5f764ab4089a68cdd7b7551f9e61d7a794e1b4295f4f009d2bc61b1e4dd70835

General

Target
2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Size 960KB
Sample260808-xjd16acl4y
SHA256 5f764ab4089a68cdd7b7551f9e61d7a794e1b4295f4f009d2bc61b1e4dd70835
MD5 7d2609deeb2d02dd001e09a042d84a2d
SHA1 c05a475282fbf8a0b770d238c5a99adc7d54ebfe
SHA512 d9d54d6461b6aeb3c11be82fa2c69c5844eebb9864d2dae49d8938b0a475e5856d46ccedddd1e6952f9010ea4dc7e50603047cc631985e9f03e7d3aee015673f
SSDEEP 24576:NvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OQ:NHHKO29QG5QZuT2
TLSH
T1AD257C31E641C03AD4A741B686BA4BBFA4787D25031565C7E3D43E6A2FB22D27E3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
868	b5b080f3

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Destination IP	4	223.5.5.5	4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Destination IP	43	114.114.114.114	4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Destination IP	44	223.5.5.5	4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	b5b080f3
File created	C:\Windows\SysWOW64\b5b080f3	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	b5b080f3
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	b5b080f3

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\edc48	b5b080f3
File opened for modification	C:\Windows\525090	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5b080f3

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	b5b080f3
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	b5b080f3
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	b5b080f3
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	b5b080f3
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	b5b080f3
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	b5b080f3
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	b5b080f3
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	b5b080f3
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	b5b080f3

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
868	b5b080f3
868	b5b080f3
868	b5b080f3
868	b5b080f3
868	b5b080f3
868	b5b080f3
868	b5b080f3
868	b5b080f3
868	b5b080f3
868	b5b080f3
868	b5b080f3
868	b5b080f3
4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	4808	2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	868	b5b080f3
Token: SeTcbPrivilege	868	b5b080f3

C:\Users\Admin\AppData\Local\Temp\2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_7d2609deeb2d02dd001e09a042d84a2d_amadey_coinminer_elex_glassworm_graphican_remcos_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\Syswow64\b5b080f3
C:\Windows\Syswow64\b5b080f3
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b5b080f3

Path C:\Windows\SysWOW64\b5b080f3
Size 960KB
SHA256 efbb6955912fdaf10e6222dd944d987513438c2b7d010bb1e3e6e59f2f668682
MD5 8887047ddf307c0efefe1f834e4038a1
SHA1 8191a0442483620bbd85562ac1680444a01493cf
SHA512 6b64cf95cc5c82da09f8dd9732f4209ec7574863720cc176931c843728767f821ef0ed6e13db095dd3833839408e53a858c60dee4f29130db5e52d70def00b53
SSDEEP 24576:avO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OQ:aHHKO29QG5QZuT2
TLSH
T102257C31E641C03AD4A741B686BA4BBFA4787D25031565C7E3D43E6A2FB22D27E3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/868-4-0x0000000000580000-0x00000000005E3000-memory.dmp

Download

memory/4808-0-0x00000000006D0000-0x0000000000733000-memory.dmp