Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 03:46
Behavioral task
behavioral1
Sample
2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 560KB
- Sample260812-eb5j2aad35
- SHA256 c91ff2aba2c19b874d09791d52cfe094719e8d55bfba915670d141ed989f0f25
- MD5 1c3d56efef19077aaa56eaf651bb77c3
- SHA1 75fd80053ef09b6d39d2342d3dcfd96b18eef844
- SHA512 cfa2a69f80af78844020697be9a3ffb02b307d9bd96c6ed9e77155c9ea76ec27b002a74332515ac261dc28a26f4e791e0b0fa71b1c71bac1b780182e1162ce1b
- SSDEEP 6144:04ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:0rNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T1BEC48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/4476-0-0x0000000000A00000-0x0000000000A8C000-memory.dmp UPX behavioral2/files/0x0006000000006977-3.dat UPX behavioral2/memory/3852-4-0x0000000000330000-0x00000000003BC000-memory.dmp UPX behavioral2/memory/4476-25-0x0000000000A00000-0x0000000000A8C000-memory.dmp UPX behavioral2/memory/3852-26-0x0000000000330000-0x00000000003BC000-memory.dmp UPX behavioral2/memory/3852-45-0x0000000000330000-0x00000000003BC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3852 3fb4c9be - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 4 223.5.5.5 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 21 114.114.114.114 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 22 223.5.5.5 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3fb4c9be File created C:\Windows\SysWOW64\3fb4c9be 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3fb4c9be File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3fb4c9be -
resource yara_rule behavioral2/memory/4476-0-0x0000000000A00000-0x0000000000A8C000-memory.dmp upx behavioral2/files/0x0006000000006977-3.dat upx behavioral2/memory/3852-4-0x0000000000330000-0x00000000003BC000-memory.dmp upx behavioral2/memory/4476-25-0x0000000000A00000-0x0000000000A8C000-memory.dmp upx behavioral2/memory/3852-26-0x0000000000330000-0x00000000003BC000-memory.dmp upx behavioral2/memory/3852-45-0x0000000000330000-0x00000000003BC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\41f298 3fb4c9be File opened for modification C:\Windows\4ca178 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fb4c9be - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3fb4c9be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3fb4c9be Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3fb4c9be Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3fb4c9be Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3fb4c9be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3fb4c9be Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3fb4c9be Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3fb4c9be Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3fb4c9be - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 3852 3fb4c9be 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 4476 2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3852 3fb4c9be Token: SeTcbPrivilege 3852 3fb4c9be
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_1c3d56efef19077aaa56eaf651bb77c3_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
C:\Windows\Syswow64\3fb4c9beC:\Windows\Syswow64\3fb4c9be1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\41f298
- Size 916B
- SHA256 5b032a56c8091e6812ebcf34245c2ab0a341d6b52480977f9154f7c2c71fe6db
- MD5 6d078b1f1c5eb0eaa555da89d44c3ccc
- SHA1 4233c2963e7a5bdb990390183d65e5fe2198de68
- SHA512 62017e522a5401ff994f5d57decc8a141473497223882ee7e168774a29e4723b526779c94a44303c13a4c9592208942de9513523a736f3566a53225ae2ef343c
- TLSH T190113AB5769A7AC81AF0E5F0A642CD8772727690D4F9017FC181201164563B6CD73DBB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\3fb4c9be
- Size 560KB
- SHA256 4ebe3881d559c859833ac3e48f12de0379b8d8f95a66cd5c90e40bd37a3dd69a
- MD5 634a8118ef6e708f92ff3cf8a0a586d7
- SHA1 aa262cb9a0ffdf55ec1b59089cc51b0a508e66b4
- SHA512 6396e7459c022a00d0221c38ac949c89a9c8879d5ef9f3d7d28c797a16785d3be2f238402e0ace87906fdced19b7755a163eb66cef6da2a4072146da38987e66
- SSDEEP 6144:j4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:jrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T103C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH