ec49ca2a2c51fdca6ecf08256b23e25bee1e6e0135637a1ad00bf780b9e29741

General

Target
2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Size 704KB
Sample260809-a5brlaxekd
SHA256 ec49ca2a2c51fdca6ecf08256b23e25bee1e6e0135637a1ad00bf780b9e29741
MD5 03376b7c65b8954a41619a3ed09f1c95
SHA1 07017bc93c6ccce4ec3f522cc298a30a5b6d6724
SHA512 3084fdb455adebc721861133ac8935a31cbf1f8685e54f52a77b7bfda851971076d102f3df1b1f0445f1205c33393852323d7dc7779c2c4237d8a159e1f89ce3
SSDEEP 12288:GSvO2x9mONvKRILSF/Okx2LIatyVuX13kdB4YSYVWd:lvO2xJKRI2dOkx2LFAAX1oOYSY8d
TLSH
T16AE48B12F791C172C86746B488A7476EAA75BD1523204BCBE7907E5A8EB33D1BC3930D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
behavioral1/files/0x001100000002428e-2.dat	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 1 IoCs

pid	Process
1524	b2408add

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	4	223.5.5.5	4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	32	114.114.114.114	4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	33	223.5.5.5	4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\b2408add	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	b2408add
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	b2408add

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\1a1768	b2408add
File opened for modification	C:\Windows\4ac820	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2408add

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	b2408add
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	b2408add
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	b2408add
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	b2408add
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	b2408add
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	b2408add
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	b2408add
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	b2408add
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	b2408add

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1524	b2408add
1524	b2408add
1524	b2408add
1524	b2408add
1524	b2408add
1524	b2408add
1524	b2408add
1524	b2408add
1524	b2408add
1524	b2408add
1524	b2408add
1524	b2408add
4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	4368	2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	1524	b2408add
Token: SeTcbPrivilege	1524	b2408add

C:\Users\Admin\AppData\Local\Temp\2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_03376b7c65b8954a41619a3ed09f1c95_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\Syswow64\b2408add
C:\Windows\Syswow64\b2408add
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1a1768

Path C:\Windows\1a1768
Size 506B
SHA256 92d4204ad33063212e07a720b1c43186c25581fa792db8b2f29db172df56e8ae
MD5 e59d1b1db1fba27738349ece0f157efc
SHA1 fd0371cdd735d24167b0a7072235a264ae9ab231
SHA512 8331951a285aaffe2d35e3f6034eadab45c1ed332b536ebf3d84e6b919df4d38e53493f51c6b25605edfbeeb73e27579d2bfa27b3da0a6026098388b2186e19b
TLSH
T1F9F09E3FD42F3AA9CA8B5CA1B743B9C9121FB06F59A661292AD3F4810CEF0459C4740D
MD5 SHA1 SHA512 TLSH

Submit Download

b2408add

Path C:\Windows\SysWOW64\b2408add
Size 704KB
SHA256 2c417c25fe37475397eb14e73d79f44b446f81db1d98160ddff096582fd373eb
MD5 257985fd22146f0634aeba9198cfed3b
SHA1 3828795b56a4b17d50ec0fbe0f439bdba64a68c7
SHA512 097f2b00bf3b37f2935f7c94b71a382ccccba623e60aa17a1ef36b7c48cadb88cb015d6a357ca96266c59e496a7edc05e5587987d33a9890fdb77e0c511637bf
SSDEEP 12288:GSvO2x9mONvKRILSF/Okx2LIatyVuX13kdB4YSYVWd:lvO2xJKRI2dOkx2LFAAX1oOYSY8d
TLSH
T1CFE48B12F791C172C86746B488A7476EAA75BD1523204BCBE7907E5A8EB33D1BC3930D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-4-0x0000000000920000-0x0000000000983000-memory.dmp

Download

memory/4368-0-0x00000000005F0000-0x0000000000653000-memory.dmp