Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_ed7f46b0eee5963d82dad0b45d0cf694_amadey_coinminer_elex_kwampirs_mafia_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_ed7f46b0eee5963d82dad0b45d0cf694_amadey_coinminer_elex_kwampirs_mafia_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-08-10_ed7f46b0eee5963d82dad0b45d0cf694_amadey_coinminer_elex_kwampirs_mafia_smoke-loader.exe
- Size 484KB
- Sample260810-1cn5bstxes
- SHA256 ee4a73ae21825126cc91b3474865c58c2104d601aff3927a74559b479cbd5143
- MD5 ed7f46b0eee5963d82dad0b45d0cf694
- SHA1 a51332ca21a4c1df4523d4f070a8aacde9c67096
- SHA512 95b88262a56c82a7c9c13225010fc7c7847a1631a83a658155c6254a95d43bc9bbd8a5d73bcf67c855be77ec4d7c2577e7be8f90b34ae57d1a39de394a084db5
- SSDEEP 12288:iu4lNAtYytvS5Aku1YLYxdkUoDj9JU01tuMsTp:iwhtvSLuleUoPo0uM
- TLSH T1C0B4CF21B690C033E51312754879A77A992FAA715B3095C797EC0E7EBF663C39B3034A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation 2026-08-10_ed7f46b0eee5963d82dad0b45d0cf694_amadey_coinminer_elex_kwampirs_mafia_smoke-loader.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_ed7f46b0eee5963d82dad0b45d0cf694_amadey_coinminer_elex_kwampirs_mafia_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2348183846" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271183" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "493162407" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2346464576" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271183" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008e214533908c949bd6f849ed4c4ef8200000000020000000000106600000001000020000000c1d665b84e44128f9ca3b0c83f260aec0cc0d929576475491bf6aa1a543f6db3000000000e800000000200002000000012889de5f7cd4f783cae35e1e760a6394a255c1be00189efa531edc1e1f9cf2120000000bafb8fa81a704c55591c3cba8582116e3497730336ac73ead040690e414ba31e400000002486e771192ac5b7a74d9f50cc7417a02773b5c9037ca187efd31781dc5e0697a35f7a7419b54b4e2ab5cb4c63b9c324335e533d67f41003126dc17985437bfb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B7029BD3-9502-11F1-B40A-EEAAB15450A7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e4ffed1729dd01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b8f8ed1729dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000008e214533908c949bd6f849ed4c4ef82000000000200000000001066000000010000200000008e5793194b20537ae3204fa3a07a36f33c479ead494e6ca942c06c0df64d6c55000000000e800000000200002000000085cce54718f18fd18d4dfe35abb78476de188d436c3d8f9184ca43e66b84f3cf20000000df08951fab8c6cfcda9269506dd2cc44e1996025b8114e7ee26d5efdc84c2a5340000000f2681ad6ea8dc4b2e9e112995b38bf3abfa11468a08a625a8c9abc0939ea34b517de6a489d5367f9f4f9fdd67aea5554dac94a890fd5c10ad49fde385d3b0625 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4868 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4868 iexplore.exe 4868 iexplore.exe 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4868 2872 2026-08-10_ed7f46b0eee5963d82dad0b45d0cf694_amadey_coinminer_elex_kwampirs_mafia_smoke-loader.exe 85 PID 4868 wrote to memory of 2624 4868 iexplore.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_ed7f46b0eee5963d82dad0b45d0cf694_amadey_coinminer_elex_kwampirs_mafia_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ed7f46b0eee5963d82dad0b45d0cf694_amadey_coinminer_elex_kwampirs_mafia_smoke-loader.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://skjp.zcjczj.cn/rxzgzb.html?s=56&v=57&c=72&a=175&m=&t=16150851502⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4868 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2624
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 453befde346c1d09037e130726c444f7ef9b92e3ae425d56a56716a7e77c976e
- MD5 375bf99e1d039f08d00bf36ef9504ac1
- SHA1 e7c96cce2ee295ee465f6c90f24f6cd7239288b1
- SHA512 6897739f7e7715acfe296a481dc8b7ff539dfc648ae0fca15e5cde13f97c61e4d703cb15902081a375828116d6a49f0668bd9b360b0d9c74082e9d620069f91b
- TLSH T153F05CC2985C9AA048C21ADC09AC832BF822D1BB60A5082A803C0AB68B223149259A3C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 8d2fbc0cbcc4ccbee6c7541bcc74a83be5258a28f63f0b192b1828d74484f53e
- MD5 80a75691393497d0dea71b1f84802e46
- SHA1 d214986189d0126e71dc0118cd865fceebf58863
- SHA512 9c43fada27f50ed1a345f73958a9befbad5fa835897a91056a5e636b8841013cf20b59b3a5dfa67f8e65031faeb842c1e3392e13c2dc91cd42025a52b3a4ed63
- TLSH T12BE0C03815F6451EF5E4E4344FD576258469F0320518D2F42AE4DB08A702600AC0292E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D6NN03DP\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH