04342bed5ad7f82915261ca427076a1a0247a4d8016015071bccc0be2aebbda1

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_c18ef6875748c3787789bc6050cd4aec_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Size 519KB
Sample260808-xebegafa84
SHA256 04342bed5ad7f82915261ca427076a1a0247a4d8016015071bccc0be2aebbda1
MD5 c18ef6875748c3787789bc6050cd4aec
SHA1 98ba6497e51e85ff14670600bc6d9cc80e2573e2
SHA512 13285966fd0be75996f0f8e09582c3245b71e554a5a8ddca2d8f2d0051526d274d43534eae82d77e9e9990b58c422fa7ea16c3a1c3dafc31915cc8c69c4a76f9
SSDEEP 6144:kUkCH1caWozbshiLlbyBktLKRbpFcirKcEOkCybEaQRXr9HNdvOa:k2HOaNAixbyBoLKRRQOkx2LIa
TLSH
T116B47D2AF7A0D036C4B79574C4A246A6FBB1B82177204ACFA790475A1F637D2BE3530D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/3040-0-0x0000000000FF0000-0x000000000107A000-memory.dmp	UPX
behavioral1/memory/3040-1-0x0000000000FF0000-0x000000000107A000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3040-0-0x0000000000FF0000-0x000000000107A000-memory.dmp	upx
behavioral1/memory/3040-1-0x0000000000FF0000-0x000000000107A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3324	3040	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_c18ef6875748c3787789bc6050cd4aec_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_c18ef6875748c3787789bc6050cd4aec_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c18ef6875748c3787789bc6050cd4aec_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 416
  2⤵
  - Program crash
  PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3040 -ip 3040
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x0000000000FF0000-0x000000000107A000-memory.dmp

Download

memory/3040-1-0x0000000000FF0000-0x000000000107A000-memory.dmp