Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 17:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe
- Size 1.1MB
- Sample260730-vyly7starh
- SHA256 4f16fbc8c43dc37893f5bfc8708664ad2342f8ebb9623203463ee1a9aa3477d4
- MD5 8478419a7c94a747498e47fd886f6e43
- SHA1 baa92f32bece87049d7421937abbda32fbd7d4b5
- SHA512 157595c75bc07d9280999dfb09481f5fc496fae2937ff33b6cdcc50e0388aa62123399ce572c864cb5c06887c6413db2e6c48c0c97b2cea61944fb8d78b2ce24
- SSDEEP 24576:C0S031oEGeKWdazvQoHemA6P27nGb26MGY5RIr:jGoazvpemvP2qlSRM
- TLSH T15245CF7CFA408792C50496B0CDC454E862468C735BBAE173D9CA6E7D64B67EC0D833AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral2/memory/2868-0-0x0000000000400000-0x0000000000556000-memory.dmp UPX behavioral2/memory/2868-1-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-2-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-34-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-42-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-45-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-40-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-38-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-36-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-32-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-30-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-28-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-26-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-24-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-22-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-18-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-16-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-14-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-12-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-44-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-3-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-20-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-10-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-8-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-6-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-4-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-46-0x00000000023C0000-0x00000000023FE000-memory.dmp UPX behavioral2/memory/2868-47-0x0000000000400000-0x0000000000556000-memory.dmp UPX -
resource yara_rule behavioral2/memory/2868-1-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-2-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-34-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-42-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-45-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-40-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-38-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-36-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-32-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-30-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-28-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-26-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-24-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-22-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-18-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-16-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-14-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-12-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-44-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-3-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-20-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-10-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-8-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-6-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-4-0x00000000023C0000-0x00000000023FE000-memory.dmp upx behavioral2/memory/2868-46-0x00000000023C0000-0x00000000023FE000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe 2868 2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_8478419a7c94a747498e47fd886f6e43_coinminer_elex_xiaoba.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2868