13d725b58a740a1f39069977abc74f4f19ea2d067793c2a3d8e623d60e92e479

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_a5fa9912100867f90fd13dc81c4abd40_amadey_coinminer_elex_smoke-loader_virlock.exe
Size 644KB
Sample260718-1fckpsgs4s
SHA256 13d725b58a740a1f39069977abc74f4f19ea2d067793c2a3d8e623d60e92e479
MD5 a5fa9912100867f90fd13dc81c4abd40
SHA1 ce7e9630c9f48317043426bf2d0e3d693702e1aa
SHA512 a651be7def0a9232640c9b4cd3a2df91f78fac9729341bc6de627e0f9b2761b86b0e535179d4cbab7b66ec9d7a73f4957f6a38f412a664a3f6cb697c9f7eb8ec
SSDEEP 12288:DEPEPxF2dqIOkU8AMXE9B7PElZlP41v6ro4nn:aUWBOkUhMXcBwcCro4
TLSH
T139E47F72A35050B6D6F10972E93896707F3976542B30C8678384FD3D2A7D6B2ABF7212
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4916	3900	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_a5fa9912100867f90fd13dc81c4abd40_amadey_coinminer_elex_smoke-loader_virlock.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_a5fa9912100867f90fd13dc81c4abd40_amadey_coinminer_elex_smoke-loader_virlock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_a5fa9912100867f90fd13dc81c4abd40_amadey_coinminer_elex_smoke-loader_virlock.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 264
  2⤵
  - Program crash
  PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3900 -ip 3900
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3900-0-0x0000000000400000-0x00000000004A215C-memory.dmp

Download

memory/3900-1-0x0000000000400000-0x00000000004A215C-memory.dmp