Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 00:45
Behavioral task
behavioral1
Sample
2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 640KB
- Sample260809-a34dtsfn4x
- SHA256 faa393c86159f8cd360d642fcc134b0154cb010a4c6077c4def407af1d453ad2
- MD5 563047ab683e757cd6e6d379552a9c95
- SHA1 cc252d37cf3271d5ffc6baf74448373294b3625f
- SHA512 e6adc3636f5468d0ef969196196d4e284eed9aaeca60caecc0826585f109045eac49725656ba3b21508f99bc6172e8fe11d65e4f0584aed36f12dde66409cdd5
- SSDEEP 6144:3cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:3SvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T1F3D45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral1/memory/1748-0-0x00000000006E0000-0x000000000076C000-memory.dmp UPX behavioral1/files/0x00100000000231f3-2.dat UPX behavioral1/memory/4472-4-0x0000000000A40000-0x0000000000ACC000-memory.dmp UPX behavioral1/memory/1748-15-0x00000000006E0000-0x000000000076C000-memory.dmp UPX behavioral1/memory/4472-16-0x0000000000A40000-0x0000000000ACC000-memory.dmp UPX behavioral1/memory/4472-35-0x0000000000A40000-0x0000000000ACC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 4472 cf2d977c - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 30 114.114.114.114 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 33 223.5.5.5 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 3 114.114.114.114 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 6 223.5.5.5 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\cf2d977c 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cf2d977c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cf2d977c -
resource yara_rule behavioral1/memory/1748-0-0x00000000006E0000-0x000000000076C000-memory.dmp upx behavioral1/files/0x00100000000231f3-2.dat upx behavioral1/memory/4472-4-0x0000000000A40000-0x0000000000ACC000-memory.dmp upx behavioral1/memory/1748-15-0x00000000006E0000-0x000000000076C000-memory.dmp upx behavioral1/memory/4472-16-0x0000000000A40000-0x0000000000ACC000-memory.dmp upx behavioral1/memory/4472-35-0x0000000000A40000-0x0000000000ACC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4c8ff0 cf2d977c File opened for modification C:\Windows\1ded28 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf2d977c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cf2d977c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cf2d977c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cf2d977c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cf2d977c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cf2d977c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cf2d977c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cf2d977c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cf2d977c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cf2d977c - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 4472 cf2d977c 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 1748 2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 4472 cf2d977c Token: SeTcbPrivilege 4472 cf2d977c
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_563047ab683e757cd6e6d379552a9c95_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
C:\Windows\Syswow64\cf2d977cC:\Windows\Syswow64\cf2d977c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\cf2d977c
- Size 640KB
- SHA256 466854f2e6cc3bc926fdf076de70411bcec4dcb599d14677d2d39f91a4a7464c
- MD5 f425ff95d66ea05963a27196c7117c03
- SHA1 29d359ea88c8a6ce1b5e05ac8146359946360a99
- SHA512 4e18f5761c092f82825d5a9ae9377c18240a8f1cac1121a2ee9fa4620a517e7fbd4dbbb47870265a83a4ec9fe2674754d3b27b8dbdc85b1f23af4c2f4789ca96
- SSDEEP 6144:CcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:CSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T14BD45B35A6808036C0B74631C6F64BAAF9B5BC21631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH