15e98ad24ab1f2a4ef1d0ea4377fface6e8824da5225d5226bfd1f3707b54475

General

Target
2026-08-22_ced2d75d3ddfd8b90b3f7f91d23581d9_amadey_coinminer_elex_smoke-loader.exe
Size 2.3MB
Sample260823-adj9nagg87
SHA256 15e98ad24ab1f2a4ef1d0ea4377fface6e8824da5225d5226bfd1f3707b54475
MD5 ced2d75d3ddfd8b90b3f7f91d23581d9
SHA1 cf26eb7ebaff541b4d4ecbe6d77cef8bad4a3bbc
SHA512 23a06ae23b19e2df7fee85c5b3043d377f51672cc6e1a110d0cfb7ee5ecd3686354f224c63c464f9c4d512a0e08b729ed2cdd5ed4639e5c862f6ccf04b4f404b
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/qIf5BOkUhMXcBwcCro4Q:s6F0eMpAAYEhpiqyTUasqcVJ
TLSH
T12AB57EE1FF42F1B2E49208F1740BF6FDE9236D2488228867F787FF287572552656A106
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2924	original_temp.exe
2352	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
2352	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_ced2d75d3ddfd8b90b3f7f91d23581d9_amadey_coinminer_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2924	2636	2026-08-22_ced2d75d3ddfd8b90b3f7f91d23581d9_amadey_coinminer_elex_smoke-loader.exe	90
PID 2924 wrote to memory of 2352	2924	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-22_ced2d75d3ddfd8b90b3f7f91d23581d9_amadey_coinminer_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_ced2d75d3ddfd8b90b3f7f91d23581d9_amadey_coinminer_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.unelevated BurnPipe.{3C48473E-7551-4B6A-827F-0FE2B5441D2F} {ED449B75-65E7-476C-9225-CE9D0E0B93DA} 2924
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
Size 2.3MB
SHA256 b0df5c86b30bdcad52190a7a2d4e1d4704616bb774af1116f5b14f21389a2e77
MD5 201b5c87060e5e7ee97c6b4f932869e9
SHA1 d51f6e2b4235f92d94771021f4c6d17f150f802a
SHA512 2843ec07baa25b12909f58a2cb6ba7e58430f4f3194d7d6b9902be247fb47f7d294cbdeb61ccd32c2bc7d58e1c19d76953ef43f2119d1f5fb9c646340eb082b1
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/qIf7BOkUhMXcBwcy04:s6F0eMpAAYEhpiqyVUasqc8
TLSH
T1DFB57EE1FF42F1B2E49208F1740BF6FDE9236D2488228867F787FF287572552656A106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6C3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6C3E.tmp
Size 1.9MB
SHA256 62bceca10d4935a03410003b999678fb571d19da205bd06e30a62ca92f3be196
MD5 669878cc5ec3be2d8535c4c1c7e6ae35
SHA1 0bf5ca191ff4dc1ca37407af676712bc051d44a2
SHA512 d3823904a61d8a4de019b9c1243609c44ac32f56fd5aba9a8bc77dc8ddf63e8bae5bd04b3e0bdee66770ebf7f1240e06995ace5086a6877472e1bb06f4ca2c4c
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/qIf:s6F0eMpAAYEhpiqy
TLSH
T1B09539E5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 455KB
SHA256 102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
MD5 3284088a2d414d65e865004fdb641936
SHA1 7f3e9180d9025fc14c8a7868b763b0c3e7a900b4
SHA512 6786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62
SSDEEP 6144:9qIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi/6xLdowQguVC+:9qIOkU8AMXE9B7PElZlP41v6ro4n+
TLSH
T13BA45D31A6A04037D6F106B3F914D6307E7DA2187B1184ABD394AE2D7AB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.9MB
SHA256 44b22d0a2f1843a72270f4a203cc8b9fbd34181c3fd384ce7fddd85adf74d5b0
MD5 616b754974c814952285ed8b94512df8
SHA1 1f12b39cba0c40732eb7602d1cb37c53a90e1ac5
SHA512 d9146c85e79ed03dc55f742ebcfb887bbc491d16be2b34a8c188ac36ae8f1048ed15a7d10eadeae740298558a4980e21ca03f5a62219fb5486f11f1e22bfb744
SSDEEP 24576:b7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOpqBJ:46F0eMpAAYEhpMqX
TLSH
T1F79539E5FE42F2F2E8920CF1350BF6FED5236D25C8228953B687FB28B573A112559106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2636-173-0x0000000000400000-0x00000000005F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads