Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 00:26
Behavioral task
behavioral1
Sample
2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe
- Size 576KB
- Sample260731-arprashj8v
- SHA256 8ff34e684d3f0e43012e314f4bb006d69374deb5e75c9400e5d1eb8c7485ce8a
- MD5 ab66746c7f646a159cff40ab4d61457f
- SHA1 5306da1308928804cec2ea45ddabe04d1b1b2302
- SHA512 a7d22ca659518a6ee70721ccfc239a46612c397ca532d65422901cfb50fb621ec82fb1f65da87f32d5f8e25dd7f4bb18bdfc97d1e505a90998bbfacc3967a1cc
- SSDEEP 12288:OqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:OjHPOSOkx2LFscUQPK
- TLSH T16CC47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral1/memory/4740-0-0x0000000000550000-0x00000000005D9000-memory.dmp UPX behavioral1/files/0x0014000000024158-2.dat UPX behavioral1/memory/3628-4-0x0000000000BE0000-0x0000000000C69000-memory.dmp UPX behavioral1/memory/4740-13-0x0000000000550000-0x00000000005D9000-memory.dmp UPX behavioral1/memory/3628-15-0x0000000000BE0000-0x0000000000C69000-memory.dmp UPX behavioral1/memory/4740-32-0x0000000000550000-0x00000000005D9000-memory.dmp UPX behavioral1/memory/3628-33-0x0000000000BE0000-0x0000000000C69000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3628 fd54a288 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe Destination IP 4 223.5.5.5 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe Destination IP 30 114.114.114.114 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe Destination IP 31 223.5.5.5 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fd54a288 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fd54a288 File created C:\Windows\SysWOW64\fd54a288 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C fd54a288 -
resource yara_rule behavioral1/memory/4740-0-0x0000000000550000-0x00000000005D9000-memory.dmp upx behavioral1/files/0x0014000000024158-2.dat upx behavioral1/memory/3628-4-0x0000000000BE0000-0x0000000000C69000-memory.dmp upx behavioral1/memory/4740-13-0x0000000000550000-0x00000000005D9000-memory.dmp upx behavioral1/memory/3628-15-0x0000000000BE0000-0x0000000000C69000-memory.dmp upx behavioral1/memory/4740-32-0x0000000000550000-0x00000000005D9000-memory.dmp upx behavioral1/memory/3628-33-0x0000000000BE0000-0x0000000000C69000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3e1cd8 fd54a288 File opened for modification C:\Windows\512688 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd54a288 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fd54a288 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fd54a288 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fd54a288 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fd54a288 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fd54a288 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fd54a288 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fd54a288 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fd54a288 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fd54a288 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3628 fd54a288 3628 fd54a288 3628 fd54a288 3628 fd54a288 3628 fd54a288 3628 fd54a288 3628 fd54a288 3628 fd54a288 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe Token: SeTcbPrivilege 4740 2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe Token: SeDebugPrivilege 3628 fd54a288 Token: SeTcbPrivilege 3628 fd54a288
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_ab66746c7f646a159cff40ab4d61457f_amadey_coinminer_elex_remcos_smoke-loader.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
C:\Windows\Syswow64\fd54a288C:\Windows\Syswow64\fd54a2881⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\fd54a288
- Size 576KB
- SHA256 8e088b54ab1f0e88bbb8e5ec80e2fad66962515893cf6cbc3243829ac9c60d33
- MD5 5fd46a2b1aa93d17d5476225d49432b7
- SHA1 47d7c6967f50e559aba9884efb93d0cf6c165548
- SHA512 cf9c171f1d298a8c8d19d82894c670cc30da6d873a4e36aa3046ea2ccd7fa232e6b031af10de230f74f7d7a52cefabf9aeb137674a025c356626aece53c63cc7
- SSDEEP 12288:0qXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3K:0jHPOSOkx2LFscUQPK
- TLSH T1EEC47C31E201C03AD1A74572C6FE0BAFA568BD24431562C7A3D479762FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH