73ed5aed72450d8dcb03e8c91f79741a03eedf6e0d543472846dbba203846b46

General

Target
2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Size 448KB
Sample260803-m7b7csvglc
SHA256 73ed5aed72450d8dcb03e8c91f79741a03eedf6e0d543472846dbba203846b46
MD5 c479e9313f9e9766fe7a60100dc4dfde
SHA1 1e8a241f50fe6f694a387ba79e999bae4bb1b1cc
SHA512 32217fc42b9b26f348c1be1b872395d9ea348e0b7a4d569fe22f0e7523cdf0cd4f048b3101544460d5ad55916536eeb9758314adac17c7b82bee3695416e25ff
SSDEEP 6144:CcTgav1cdCTuoPbgwmOLJvKRILSFvdFbcEOkCybEaQRXr9HNdvOaty8KRpPUM:CSvO2x9mONvKRILSF/Okx2LIatyD
TLSH
T1C5A45C26B7909076C4B78674C8A247AAFBB1BC2127118B8FA39077191F73792BD3570D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4796	e270b1f8

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	4	223.5.5.5	5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	37	114.114.114.114	5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	39	223.5.5.5	5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\e270b1f8	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	e270b1f8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1	e270b1f8

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\521bf8	e270b1f8
File opened for modification	C:\Windows\56f8b0	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e270b1f8

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	e270b1f8
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	e270b1f8
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	e270b1f8
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	e270b1f8
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	e270b1f8
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	e270b1f8
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	e270b1f8
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	e270b1f8
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	e270b1f8

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA	e270b1f8
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037	e270b1f8

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
4796	e270b1f8
5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	5080	2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4796	e270b1f8
Token: SeTcbPrivilege	4796	e270b1f8

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c479e9313f9e9766fe7a60100dc4dfde_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\Syswow64\e270b1f8
C:\Windows\Syswow64\e270b1f8
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e270b1f8

Path C:\Windows\SysWOW64\e270b1f8
Size 448KB
SHA256 5bf07fd1c1b08b230d773915b897634785d3961aceed0ad53c5bfc382b094827
MD5 a3fb9dbd7f276da533a9b08fabdf5696
SHA1 8a2293e0f9e519229ccf6bd3a462f7594e889875
SHA512 9f1f963745e86e01c8c4cc17a2bd1efc169b79eefa782cebdf3683cacd28a5875f469530e9cb051f049487543257fb9facc40f82083e36537d2e4f75feeb51f4
SSDEEP 6144:icTgav1cdCTuoPbgwmOLJvKRILSFvdFbcEOkCybEaQRXr9HNdvOaty8KRpPUM:iSvO2x9mONvKRILSF/Okx2LIatyD
TLSH
T11CA45C26B7909076C4B78674C8A247AAFBB1BC2127118B8FA39077191F73792BD3570D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4796-4-0x00000000004F0000-0x0000000000553000-memory.dmp

Download

memory/5080-0-0x0000000000340000-0x00000000003A3000-memory.dmp