Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 06:01
Behavioral task
behavioral1
Sample
2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 525KB
- Sample260804-gra2gagr21
- SHA256 0fd4fbdad410c4ba976d472b7a1dc51e4b4e5932d05d93bd74aeec0eb00a59cb
- MD5 a40a21fbb5d3d45da66a8bf73f197f48
- SHA1 7a791af75080c043f27838405e5270e3db14174a
- SHA512 2be007d1954c457b1e3c14f67ac4f3c2578762216f9629c7f011d0affdef211591fc8ceb474cf1d0ea6e3cb15e34c84a3552b35523058495671548b98c79470d
- SSDEEP 6144:xcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:xSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T19AB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral1/memory/3040-0-0x0000000000120000-0x00000000001AC000-memory.dmp UPX behavioral1/files/0x000c0000000242ac-2.dat UPX behavioral1/memory/3820-3-0x0000000000E00000-0x0000000000E8C000-memory.dmp UPX behavioral1/memory/3040-12-0x0000000000120000-0x00000000001AC000-memory.dmp UPX behavioral1/memory/3820-13-0x0000000000E00000-0x0000000000E8C000-memory.dmp UPX behavioral1/memory/3820-29-0x0000000000E00000-0x0000000000E8C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3820 9c273b08 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 4 223.5.5.5 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 23 114.114.114.114 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 24 223.5.5.5 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9c273b08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9c273b08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9c273b08 File created C:\Windows\SysWOW64\9c273b08 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9c273b08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9c273b08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9c273b08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9c273b08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9c273b08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9c273b08 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9c273b08 -
resource yara_rule behavioral1/memory/3040-0-0x0000000000120000-0x00000000001AC000-memory.dmp upx behavioral1/files/0x000c0000000242ac-2.dat upx behavioral1/memory/3820-3-0x0000000000E00000-0x0000000000E8C000-memory.dmp upx behavioral1/memory/3040-12-0x0000000000120000-0x00000000001AC000-memory.dmp upx behavioral1/memory/3820-13-0x0000000000E00000-0x0000000000E8C000-memory.dmp upx behavioral1/memory/3820-29-0x0000000000E00000-0x0000000000E8C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\416658 9c273b08 File opened for modification C:\Windows\340bc0 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9c273b08 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9c273b08 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9c273b08 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9c273b08 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9c273b08 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9c273b08 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9c273b08 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9c273b08 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9c273b08 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9c273b08 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3820 9c273b08 3820 9c273b08 3820 9c273b08 3820 9c273b08 3820 9c273b08 3820 9c273b08 3820 9c273b08 3820 9c273b08 3820 9c273b08 3820 9c273b08 3820 9c273b08 3820 9c273b08 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 3040 2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3820 9c273b08 Token: SeTcbPrivilege 3820 9c273b08
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a40a21fbb5d3d45da66a8bf73f197f48_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
C:\Windows\Syswow64\9c273b08C:\Windows\Syswow64\9c273b081⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\416658
- Size 506B
- SHA256 f74170c47d4fd3634cd89ca47d064227c4720e822de9f021680c6107f48f7bde
- MD5 afa0bae383d53ed4555c9617bd597bdf
- SHA1 1d3ce77ca7389a7cbdb31fea6d249823b337615f
- SHA512 0868d700fca64925cd7d62a9cfade041cfd20bb05b6957ae975ae836fd937f40621b02c6e570fd7f51dc720054f133e518e7203ddf78c55635fc09cbe921934e
- TLSH T130F0053EDC3E22E5AEDA3F3145175C052417D23AC01E65091BF175740DE218F4D43054
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\9c273b08
- Size 525KB
- SHA256 3b178d5177443265279e01aa6997b30bd1dc96daa886a488c2a2553481df5da6
- MD5 e223e8a30b59cd81d67c60ead25d628c
- SHA1 5da64b62376d72053ad1dd0ced58fcbc9b150a66
- SHA512 f18c03d7ec097044e3df683f47ec468a747ae73a682e3e09ca89372b1e0dca73ec67a47c143354478930ba7f5e561d331dc317b15d750097350c751ff2dce948
- SSDEEP 6144:scTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:sSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T114B47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH