Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe
- Size 395KB
- Sample260809-3patksxdnd
- SHA256 804ff59e3b70c8bb0977b7e3ca56a529ed74a6a4a7786a377b17c5f1f178c525
- MD5 f74cc452e16221e322a2c4454c523131
- SHA1 929c973e0ddbbbf5c83d9414115205e90c5291da
- SHA512 73f1e2129ef98357dfb04cb2afdf2196ed5b631d4f6110fd413de4f537a76ce83477b0fbfa4a9b5e811f3a1f233c95d4d900f393d507a334ecb0ba1d328a2fd8
- SSDEEP 6144:ag/AL1cVUoG1XRlL0wcJtL2KmEFEcEOkCybEaQRXr9HNdvOaty8K:anLOVWLlowcJtL2KyOkx2LIaty
- TLSH T111847C26F6A08036C5B79578C4A396A6FFB1742137248ACFA390475A1F237E2BD3531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5700 3e0007ff - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe Destination IP 4 223.5.5.5 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe Destination IP 25 114.114.114.114 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe Destination IP 26 223.5.5.5 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3e0007ff File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3e0007ff File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3e0007ff File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3e0007ff File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3e0007ff File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 3e0007ff File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 3e0007ff File created C:\Windows\SysWOW64\3e0007ff 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3e0007ff File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3e0007ff File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3e0007ff - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\619608 3e0007ff File opened for modification C:\Windows\63a3f8 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3e0007ff - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3e0007ff Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3e0007ff Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3e0007ff Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3e0007ff Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3e0007ff Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3e0007ff Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3e0007ff Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3e0007ff Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3e0007ff - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5700 3e0007ff 5700 3e0007ff 5700 3e0007ff 5700 3e0007ff 5700 3e0007ff 5700 3e0007ff 5700 3e0007ff 5700 3e0007ff 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe Token: SeTcbPrivilege 5820 2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe Token: SeDebugPrivilege 5700 3e0007ff Token: SeTcbPrivilege 5700 3e0007ff
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_f74cc452e16221e322a2c4454c523131_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5820
-
C:\Windows\Syswow64\3e0007ffC:\Windows\Syswow64\3e0007ff1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\3e0007ff
- Size 395KB
- SHA256 3e9063492a86bc755838042f9156da423203ee11459b1d6690e5bcf33572bc27
- MD5 3da9cca587ec8eea43cbac1059e3d091
- SHA1 aad2a6d3c149c108abfe0cd011dff2c07f7c10e6
- SHA512 579331a13ea99bf7b1508054c8bcfe27e5bbccac25f81c6067d88bc68217a7b30ba3186e46581e135471b62f90710c87dcd9d98510aadb0904adfb0640ecdf85
- SSDEEP 6144:Vg/AL1cVUoG1XRlL0wcJtL2KmEFEcEOkCybEaQRXr9HNdvOaty8K:VnLOVWLlowcJtL2KyOkx2LIaty
- TLSH T17B847C26F6A08036C5B79578C4A396A6FFB1742137248ACFA390475A1F237E2BD3531D
- MD5 SHA1 SHA512 SSDEEP TLSH