2ebe6876cf79478692ee4262888916af917b8d5fc573c85a033d62905e57844f

General

Target
2026-08-07_cb3ec0f7dd0f5cda54fdd4335ed655c5_amadey_coinminer_elex_smoke-loader.exe
Size 1.8MB
Sample260807-srmwtayapa
SHA256 2ebe6876cf79478692ee4262888916af917b8d5fc573c85a033d62905e57844f
MD5 cb3ec0f7dd0f5cda54fdd4335ed655c5
SHA1 bf87d1559f6f0aff483bc544c089ebeef2baf104
SHA512 9359c7241136c31c0671eb4b41008a7bc5c3f294ab46e6e4bedaac428779c4cea598ee11a5c885b5334c70c83e5de8bc6a60b3c9fb919517f0d4d5f5f8002c03
SSDEEP 24576:O7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOH31YA+wFD5BOkUhMXcBwcT:l6F0eMpAAYEhpw3+hwVTUasqcV5
TLSH
T1C2958EE1EF42B0B1E99308F1740BE7BEA9336E2944218C67E7C7FF157972952257A102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3416	original_temp.exe
820	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
820	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_cb3ec0f7dd0f5cda54fdd4335ed655c5_amadey_coinminer_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5876 wrote to memory of 3416	5876	2026-08-07_cb3ec0f7dd0f5cda54fdd4335ed655c5_amadey_coinminer_elex_smoke-loader.exe	89
PID 3416 wrote to memory of 820	3416	original_temp.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-07_cb3ec0f7dd0f5cda54fdd4335ed655c5_amadey_coinminer_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_cb3ec0f7dd0f5cda54fdd4335ed655c5_amadey_coinminer_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.unelevated BurnPipe.{049FB407-8B2A-42F2-A77D-B0581A20AAA6} {5C5135F3-09E8-48D8-A27F-A7B939E763E9} 3416
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
Size 1.8MB
SHA256 f41a855e6f1107ecf8e7244fbb3609d9d2a5bcf8060278dc1c1380338febde9e
MD5 965e34af7e39623cc1701774cd37a86b
SHA1 646602fe276f28867020b1721389a7a4af009911
SHA512 5ba6f6ea1166d51d2eee0b1709a97b44024cb87f9379e72f823479233bd89d3aadc7c329dcf7cc0f0db350a20c9d5321c104274740b1cec2b7023024f01ad39c
SSDEEP 24576:O7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOH31YA+wFD7BOkUhMXcBwcc:l6F0eMpAAYEhpw3+hwVVUasqcc
TLSH
T14F958EE1EF82B0B1E99308F1740BE7BEA9336D2944218C67E7C7FF157972952257A102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 455KB
SHA256 102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
MD5 3284088a2d414d65e865004fdb641936
SHA1 7f3e9180d9025fc14c8a7868b763b0c3e7a900b4
SHA512 6786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62
SSDEEP 6144:9qIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi/6xLdowQguVC+:9qIOkU8AMXE9B7PElZlP41v6ro4n+
TLSH
T13BA45D31A6A04037D6F106B3F914D6307E7DA2187B1184ABD394AE2D7AB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 caa1b2bb2fbd4210e7258878b4e9f263619263d344f8b12277934861c7db714c
MD5 580820e36da6878bdffa8124e1d0b8db
SHA1 01ec4fb2415f6a3717da80bf823d84e3c9895e8d
SHA512 158500c500bad580afd68ab6f90dd817e11128f59d5e14d636d8ad576b59559a6fab5eb2d23b4360100539e31c1aabed1baabf9465a396b43ff43bf804ce7c1c
SSDEEP 24576:O7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOH31YA+wFD:l6F0eMpAAYEhpw3+hwV
TLSH
T1AA655CD5EF83B4F5E85308F1350BE7BEA523AD2580228D67FAC7FF11B6729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 342cc1979bd8f00f8c78a687e879b8e564abdf1ca89cf8edf31bf90bd69301c1
MD5 1657a79855264f423e87d4107d604df9
SHA1 13f0df429a55f499448a50c5126839be21ef9a76
SHA512 95f5f13e1a03bb32764da990e71b0e682c3057cacfa4093da0186bba56bbcf3fb2cb7d2335b477783232e59257fd549e8d126653eb228f34d80e3d82248c2618
SSDEEP 24576:G7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOJ31YA+wHf:96F0eMpAAYEhpu3+hw/
TLSH
T174655CD5EF83B4F5E85308F1350BE7BEA523AD2580228D67FAC7FF11B6729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 4afa980e026249c0dcd9d0cab1ff4f3f3e71265cafcf4a065a072464f00bf4a0
MD5 b19d374feace5565c6c14f441a3e9e32
SHA1 2bc433c2b10e23d64ec16626372fd28cd26fa747
SHA512 04f022c3c5d7a642d1e028973b152bb330b387a3196f3378d3d6af47a35d5dc17f983fae25b6884ffc0dc9e7fee51e1bc3d5f91ea3d0f88cc3f5777057e19eed
SSDEEP 24576:27VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOn31YA+w86:N6F0eMpAAYEhpQ3+hwb
TLSH
T169655BD5EF83B4F5E85308F1350BE7BEA523AD2580228D67FAC7FF11B6729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5876-174-0x0000000000400000-0x000000000056F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads