97821666f0c1bf4e179dc4fc0310845df739a6b97c0cf5e6481e0e0b5b73137f

General

Target
2026-08-06_faabb98326f5c38fb545de67ed670e54_amadey_coinminer_elex_smoke-loader.exe
Size 1.9MB
Sample260806-r2pygstbrf
SHA256 97821666f0c1bf4e179dc4fc0310845df739a6b97c0cf5e6481e0e0b5b73137f
MD5 faabb98326f5c38fb545de67ed670e54
SHA1 e24515d485923fb757d398a565b68b4aa888368e
SHA512 35d518247f4200b0c0fce41fb83919a655637b65390a2f8e6dc04e7b10fba1a1ad64acdf686bd8dd677c87a3ab6ac41e6d3fb0827b406ce1566bcf8bc44f29ec
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVnvZ1YA+wwd4BOkUhMXcBz:V6F0eMpAAYEhponh+hwEmUasqcn
TLSH
T1AF958EE0EF42B0F5E99308F1740BE7BEA9336E2944218C67E787FF157972952257A102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1848	original_temp.exe
4792	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
4792	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_faabb98326f5c38fb545de67ed670e54_amadey_coinminer_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 1848	5856	2026-08-06_faabb98326f5c38fb545de67ed670e54_amadey_coinminer_elex_smoke-loader.exe	90
PID 1848 wrote to memory of 4792	1848	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-06_faabb98326f5c38fb545de67ed670e54_amadey_coinminer_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_faabb98326f5c38fb545de67ed670e54_amadey_coinminer_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.unelevated BurnPipe.{0F252871-C92F-4537-8AD8-4B31E43016CB} {38E1BD7B-066B-4CFD-A4BF-9680D0D90814} 1848
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 1.9MB
SHA256 6ce327d2db5bc6e2880d399ec88502acfe496788f9920d574d93518989278897
MD5 66ea07171faebb4c0d3fdee390b8fc28
SHA1 ca43687f67e1d91f3e115b4d5ef50aa1a3675481
SHA512 4fa0c9391d9e84aaec3502a7b3ddb445065dd953062417608ada5945df0afd414ba9ec2becdfee2150f1b1b53777e4c40ff05a3b24da7eef91864d66e87e4f8d
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVnvZ1YA+wwdJBOkUhMXcB+:V6F0eMpAAYEhponh+hwEDUasqc6
TLSH
T156958EE0EF82B0F5E99308F1740BE7BEA9336D2944218C67E787FF157972952257A102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 455KB
SHA256 fd597b58a578cfa46e1818b3b4b795ca6d25225dc11ee86cd491f3d55d7b235d
MD5 0ce624d3a5a586c2bdda26b748da78d7
SHA1 b9ed0a86eae645ba19ed08327888a4474c95e34a
SHA512 e5bc577bd319eb3ac70c527acfb313fac817e63f5184e6581f6d813491ca0f1a0f80583c14c2b9f2b8fa1df5938c2ae3318a91bda41171c63cd1670c55a85b7f
SSDEEP 6144:UqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1OiD+WYtfAx/WfQC:UqIOkU8AMXE9B7PElZlP41T+dtUWfQbe
TLSH
T13AA46D31A6A05037D6F106B3F914D6307E7DA2187B1184ABD394AE2D3EA9497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 f5d52f642fe6fb095e616058c2f927d9eae4c96d9e1bf60be2c6bc501bea0b2e
MD5 a69c046747cc385c8261916c86e03474
SHA1 6b5682c3a3cb363133e5bf31e5e6fa31f2c28d4b
SHA512 c608f69d44598e28a77fd2c51ea2013406bc09e7588e4d1cfd86225ebac65dac9bec4ff9ae2dd82aaba2ec01bf2ea412a999963e34468707c33d29fdca0ff799
SSDEEP 24576:e7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVnvZ1YA+wwd:V6F0eMpAAYEhponh+hwE
TLSH
T1E1655CD5EF83B4F5E85308F1350BE7BEA5236D2980328D67FA87FF11B6729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 f8264a58f4c364cdcf5191f6292f0061085713d030664e7a0fa7cefa57d95ae3
MD5 2770496479313ccabc38cb4dc37ff94e
SHA1 5be346c8fe413ea1cc3b9707d5a48f1f1fb6eeaf
SHA512 47fdefece79ce5a05251082d113ac6528237ac9b134adc9b4dd5cf586439284a943624fc8c85df125eddd5d731131f48c44514e93767a8d7f824c18963a624ab
SSDEEP 24576:x7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEnvZ1YA+wip:i6F0eMpAAYEhpJnh+hwm
TLSH
T106655CD5EF83B4F5E85308F1350BE7BEA523AD2980328D67FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 4c033b2878b47628ead2a074e189a8d01f227288e2a480544ee015871056a187
MD5 e3a7afd417c3845914c197c57f8dda29
SHA1 753501e3749c9d6ae4b3ea6aed09cc034636790f
SHA512 a1da0fe2e5b783154d12d92fc5adeb6152413abc419739c17535f9569b75aec14c2647a178a33707fb0eb8195ce1ee7e8d78b146dcb9c4f87c7b17db9020df79
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6nvZ1YA+w8G:26F0eMpAAYEhpjnh+hwL
TLSH
T179655CD5EF83B4F5E85308F1350BE7BEA5236D2980328D67FA87FF11B6729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5856-174-0x0000000000400000-0x000000000057F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads