Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 22:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
- Size 704KB
- Sample260806-2xpr2asdpg
- SHA256 5ec4a06f39b8c721b19da6d3455f008ab56b0db037dd4b8596c410038bd26cbe
- MD5 8066ec5ed26e6de73092d844adeb8e68
- SHA1 f83fcd4e23ed86eb5d813e829cc8ac147d4fbf4a
- SHA512 34b2baf6287116b5ca80d02b05f5fd66f0c467cab164208bd695efc5779f3244b2088822ba7e5c81a0515c2fcafddc0b0c8aba51d50f7847e201d45f311378d4
- SSDEEP 12288:uSvO2x9mONvKRILSFnOkx2LIaxy6RJ05r:NvO2xJKRI2FOkx2LFEF
- TLSH T195E46C26B7908136C477463585AB47A6EBB5BD11AB228B8F6340731D0F73793AE31B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5400 374761fd - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 25 223.5.5.5 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 2 114.114.114.114 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 4 223.5.5.5 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 24 114.114.114.114 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 374761fd File created C:\Windows\SysWOW64\374761fd 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 374761fd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 374761fd - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5c7330 374761fd File opened for modification C:\Windows\380490 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 374761fd - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 374761fd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 374761fd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 374761fd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 374761fd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 374761fd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 374761fd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 374761fd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 374761fd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 374761fd - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5400 374761fd 5400 374761fd 5400 374761fd 5400 374761fd 5400 374761fd 5400 374761fd 5400 374761fd 5400 374761fd 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Token: SeTcbPrivilege 3272 2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 5400 374761fd Token: SeTcbPrivilege 5400 374761fd
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_8066ec5ed26e6de73092d844adeb8e68_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
C:\Windows\Syswow64\374761fdC:\Windows\Syswow64\374761fd1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\374761fd
- Size 704KB
- SHA256 7a9769d7b471d8db3c976220ec5d22799d55bf43241caf8068b00ca5eb8b627f
- MD5 d1b62e9401253ba85086546ee268fce4
- SHA1 b8561875625011023f965d514182f51547968ec8
- SHA512 ccf5446af58a730a8c2e0647e10000c4e1d11c3586a5ccfb1d530990d02790bd4b7ee9279b00d81c5ed316ef5a8ebfb9e3715f9341abb1acec503f4b1df54e5c
- SSDEEP 12288:aSvO2x9mONvKRILSFnOkx2LIaxy6RJ05r:BvO2xJKRI2FOkx2LFEF
- TLSH T17BE46C26B7908136C477463585AB47A6EBB5BD11AB228B8F6340731D0F73793AE31B1C
- MD5 SHA1 SHA512 SSDEEP TLSH