Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 00:52
Behavioral task
behavioral1
Sample
2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 560KB
- Sample260720-a7538ads2x
- SHA256 ccef6695e93c53a5284d1b186d29e0145a4d60fffc05074a375846e43b8803e2
- MD5 a2aeeb7be69930048b1ff4d54e0bf03e
- SHA1 e745ca03869427b862116f46970dd64a601f5113
- SHA512 42d0a4df559ff520e98f19cefade610bab20dab84cd883015f6da936af572bd2401e4d59194fdce4cca10d32c08b0aa75f5dbe4850235f4531c36868e7fdd8c3
- SSDEEP 6144:uWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:ukCO2zVPX7vf1LKlIsOkxHy
- TLSH T196C47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D00B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral1/memory/5040-0-0x0000000000F10000-0x0000000000F9C000-memory.dmp UPX behavioral1/files/0x000a000000024290-3.dat UPX behavioral1/memory/1628-4-0x0000000000C90000-0x0000000000D1C000-memory.dmp UPX behavioral1/memory/5040-15-0x0000000000F10000-0x0000000000F9C000-memory.dmp UPX behavioral1/memory/1628-16-0x0000000000C90000-0x0000000000D1C000-memory.dmp UPX behavioral1/memory/1628-33-0x0000000000C90000-0x0000000000D1C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 1628 af2966e8 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 30 114.114.114.114 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 31 223.5.5.5 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 3 114.114.114.114 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 4 223.5.5.5 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\af2966e8 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 af2966e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 af2966e8 -
resource yara_rule behavioral1/memory/5040-0-0x0000000000F10000-0x0000000000F9C000-memory.dmp upx behavioral1/files/0x000a000000024290-3.dat upx behavioral1/memory/1628-4-0x0000000000C90000-0x0000000000D1C000-memory.dmp upx behavioral1/memory/5040-15-0x0000000000F10000-0x0000000000F9C000-memory.dmp upx behavioral1/memory/1628-16-0x0000000000C90000-0x0000000000D1C000-memory.dmp upx behavioral1/memory/1628-33-0x0000000000C90000-0x0000000000D1C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1bdf38 af2966e8 File opened for modification C:\Windows\564960 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language af2966e8 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix af2966e8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" af2966e8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ af2966e8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" af2966e8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" af2966e8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" af2966e8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" af2966e8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" af2966e8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing af2966e8 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1628 af2966e8 1628 af2966e8 1628 af2966e8 1628 af2966e8 1628 af2966e8 1628 af2966e8 1628 af2966e8 1628 af2966e8 1628 af2966e8 1628 af2966e8 1628 af2966e8 1628 af2966e8 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 5040 2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 1628 af2966e8 Token: SeTcbPrivilege 1628 af2966e8
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_a2aeeb7be69930048b1ff4d54e0bf03e_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
C:\Windows\Syswow64\af2966e8C:\Windows\Syswow64\af2966e81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\1bdf38
- Size 501B
- SHA256 69048d6ec10344f91de9a4836baa059f3531ff928b6bbaaf27ee83c23de981f7
- MD5 5545ec27e01117759b0ce49258970443
- SHA1 fb0fbdcb24b3af14f068d01ef2a28e179c168c86
- SHA512 863b6d347cc04d4dde74eaa30160790c94c3fc7a692a7a9e6c5d626246d1810f2a539183b31a81e1e9835954c5286b75c0a62c405c4f177842b7cc067f1780c3
- TLSH T131F059FED42972A64B9A5CFA8B1B989E7056182EC01BB582BDC1708487872836D03E07
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\af2966e8
- Size 560KB
- SHA256 23196ac62b578f70c2e09641f989af49e493462b165ca66199ce636fbb212520
- MD5 182b6851750801afd7bf2207fae19f1d
- SHA1 e5a77cadc604de1de727602ef80b9962b234de9c
- SHA512 7ad2a6c4df8563e017983f03385b4473520cc46bcd26cba94857c814a905e01663ff0c290262857f09f6a91f1fad0cf1c7f36725e924b5aa2a7449c94d448230
- SSDEEP 6144:cWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRuy8K:ckCO2zVPX7vf1LKlIsOkxHy
- TLSH T1E9C47C29B690D076C4779574C4A187AAFAB1B432372449CFB3D00B5A1F237E2BA7530E
- MD5 SHA1 SHA512 SSDEEP TLSH