fd4b59a0c15fe7bcca011ea74e5f26ca5b2831947e60f2bf089335b9117dfb5c

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Size 419KB
Sample260815-d4vd4adf52
SHA256 fd4b59a0c15fe7bcca011ea74e5f26ca5b2831947e60f2bf089335b9117dfb5c
MD5 8b5ec028cc88eb611dbe5b019f7175d1
SHA1 ddabe0d7d04a30b861273d83cf84c0bb77d899dc
SHA512 f5a13c00878c3ad8a3596dc82b7cecc8fe6ff388e85788e73cf304ebefc444f1c9aa2ac33dbadd098ef273167de0728d29240c2556cc0d40af5f5965726eb620
SSDEEP 6144:M8a+AjLd9fSZLC/umZjqDvjZFXcEOkCybEaQRXr9HNdvOa:Ba+4EZe/uwqDvDOkx2LIa
TLSH
T199948D19FAA08036C5A38575C4A257A7FBB1752137209ACFA3A057561F237E3BD3630E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2500	ada93425

Unexpected DNS network traffic destination 14 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	2	223.5.5.5	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	43	114.114.114.114	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	46	223.5.5.5	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	136	114.114.114.114	2500	ada93425
Destination IP	154	223.5.5.5	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	284	114.114.114.114	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	285	223.5.5.5	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	314	114.114.114.114	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	1	114.114.114.114	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	35	114.114.114.114	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	105	114.114.114.114	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	227	114.114.114.114	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	228	223.5.5.5	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	366	114.114.114.114	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	ada93425
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	ada93425
File created	C:\Windows\SysWOW64\ada93425	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	ada93425

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\2acd08	ada93425
File opened for modification	C:\Windows\2af018	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ada93425

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ada93425
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ada93425
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ada93425
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ada93425
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ada93425
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ada93425
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ada93425
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ada93425
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ada93425

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	ada93425
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 6b00000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ada93425
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c0000000100000004000000000800001900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d6b00000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd677073920000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ada93425

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2500	ada93425
2500	ada93425
2500	ada93425
2500	ada93425
2500	ada93425
2500	ada93425
2500	ada93425
2500	ada93425
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	2508	2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	2500	ada93425
Token: SeTcbPrivilege	2500	ada93425

C:\Users\Admin\AppData\Local\Temp\2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_8b5ec028cc88eb611dbe5b019f7175d1_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\Syswow64\ada93425
C:\Windows\Syswow64\ada93425
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ada93425

Path C:\Windows\SysWOW64\ada93425
Size 419KB
SHA256 167a7b49016fca947b3867eaa716893829e525d7d433ac203e76b0574a1d551b
MD5 2e9ed43482988fbe3647a26e2c28c47a
SHA1 1090011d8bc3ca8fca38a9b1bc6c8bad84f55cbf
SHA512 724dd3847c34a1c65fd78cb13c2fdd128e7bbf48209bfa3f06f4990d19462ceee46e038a5d52f3a32839167629830a060df27c673026b7b577cb3f5e3d941872
SSDEEP 6144:c8a+AjLd9fSZLC/umZjqDvjZFXcEOkCybEaQRXr9HNdvOa:Ra+4EZe/uwqDvDOkx2LIa
TLSH
T124948D19FAA08036C5A38575C4A257A7FBB1752137209ACFA3A057561F237E3BD3630E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download