5ae02396d0cea5f46ccdf03cba7d774391526810c8b9a43acce686a50326191a

Analysis

max time kernel
166s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe
Size 29.4MB
Sample260808-vh45vaee38
SHA256 5ae02396d0cea5f46ccdf03cba7d774391526810c8b9a43acce686a50326191a
MD5 ff5f6687d72fcfd248872038649a80f3
SHA1 acf3ec4a57a34485eb7ade45b5034b1c38e007f0
SHA512 a88314f8cf0a810d0ec97bb5785130550e3bb3cba57118800d4536e9524f9fc51adf7eb4a171ccc1a9b502f9c8a18cdbbba6b3b13b6ef28800f40bd169585c62
SSDEEP 786432:21qd8TBc++AtEGmgXEDq4G67OEVAIOoYdkvQgS:Ldn++AtzmgQqPqOEWIOoQoy
TLSH
T1306733137BE0D172D3A9847126D197BE627AAEC746308483E74DBB5E8664E807F33B05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF56FF80-3803-422B-80A0-9844629C810C}	2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF56FF80-3803-422B-80A0-9844629C810C}\IMPLEMENTED CATEGORIES	2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF56FF80-3803-422B-80A0-9844629C810C}\IMPLEMENTED CATEGORIES\{C376DC05-16CC-4498-8BF3-1F0D8FF4013A}\uuid = "25ae54db805cd32fbd2f96fa96bc507a"	2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF56FF80-3803-422B-80A0-9844629C810C}\IMPLEMENTED CATEGORIES\{C376DC05-16CC-4498-8BF3-1F0D8FF4013A}	2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ff5f6687d72fcfd248872038649a80f3_coinminer_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3332-83-0x0000000002810000-0x0000000002811000-memory.dmp

Download

memory/3332-95-0x0000000002810000-0x0000000002811000-memory.dmp