3b3d35309cd4592c8542e8f84b6657003586d4f5af09b6bc0b12f780586fcc50

General

Target
2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe
Size 1.3MB
Sample260810-twe77ssgnd
SHA256 3b3d35309cd4592c8542e8f84b6657003586d4f5af09b6bc0b12f780586fcc50
MD5 589cb3474c2a2aa799b22baf6aa6ea3b
SHA1 1351d64ea3ed51e304b2e4e7681d7376cbd3f9ec
SHA512 eab34b595e1d879575f48e2270dacaf8636f3184c48a2de1c09d9e2eee12e3da2b57420395e86f4e1a7d39da5e175546d959561805ca93b863badce45cc3c8a5
SSDEEP 24576:yCx+ds2shQb206BvBPbfFT1R6eUBxXhT2oZl+fTbV7Jn3o0E+I5VaM4t:hdTBpL56eUBLTjgZE+I5V2t
TLSH
T1CF557D61B702C035EDA304B1897E4BAE95246F61032655C7F3D43C6A2FB65E32B37A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	2684	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\DOMStorage\softonic.com	2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\DOMStorage	2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\DOMStorage\softonic.com\NumberOfSubdomains = "1"	2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 5c0000000100000004000000000800000b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f57f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa467e00000001000000080000000080826f22e7dc01030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4	2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E	2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2684	2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe
2684	2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_589cb3474c2a2aa799b22baf6aa6ea3b_coinminer_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 2108
  2⤵
  - Program crash
  PID:2440