Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 07:22
Behavioral task
behavioral1
Sample
2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 766KB
- Sample260718-h7btdab13p
- SHA256 e10d5ea4ca8cc8c7aa24f25aac6ef4a249f6a81e31ca0cdae479370f402c55f0
- MD5 8458aa76c3b7cf4aedb03f4c240403d5
- SHA1 44a5e01373bb88fb54c7d2c5e3a2178af902522a
- SHA512 6938a5bafb4670d9fa3f8e027fca9dc5d6f3e01bb48e5d6ca74a013f358a7acdcc7f7555ef61024313afcabd79c9ea76f577b68f46f8932620fd23ab270af1cd
- SSDEEP 12288:FSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:kvO2xJKRw2kOkx2LFRvcUV
- TLSH T15DF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/4360-0-0x0000000000390000-0x000000000041C000-memory.dmp UPX behavioral2/files/0x0008000000019cc1-2.dat UPX behavioral2/memory/2612-3-0x00000000002F0000-0x000000000037C000-memory.dmp UPX behavioral2/memory/4360-25-0x0000000000390000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2612-26-0x00000000002F0000-0x000000000037C000-memory.dmp UPX behavioral2/memory/2612-39-0x00000000002F0000-0x000000000037C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 2612 cae09fa4 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 26 223.5.5.5 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 1 114.114.114.114 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 3 223.5.5.5 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 25 114.114.114.114 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cae09fa4 File created C:\Windows\SysWOW64\cae09fa4 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cae09fa4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cae09fa4 -
resource yara_rule behavioral2/memory/4360-0-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/files/0x0008000000019cc1-2.dat upx behavioral2/memory/2612-3-0x00000000002F0000-0x000000000037C000-memory.dmp upx behavioral2/memory/4360-25-0x0000000000390000-0x000000000041C000-memory.dmp upx behavioral2/memory/2612-26-0x00000000002F0000-0x000000000037C000-memory.dmp upx behavioral2/memory/2612-39-0x00000000002F0000-0x000000000037C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2cb7e8 cae09fa4 File opened for modification C:\Windows\4aa510 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cae09fa4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cae09fa4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cae09fa4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cae09fa4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cae09fa4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cae09fa4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cae09fa4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cae09fa4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cae09fa4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cae09fa4 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 2612 cae09fa4 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 4360 2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 2612 cae09fa4 Token: SeTcbPrivilege 2612 cae09fa4
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_8458aa76c3b7cf4aedb03f4c240403d5_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
C:\Windows\Syswow64\cae09fa4C:\Windows\Syswow64\cae09fa41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\2cb7e8
- Size 916B
- SHA256 add472aa07fe435aa14f79d9012dd3bba155aa342f035cf7b5be8ba04c4e3cb1
- MD5 4775cf5a9998a7ae46696a1854af1e29
- SHA1 f4ed32251413b68896b98620551ce410cf8984be
- SHA512 5eb072c0d7be6803484937ef3e39caa5edf38e37efb7d608d25296d245ef534dec1616661ed6f673b204f858436e6a9135832e83af353565bbf0e9bf132f752d
- TLSH T1FD1129B67CAFA2FD94F49BA4E0A90EFFB63834D4D097D423C049396068535668C13123
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\cae09fa4
- Size 766KB
- SHA256 97d73be37eeb35dd40f28577d4ddb56b3ee153134b7cd368fd3d8a87252bea29
- MD5 3d12460ec2218dd3fb70d350b0356809
- SHA1 3f7a6b5d558b99489516fd06140d79e4705ef625
- SHA512 bbf3f05fb7704929871fbfa71c639810b839b8ea4fbe94701c683270860bf8aced74e518eaaaf61c6bdb8344fc01bcb97b4ab9e8682562f431012a2f35b62e8c
- SSDEEP 12288:oSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:jvO2xJKRw2kOkx2LFRvcUV
- TLSH T1C9F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH