52ca0add52efcf524cb0c755a3a303faf7374376f1e8bb363552f18476cd02eb

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_962eff0d565cdb8275903c583a051dc3_amadey_coinminer_elex_smoke-loader.exe
Size 1.9MB
Sample260823-e6lqeasfrb
SHA256 52ca0add52efcf524cb0c755a3a303faf7374376f1e8bb363552f18476cd02eb
MD5 962eff0d565cdb8275903c583a051dc3
SHA1 9d62533b011c7ee0e60714af7c08351c54b72534
SHA512 62385af23afabce0ad2be506f6d3c019d5d117e352c953af1739cca14573b5d9f8567d758ea14c3b82e9c5c6acff8d93ba823a48dce2c106e128405b6733ab24
SSDEEP 24576:v2oo60HPdtTMrsmhfTYudO7vs6nhfdJxvP7dS27+KohfgWqiLjGCnIb6QNqJKq4:+oa1t12f0MBIdJxIwuhoWvLTIbscD
TLSH
T107952258E691D3F6D40524B0AA06C7FB2CAE3C350746DDC372CA2BAD6D606C26633797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3780	4584	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_962eff0d565cdb8275903c583a051dc3_amadey_coinminer_elex_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_962eff0d565cdb8275903c583a051dc3_amadey_coinminer_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_962eff0d565cdb8275903c583a051dc3_amadey_coinminer_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 416
  2⤵
  - Program crash
  PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4584 -ip 4584
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4584-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download