6012e65f80f883ef0a50fbc772d9523ff462c61a4b61bef0fe01b6e78bc39580

General

Target
2026-08-23_69fc6e345eb3f0bf96e90e553aec8aba_amadey_coinminer_elex_smoke-loader.exe
Size 1.6MB
Sample260824-lp4m8aen91
SHA256 6012e65f80f883ef0a50fbc772d9523ff462c61a4b61bef0fe01b6e78bc39580
MD5 69fc6e345eb3f0bf96e90e553aec8aba
SHA1 f5b2c085430dae247ded7346d8897cf0d553babf
SHA512 29f4c557eb317c6861a9e121ffe0efdade5f0039be5ad829185aa5c64c2ec333aa014fc94c57bd38e067f74fc63a73545e40b1793723f9fc2e5e765aba58a7ec
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO53YA+wpp4BOkUhMXcBwcCr:W6F0eMpAAYEhpmohwPmUasqcg
TLSH
T121758E64E743C0F6E96301F1844BE7F669309E1980318C77F7C8FE15BAB295276BA606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5832	original_temp.exe
1128	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
1128	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_69fc6e345eb3f0bf96e90e553aec8aba_amadey_coinminer_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 5832	4884	2026-08-23_69fc6e345eb3f0bf96e90e553aec8aba_amadey_coinminer_elex_smoke-loader.exe	90
PID 5832 wrote to memory of 1128	5832	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-23_69fc6e345eb3f0bf96e90e553aec8aba_amadey_coinminer_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_69fc6e345eb3f0bf96e90e553aec8aba_amadey_coinminer_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.unelevated BurnPipe.{3773D17A-5AD0-4D37-AF49-B8FCC7A0A2B2} {E28D195B-3CCB-4B47-B6CD-38A5BA99902E} 5832
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 1.6MB
SHA256 9ee53b16a517ac4f8bd4152f5f55d0e6b5b101d2881ef6e8dd064e595a949628
MD5 ef24935f2d13496793366d9684e5ee25
SHA1 d592da7462256d54833a0e12eb21e75636f9d899
SHA512 f6285d92a6b1f35cda6a279017aac4b38ab5d61ba96dd6668839b1a6f1b4e2a71f66a7e0132ed74258fe6b27a6d371da209de274fe829fcaf9cda1ee95a2ec89
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO53YA+wppJBOkUhMXcBwc08:W6F0eMpAAYEhpmohwPDUasqcR
TLSH
T12C758E64E743C0F6E96301F1844BE7F669309E1980318C77F7C8FE15BAB295276BA606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXAAED.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXAAED.tmp
Size 1.1MB
SHA256 e243a94789d37c34d6607f1d3c18eb389c49c0f4627d1dc2852a00f68641f41c
MD5 b939b70a274f39314e60aa55e9fd03fd
SHA1 bb075848dc378de1f986957296cf77034ac56180
SHA512 1e347748f53e17dec56d253fd3d504cd4b4692da1dc2ab00273a9161cf7bd4b06ce173bba3db72cd692bef1d75e2cae16deab96873b309ae7c39787a05e914a2
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO53YA+wpp:W6F0eMpAAYEhpmohwP
TLSH
T14A455C54E783C5F6ED2310F0444BE7FBA5309E2980318D67FBC8FE11BAB2E522569616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 455KB
SHA256 fd597b58a578cfa46e1818b3b4b795ca6d25225dc11ee86cd491f3d55d7b235d
MD5 0ce624d3a5a586c2bdda26b748da78d7
SHA1 b9ed0a86eae645ba19ed08327888a4474c95e34a
SHA512 e5bc577bd319eb3ac70c527acfb313fac817e63f5184e6581f6d813491ca0f1a0f80583c14c2b9f2b8fa1df5938c2ae3318a91bda41171c63cd1670c55a85b7f
SSDEEP 6144:UqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1OiD+WYtfAx/WfQC:UqIOkU8AMXE9B7PElZlP41T+dtUWfQbe
TLSH
T13AA46D31A6A05037D6F106B3F914D6307E7DA2187B1184ABD394AE2D3EA9497A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 11e3440cf771abc7c6a54fa4399c78611d5efb979a1b5daf2a395cb931eac477
MD5 22ef266e5a9e2e105ff78079697aa126
SHA1 e6f38636d81d76369ab5f3df956251ec29778d81
SHA512 b552ffb5a7169ab8ae81c3b34c08fd8421ea2fc7d3ac36362aa9c012afc81178b39f6aa1b30b67555776795271c98f6dce98a1e784b6f67c63e6afeeec57e898
SSDEEP 24576:l7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOP3YA+wAB:e6F0eMpAAYEhpDPohww
TLSH
T101455C54E783C5F6ED2310F0444BE7FBA5309E2980318D67FBC8FE11BAB2E522569616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4884-172-0x0000000000400000-0x000000000052E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads