Analysis
- max time kernel
149s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 16:28
General
- Target 2026-08-03_f3ca752ac5bedddf57dbf89667d78da6_amadey_coinminer_elex_emotet_icedid_remcos_smoke-loader.exe
- Size 7.1MB
- Sample260803-tythlscb76
- SHA256 e40e831a2ab45eafd01379bcb93f97e885b9f7a562025be7671b8f92582d3e13
Malware Config
Signatures
- UPX dump on OEP (original entry point) 30 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 3 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_f3ca752ac5bedddf57dbf89667d78da6_amadey_coinminer_elex_emotet_icedid_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f3ca752ac5bedddf57dbf89667d78da6_amadey_coinminer_elex_emotet_icedid_remcos_smoke-loader.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Mn.ms
MzcMs.dll
memory/6080-27-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-29-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-16-0x0000000004212000-0x0000000004213000-memory.dmp
memory/6080-15-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-17-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-18-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-19-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-20-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-21-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-22-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-23-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-24-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-25-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-26-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-14-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-8-0x000000006FFF0000-0x0000000070000000-memory.dmp
memory/6080-31-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-30-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-28-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-32-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-33-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-34-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-35-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-36-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-37-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-38-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-39-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-40-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-41-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-42-0x0000000003C00000-0x0000000004214000-memory.dmp
memory/6080-43-0x0000000003C00000-0x0000000004214000-memory.dmp