Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 04:24
Behavioral task
behavioral1
Sample
2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 560KB
- Sample260731-e1t5latfpb
- SHA256 a67d10048fb9d1b7f7902d5764b83b036260bb8f839bd776285b6f7c2684dd98
- MD5 3d16d3b82ee28feffc1432540fcf6497
- SHA1 4b5661b48ef123a975471911679cb72405fb1f2c
- SHA512 890a987ce5856eb39082328221a370db60a8771fe383019cc0166bd5e8b48dddcddba29ae9e7028f77e6f8df926239451608df63a02aa54966e151c92443c830
- SSDEEP 6144:jWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRXr9HNdvOa+y8K:jkCO2zVPX7vf1LKlIsOkx2LIa+y
- TLSH T13AC47C2AF6A0C036C4779574C4A257AAFFB1B42127204ACFA390475A1F637E2BE7531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral1/memory/4624-0-0x0000000000250000-0x00000000002DC000-memory.dmp UPX behavioral1/files/0x000c0000000242ac-2.dat UPX behavioral1/memory/4160-3-0x0000000000A00000-0x0000000000A8C000-memory.dmp UPX behavioral1/memory/4624-12-0x0000000000250000-0x00000000002DC000-memory.dmp UPX behavioral1/memory/4160-13-0x0000000000A00000-0x0000000000A8C000-memory.dmp UPX behavioral1/memory/4160-32-0x0000000000A00000-0x0000000000A8C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 4160 a87d98e8 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 12 223.5.5.5 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 34 114.114.114.114 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 35 223.5.5.5 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\a87d98e8 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 a87d98e8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C a87d98e8 -
resource yara_rule behavioral1/memory/4624-0-0x0000000000250000-0x00000000002DC000-memory.dmp upx behavioral1/files/0x000c0000000242ac-2.dat upx behavioral1/memory/4160-3-0x0000000000A00000-0x0000000000A8C000-memory.dmp upx behavioral1/memory/4624-12-0x0000000000250000-0x00000000002DC000-memory.dmp upx behavioral1/memory/4160-13-0x0000000000A00000-0x0000000000A8C000-memory.dmp upx behavioral1/memory/4160-32-0x0000000000A00000-0x0000000000A8C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\473880 a87d98e8 File opened for modification C:\Windows\4f2a20 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a87d98e8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a87d98e8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a87d98e8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a87d98e8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a87d98e8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a87d98e8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a87d98e8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a87d98e8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a87d98e8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a87d98e8 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA a87d98e8 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 a87d98e8 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4160 a87d98e8 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 4624 2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 4160 a87d98e8 Token: SeTcbPrivilege 4160 a87d98e8
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_3d16d3b82ee28feffc1432540fcf6497_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
C:\Windows\Syswow64\a87d98e8C:\Windows\Syswow64\a87d98e81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\473880
- Size 506B
- SHA256 af1b587241a8da449b218cb8015a159fd7fef5f8dad314134d5f077ce0a0f0be
- MD5 0e0c98ee132438d6a9330b3493b56034
- SHA1 b418d291d5744f707d21f857dc01405392f54762
- SHA512 a27d259d0212359e5c19357449a8be2e05d828495e72c757f61d4c9c937ce50ab77432031704e9526b76c83017306215e37d55e92cbc4fdce1e942fac1cb5b73
- TLSH T194F0C97A982932E22D8F3E210FAB385860A59129800A313D2982796942C2E869E8344A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\a87d98e8
- Size 560KB
- SHA256 3cf40ad5cf6f7b8feff8a8d81eb30609ee38e860b8e314ff0657f96c5c78fb26
- MD5 1915bcb24d7e96f0e303e6b69f92ad58
- SHA1 cc06bcd65c76f459587d24d2083531c695593ef4
- SHA512 ca341776fe7451206054d80bfbff83f524482f64a8b39b1d3190660669ddffd16a39d20a4d4a9b389bd7d4384fbb1da5d0fe2d0416cd98e290358320ad350a1f
- SSDEEP 6144:sWVrC1c2oonALgPLj7vf1LKlyIFVirGcEOkCybEaQRXr9HNdvOa+y8K:skCO2zVPX7vf1LKlIsOkx2LIa+y
- TLSH T105C47C2AF6A0C036C4779574C4A257AAFFB1B42127204ACFA390475A1F637E2BE7531D
- MD5 SHA1 SHA512 SSDEEP TLSH