:\Windows\Syswow64\8a0b7bc4
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18ed60

Path C:\Windows\18ed60
Size 506B
SHA256 9b42512c27ca8c9bcabadb4068ac193cd5c48f1895cd5bfff1801afb3b9575c3
MD5 5ac80893f4fc5838857d0da290ed88e3
SHA1 5727e32a9a1c1d803e733c74d3b74734afa8bf1a
SHA512 ddd042bd654e09f3522347ddba9c3d70e9a767961883d17c4867231a2995c757d994ef299af646ed63cc180a6f4cb7d886f0004e4bef2dbeee43c78ad3e9ccd5
TLSH
T19EF00E7E842323B00F9AAAF65F6BA8472016122FC00FE24AE8C0FD900C621C37E47C0D
MD5 SHA1 SHA512 TLSH

Submit Download

8a0b7bc4

Path C:\Windows\SysWOW64\8a0b7bc4
Size 3.3MB
SHA256 02bfb969cffb615f1f26b8ec5562414fc2ba92bee534042c94125fefceb79767
MD5 51f39b1c8b133e032107a86e70d321fb
SHA1 9edc738d608b7d2f9b3b74d75fda44179fbf42aa
SHA512 920e5096458c54c89d09227db168fd346ee242371acd11af6348bd12f11cffa501a729f0193fbecfab1454124c935808b89b9d55447fb0c5bb8fbd2a8e2f31de
SSDEEP 24576:+vO2xJKRI2dOkx2LFAC///wjHPOnOkx2LFhJbKkKF/eMNPjxdnQbzU:+HHKO2FQN///wTGHQd9KFeMxQbzU
TLSH
T1BAF54B12FB90C636D16A573048AB439A6BB5FD405B128BDF62D4B31F0F732869E31E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1456-4-0x0000000000410000-0x0000000000473000-memory.dmp

Download

memory/2548-0-0x0000000000860000-0x00000000008C3000-memory.dmp