Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 03:29
Behavioral task
behavioral1
Sample
2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 640KB
- Sample260804-d2dzbscc74
- SHA256 7f4066ac5ea9affc19b96474cc0f0f45bfc8e08e65d03785c829782e30cb89a3
- MD5 0cd092cd71c1e15319562cdc09e16537
- SHA1 c3d571e174c8d62e0d41b99686f8a9f372cc845c
- SHA512 0a9bff747b2d00da720db0e38ece4a3ff017308b17ccf86674316bd6674ed72b788663437b95ef5e513790efb8ccbda6199f065662efd092d0af18650beaa0da
- SSDEEP 6144:FcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:FSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T127D45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral1/memory/5068-0-0x0000000000FF0000-0x000000000107C000-memory.dmp UPX behavioral1/memory/1124-4-0x0000000000060000-0x00000000000EC000-memory.dmp UPX behavioral1/files/0x000a0000000242fc-3.dat UPX behavioral1/memory/5068-17-0x0000000000FF0000-0x000000000107C000-memory.dmp UPX behavioral1/memory/1124-18-0x0000000000060000-0x00000000000EC000-memory.dmp UPX behavioral1/memory/1124-29-0x0000000000060000-0x00000000000EC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 1124 23ccc234 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 4 223.5.5.5 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 26 114.114.114.114 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 27 223.5.5.5 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\23ccc234 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 23ccc234 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 23ccc234 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 23ccc234 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 23ccc234 -
resource yara_rule behavioral1/memory/5068-0-0x0000000000FF0000-0x000000000107C000-memory.dmp upx behavioral1/memory/1124-4-0x0000000000060000-0x00000000000EC000-memory.dmp upx behavioral1/files/0x000a0000000242fc-3.dat upx behavioral1/memory/5068-17-0x0000000000FF0000-0x000000000107C000-memory.dmp upx behavioral1/memory/1124-18-0x0000000000060000-0x00000000000EC000-memory.dmp upx behavioral1/memory/1124-29-0x0000000000060000-0x00000000000EC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\133e48 23ccc234 File opened for modification C:\Windows\56c418 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23ccc234 - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 23ccc234 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 23ccc234 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 23ccc234 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 23ccc234 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 23ccc234 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 23ccc234 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 23ccc234 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 23ccc234 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 1124 23ccc234 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 5068 2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 1124 23ccc234 Token: SeTcbPrivilege 1124 23ccc234
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_0cd092cd71c1e15319562cdc09e16537_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
C:\Windows\Syswow64\23ccc234C:\Windows\Syswow64\23ccc2341⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\133e48
- Size 1KB
- SHA256 36628039f31b68ede42640739b3450f2ce669639baf3917380170f3217424f9b
- MD5 36eebbd9d06c6ff128690600460b8bb4
- SHA1 774aff0b9563f386f723a836b546c478cdece59f
- SHA512 442cda359d2731cfe88b0ccd2851d5dbe7e76dd7056aae236ca0d4829aeebd6c7427b3a4113e68ed70dedf9bef4b7174b3c90288bc5749b1489046e181b12b47
- TLSH T13121DF3EA03A28B82DFA553055967ABC060A332C853D9218F587FF520063F24BECA593
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\23ccc234
- Size 640KB
- SHA256 ece769087a40ab0cff8e529d886863d30bdaaebeb136c1fb68a45ad33612b3ef
- MD5 9400e12e914728bfdcad8067e01aed2f
- SHA1 7f238451d8bb9512b8cda7379ce40bc4e25373df
- SHA512 e3eb890560159cb09d3361c97668640e0a08f36b105616ad8f3d6cc55c3eb49b225cc82cd3734a9038f994998038d5973076bc4810f8b860a1237fd5d88050b3
- SSDEEP 6144:OcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:OSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T1E8D45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH