Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 10:19
Behavioral task
behavioral1
Sample
2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 640KB
- Sample260804-mclgjsxfke
- SHA256 723a5f7816c446a8d6dc025651970921ea13c454ff46812aeec33b547fdbd814
- MD5 aa4a47b2208c0b642eacdce971a6ea49
- SHA1 f9dac2ead0be15f0cfa83260cf21465d5a602aee
- SHA512 c26c24e57fc08e8c1b94661a18ed50c4e18a1a69af7dd6c640d69cbd8ddbd001f2895212d959dd0e64d679c431dbc6603046219c7d554da16528f43835265822
- SSDEEP 6144:t/cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:NSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T13BD45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/4864-0-0x0000000000B70000-0x0000000000BFC000-memory.dmp UPX behavioral2/files/0x000e00000001b847-2.dat UPX behavioral2/memory/5076-3-0x00000000008D0000-0x000000000095C000-memory.dmp UPX behavioral2/memory/4864-10-0x0000000000B70000-0x0000000000BFC000-memory.dmp UPX behavioral2/memory/5076-11-0x00000000008D0000-0x000000000095C000-memory.dmp UPX behavioral2/memory/5076-36-0x00000000008D0000-0x000000000095C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 5076 744d16dc - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 223.5.5.5 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 10 114.114.114.114 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 11 223.5.5.5 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 63 114.114.114.114 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 64 223.5.5.5 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 1 114.114.114.114 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 744d16dc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 744d16dc File created C:\Windows\SysWOW64\744d16dc 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe -
resource yara_rule behavioral2/memory/4864-0-0x0000000000B70000-0x0000000000BFC000-memory.dmp upx behavioral2/files/0x000e00000001b847-2.dat upx behavioral2/memory/5076-3-0x00000000008D0000-0x000000000095C000-memory.dmp upx behavioral2/memory/4864-10-0x0000000000B70000-0x0000000000BFC000-memory.dmp upx behavioral2/memory/5076-11-0x00000000008D0000-0x000000000095C000-memory.dmp upx behavioral2/memory/5076-36-0x00000000008D0000-0x000000000095C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\56e728 744d16dc File opened for modification C:\Windows\534600 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 744d16dc - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 744d16dc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 744d16dc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 744d16dc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 744d16dc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 744d16dc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 744d16dc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 744d16dc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 744d16dc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 744d16dc - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5076 744d16dc 5076 744d16dc 5076 744d16dc 5076 744d16dc 5076 744d16dc 5076 744d16dc 5076 744d16dc 5076 744d16dc 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 4864 2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 5076 744d16dc Token: SeTcbPrivilege 5076 744d16dc
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_aa4a47b2208c0b642eacdce971a6ea49_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
C:\Windows\Syswow64\744d16dcC:\Windows\Syswow64\744d16dc1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\744d16dc
- Size 640KB
- SHA256 522ffd36defd086b5760089eb67d28f0caed317a3f842a396108f1e8ba036e5c
- MD5 266eaaa64758de5a12f0a59e5eaca636
- SHA1 7ade0a30b418edde0efbf4f316408eb49d94b925
- SHA512 a152f6a4ebe6ccf568c691f73945ebbaca71ae33fbe3c6d4735c3bcb201e1f2a5e4857f651051e6e6842154f60f67228398a066171ff8fb675360b08a852b2cb
- SSDEEP 6144:scTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:sSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T16DD45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH