Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 04:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 615KB
- Sample260804-fmrmzsdc69
- SHA256 a9de2e52c772e2e33ab0d1c4b1823359c5784a5f1e1a5f167e1d8c254691fb1a
- MD5 ec46fe9ef44d0ac45488202a8a4f6ca9
- SHA1 59af766ca9e7f8657a76b5f2c65b4f4f5c1d425d
- SHA512 48c9fcc9afba69c99554a013871322eb0104ac29523c5af1db708b86d978ee8fde5de8b5065b6148b67b430298db7435876d79b4e4796a1badfc1b30a0a75dbf
- SSDEEP 12288:wSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:rvO2xJKRI2FOkx2LFicUV
- TLSH T146D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2892 cddb18d0 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 114.114.114.114 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 6 223.5.5.5 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 51 114.114.114.114 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 52 223.5.5.5 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 cddb18d0 File created C:\Windows\SysWOW64\cddb18d0 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cddb18d0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cddb18d0 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\318318 cddb18d0 File opened for modification C:\Windows\517e30 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cddb18d0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cddb18d0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cddb18d0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cddb18d0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cddb18d0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cddb18d0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cddb18d0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cddb18d0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cddb18d0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cddb18d0 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 2892 cddb18d0 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 4760 2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 2892 cddb18d0 Token: SeTcbPrivilege 2892 cddb18d0
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_ec46fe9ef44d0ac45488202a8a4f6ca9_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
C:\Windows\Syswow64\cddb18d0C:\Windows\Syswow64\cddb18d01⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\cddb18d0
- Size 615KB
- SHA256 d425360b16e47cc3972f42e332fd7afecbf333e52767325971d82392abdea04c
- MD5 85c67dbc872cf65095e60375aaab4d9d
- SHA1 781b6c50c48840ff70ff67998527b3077fd1bce8
- SHA512 90736f086e421c645b48226ce9d407642520946f4b36793a1b7dacc30b0bcae14c3a4af872c3cbaec48f81e42f4004cb1a4dfbb9bfb0b42675ad55b80f488fff
- SSDEEP 12288:DSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:2vO2xJKRI2FOkx2LFicUV
- TLSH T17CD44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH