Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 511KB
- Sample260824-e7ba3ashmg
- SHA256 6ce33a6a3a50a55039086134c08be72f4f3c42929c4c5d73c7718153abc2c691
- MD5 9727cc17fe390989b1c8def0b232a534
- SHA1 f9579842c8b0f01705e1cda3992752bb88aed628
- SHA512 68c10e0f40efbdbba14a8a36a9988e725aef143dbce2244c776b8d47fb3d71cb3e894d023cfbb00e55112995e4027e943709eef65e9a7eed778bb2220ff6c266
- SSDEEP 6144:vcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:vSvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T16CB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3756 daf5e70 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 11 223.5.5.5 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 68 223.5.5.5 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 126 114.114.114.114 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 194 114.114.114.114 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 195 223.5.5.5 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 57 114.114.114.114 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 62 114.114.114.114 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 63 223.5.5.5 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 127 223.5.5.5 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 daf5e70 File created C:\Windows\SysWOW64\daf5e70 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 daf5e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 daf5e70 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\404dd8 daf5e70 File opened for modification C:\Windows\240570 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daf5e70 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" daf5e70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" daf5e70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" daf5e70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" daf5e70 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing daf5e70 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix daf5e70 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" daf5e70 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ daf5e70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" daf5e70 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3756 daf5e70 3756 daf5e70 3756 daf5e70 3756 daf5e70 3756 daf5e70 3756 daf5e70 3756 daf5e70 3756 daf5e70 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 2104 2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3756 daf5e70 Token: SeTcbPrivilege 3756 daf5e70
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9727cc17fe390989b1c8def0b232a534_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
C:\Windows\Syswow64\daf5e70C:\Windows\Syswow64\daf5e701⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\daf5e70
- Size 511KB
- SHA256 08ea8509eec6c981523c6d4d970124e6db1673e4eec0a4fadf9f00952fecfdeb
- MD5 4c6812fbc729b728ee1efbec685e8797
- SHA1 f4ec5044c49cc1b0616a844804bff449e252e4eb
- SHA512 d95d13fe2934e3384658b0b1e228ff720c6fd0b812d8b1ab606940ce54edac3ebf39b40306492f5f0cf9c8f51774dc1b6a34a39445680986796388cd900de371
- SSDEEP 6144:jcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:jSvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T1ECB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH