4a17e8d7cc475c2c8248a196ea9f05465eb3d10188494cd2b3fdc37b5ef5cc07

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe
Size 18.8MB
Sample260809-sbaljszgjc
SHA256 4a17e8d7cc475c2c8248a196ea9f05465eb3d10188494cd2b3fdc37b5ef5cc07
MD5 0c90e64693a32d7668c6eec6d747a213
SHA1 3c29a7fd2702015a77f4dbe0d649dcb9dd97f97b
SHA512 120d036fd3abbf506f25d21010e48f83e52a632bbe94ce42633e830d8027961a650459fcf47ca8ffe5a250327f3f6fabc7fc0b7256e0fb7c62b611c6170cc17b
SSDEEP 393216:QWa1hAeGmZ5BHhO/G0BZUCHhMoW28SOfn5H8dnYkBCfpnvfFXm6juH6ez:QLumNgkCBBW5STMnvfi6
TLSH
T1D4172301E6015239FEB725B28DBE442DE12CBE60671865C3A3C87C2D5FBA9F2793115B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E364F12-2076-414D-A935-BA6E20317C83}	2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E364F12-2076-414D-A935-BA6E20317C83}\IMPLEMENTED CATEGORIES	2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E364F12-2076-414D-A935-BA6E20317C83}\IMPLEMENTED CATEGORIES\{2A1565A0-C57A-496F-A63E-7A603A45E1B3}\svrid	2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{2E364F12-2076-414D-A935-BA6E20317C83}\\IMPLEMENTED CATEGORIES\\{2A1565A0-C57A-496F-A63E-7A603A45E1B3}	2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E364F12-2076-414D-A935-BA6E20317C83}\IMPLEMENTED CATEGORIES\{2A1565A0-C57A-496F-A63E-7A603A45E1B3}\uuid = "bf38b0eb6756bdc98427dda17adcb614"	2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E364F12-2076-414D-A935-BA6E20317C83}\IMPLEMENTED CATEGORIES\{2A1565A0-C57A-496F-A63E-7A603A45E1B3}	2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0c90e64693a32d7668c6eec6d747a213_amadey_coinminer_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installconfig.xml

Path C:\Users\Admin\AppData\Local\Temp\~e58fba1\installconfig.xml
Size 3KB
SHA256 dd44ad117332429d379c19122dd4a5fbc57a804030e0e79ebee8f7970e449a17
MD5 6ccdb270597d1268536eb29708fe02fc
SHA1 62e86e193c8a3a7032e4af45633e38118ca2d6ac
SHA512 cab63c303d473dacc45ceb0c3fc9d779f5c98ecf0d9dda4e683cba140e194e745b8f7b4c4499a699cf3e3e9125b1a6dcc2779b6fb38e13f2f129ca000c02e6ae
TLSH
T12D81BD91F01C3F72867C23B7667A9D25169FFDDF914582AA68FD313302478E009782B6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5364-102-0x0000000003F80000-0x0000000003F81000-memory.dmp

Download

memory/5364-113-0x0000000003F80000-0x0000000003F81000-memory.dmp