684f4987dd08c3bf030274380d1ab961446b09dd5aa3ef648cf88a36fb51ac1a

General

Target
2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Size 871KB
Sample260804-drfeeavscv
SHA256 684f4987dd08c3bf030274380d1ab961446b09dd5aa3ef648cf88a36fb51ac1a
MD5 20df47914b7c3c3a8fdd8ca1187e22f4
SHA1 7826652e823651006179f68866c24d740c70b6ad
SHA512 25d6d97c6a5034d3143e247f7593d04909f099fef064ece5c8606ffa33e617dfc9ce7adb492194919753d6325c74540802df6fd0a2468d9a0ad411e4b82ab127
SSDEEP 12288:gSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:7vO2xJKRI2FOkx2LFEvcU6UQOJdT
TLSH
T1B6156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000243b3-2.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000243b3-2.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
4252	f44a14fc

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Destination IP	6	223.5.5.5	1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Destination IP	40	114.114.114.114	1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Destination IP	43	223.5.5.5	1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\f44a14fc	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	f44a14fc
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	f44a14fc

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\48cbb8	f44a14fc
File opened for modification	C:\Windows\1cd4a8	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f44a14fc

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	f44a14fc
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	f44a14fc
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	f44a14fc
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	f44a14fc
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	f44a14fc
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	f44a14fc
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	f44a14fc
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	f44a14fc
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	f44a14fc

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
4252	f44a14fc
1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Token: SeTcbPrivilege	1684	2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
Token: SeDebugPrivilege	4252	f44a14fc
Token: SeTcbPrivilege	4252	f44a14fc

C:\Users\Admin\AppData\Local\Temp\2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_20df47914b7c3c3a8fdd8ca1187e22f4_amadey_coinminer_cryptolocker_elex_graphican_mafia_rhada.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\Syswow64\f44a14fc
C:\Windows\Syswow64\f44a14fc
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f44a14fc

Path C:\Windows\SysWOW64\f44a14fc
Size 871KB
SHA256 b1805129e1eb0d7a206417d85758f432549e88d5d62260a1434905084f8f3d26
MD5 62c6f8899f7aadd3d465039655e4230f
SHA1 87b65de12be839291d7f8eefef87afaf3da81674
SHA512 a57edd6fa225e154758f82c1672ed3c8443491503f802373558a2b4a8e14ab5e43d7dc16312177831fecd76b7394806d47ba2c9bf86aa28597376869bdfc4ffe
SSDEEP 12288:xSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:YvO2xJKRI2FOkx2LFEvcU6UQOJdT
TLSH
T167156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1684-0-0x0000000000460000-0x00000000004C3000-memory.dmp

Download

memory/4252-4-0x0000000000290000-0x00000000002F3000-memory.dmp