Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
23/07/2026, 12:53
General
- Target 2026-07-23_74128538d36e58a581e7349ca3a6e37f_coinminer_elex_xiaoba.exe
- Size 1.1MB
- Sample260723-p44hjsba57
- SHA256 4dec919f7e94c627002c522993813d4787d6ce8a4b6331d7179dbcdfe6ce83bf
Malware Config
Signatures
- UPX dump on OEP (original entry point) 29 IoCs
- UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_74128538d36e58a581e7349ca3a6e37f_coinminer_elex_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_74128538d36e58a581e7349ca3a6e37f_coinminer_elex_xiaoba.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1184-0-0x0000000000400000-0x0000000000556000-memory.dmp
memory/1184-1-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-43-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-48-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-47-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-46-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-41-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-39-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-37-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-35-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-33-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-32-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-29-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-27-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-23-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-21-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-19-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-17-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-15-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-11-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-9-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-5-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-3-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-2-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-25-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-13-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-7-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-50-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-49-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-51-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-52-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-55-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-54-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-53-0x0000000005BE0000-0x0000000005C00000-memory.dmp
memory/1184-56-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-57-0x0000000005BE0000-0x0000000005C00000-memory.dmp
memory/1184-59-0x0000000002460000-0x000000000249E000-memory.dmp
memory/1184-58-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-60-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-61-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-63-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-62-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-64-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-66-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-65-0x0000000005BE0000-0x0000000005C00000-memory.dmp
memory/1184-68-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-67-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-69-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-70-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/1184-71-0x0000000000400000-0x0000000000556000-memory.dmp