Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 04:20
Behavioral task
behavioral1
Sample
2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 525KB
- Sample260802-eygrgsvbmb
- SHA256 b25546fbc7973f5dbccc4aefcc509ecd8417520c5b1490a17fb4b2428597521e
- MD5 23fad4957f5fa239f367a577cc951dbb
- SHA1 9f90db23dc5f3644e6ffa532797841997536e820
- SHA512 8d8f9643cd9fbdf536b49d133e7c996d9f81e979ed942e70dbfd7c7b450c5f636fa942286bf1292b8172362c4dc1af58a66407d9d1c2726cb90f3fd0cf8a31bf
- SSDEEP 6144:+cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:+SvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T19DB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/4600-0-0x00000000003E0000-0x000000000046C000-memory.dmp UPX behavioral2/files/0x000b00000001b896-2.dat UPX behavioral2/memory/5000-3-0x0000000000570000-0x00000000005FC000-memory.dmp UPX behavioral2/memory/4600-15-0x00000000003E0000-0x000000000046C000-memory.dmp UPX behavioral2/memory/5000-16-0x0000000000570000-0x00000000005FC000-memory.dmp UPX behavioral2/memory/5000-31-0x0000000000570000-0x00000000005FC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 5000 89103ed3 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 5 223.5.5.5 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 20 114.114.114.114 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 21 223.5.5.5 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 89103ed3 File created C:\Windows\SysWOW64\89103ed3 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 89103ed3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 89103ed3 -
resource yara_rule behavioral2/memory/4600-0-0x00000000003E0000-0x000000000046C000-memory.dmp upx behavioral2/files/0x000b00000001b896-2.dat upx behavioral2/memory/5000-3-0x0000000000570000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4600-15-0x00000000003E0000-0x000000000046C000-memory.dmp upx behavioral2/memory/5000-16-0x0000000000570000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5000-31-0x0000000000570000-0x00000000005FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\559a10 89103ed3 File opened for modification C:\Windows\4ec0f0 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89103ed3 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 89103ed3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 89103ed3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 89103ed3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 89103ed3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 89103ed3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 89103ed3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 89103ed3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 89103ed3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 89103ed3 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5000 89103ed3 5000 89103ed3 5000 89103ed3 5000 89103ed3 5000 89103ed3 5000 89103ed3 5000 89103ed3 5000 89103ed3 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 4600 2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 5000 89103ed3 Token: SeTcbPrivilege 5000 89103ed3
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_23fad4957f5fa239f367a577cc951dbb_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
C:\Windows\Syswow64\89103ed3C:\Windows\Syswow64\89103ed31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\89103ed3
- Size 525KB
- SHA256 97f429002ff0bbbf4d1d096677eff6fa812bca552ce5a30ef02b13faffc8c33c
- MD5 09bd029c6274bffe5865d0ceb95a7d65
- SHA1 407a3910fac059a0c879b011c2d421b8af828565
- SHA512 9d6161f83b236b6c77fb0334f891437c912c2fdb7aaef6157ca6a3d0fbe5f8f50cf2a3672cf1013f96c8c5ab981fc56d1aa00ec4dfdba35f3968ad2435116b74
- SSDEEP 6144:DcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:DSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T1F4B47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH