c015ed10d1f44efdbd2f0d4803d7651b861bf74ff50e24cd910453aa00838f2b

General

Target
2026-08-24_6a60bdc3b49460b88e7abcd722555bfb_amadey_coinminer_elex_smoke-loader.exe
Size 1.8MB
Sample260825-nbdwra1cph
SHA256 c015ed10d1f44efdbd2f0d4803d7651b861bf74ff50e24cd910453aa00838f2b
MD5 6a60bdc3b49460b88e7abcd722555bfb
SHA1 f45b214cbf0d4f655d39133a51f1a9f1e9e690f7
SHA512 96b4326be7451863c8090f9f9d3eb023842b2e8ebe4563dee190e36346cfb94ea11e649c7e3147fee71290999b074607dc645e6ca1366c229ce048b70e1193d8
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOu1YA+wyk5BOkUhMXcBwcCi:o6F0eMpAAYEhpz+hwnTUasqcVX
TLSH
T1AA958EE1EF42B0B1E9A308F1740BE7BEA9336D2944218C67E7C7FF157972952257A102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4268	original_temp.exe
4280	original_temp.exe

Loads dropped DLL 1 IoCs

pid	Process
4280	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_6a60bdc3b49460b88e7abcd722555bfb_amadey_coinminer_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4268	4120	2026-08-24_6a60bdc3b49460b88e7abcd722555bfb_amadey_coinminer_elex_smoke-loader.exe	90
PID 4268 wrote to memory of 4280	4268	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-24_6a60bdc3b49460b88e7abcd722555bfb_amadey_coinminer_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_6a60bdc3b49460b88e7abcd722555bfb_amadey_coinminer_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Users\Admin\AppData\Local\Temp\original_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\original_temp.exe" -burn.unelevated BurnPipe.{A32B0F3F-390B-49AA-8467-695C0E63418C} {C83B9B7B-1281-4CD4-B95B-4B75322ED8F2} 4268
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x64.exe

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
Size 1.8MB
SHA256 2c7b00cdf24e10f82701e273f9b57e3726040278fab3c463adb8a10616d99ff8
MD5 8f5767727844dee3c04970d121c84858
SHA1 ffcc8dfe65b8ecaea178437656bde79890241979
SHA512 d625adc81d7523a3007fa0754ac545d41cf492f71d703e681d6ee382143c29ecd51a55cf3dc4a63c6f077395abd0092b5ef045d7f8e483c2c925bc32313cb2c3
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOu1YA+wyk7BOkUhMXcBwcyF:o6F0eMpAAYEhpz+hwnVUasqcu
TLSH
T1EF958EE1EF42B0F1E9A308F1740BE7BEA9336D2944218C67E787FF157972952257A102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 455KB
SHA256 102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
MD5 3284088a2d414d65e865004fdb641936
SHA1 7f3e9180d9025fc14c8a7868b763b0c3e7a900b4
SHA512 6786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62
SSDEEP 6144:9qIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi/6xLdowQguVC+:9qIOkU8AMXE9B7PElZlP41v6ro4n+
TLSH
T13BA45D31A6A04037D6F106B3F914D6307E7DA2187B1184ABD394AE2D7AB8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 1a5af3d61108f7357cc97606e3a97417130c1d92420485469c8d82cc904ea5e4
MD5 1c77f536718f43019a626a6d23b52413
SHA1 b01edeaec7622398e0b775eb1e864faca136f3ab
SHA512 33d11836d4acf621b88bc1281cd209bc2db0b6fd05a4361632ac515ea78ad46d1f88a8ca88d4f8f1a634ac5061a794f174d274ea07bae751d05756d016cf27ba
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOu1YA+wyk:o6F0eMpAAYEhpz+hwn
TLSH
T1B9654CD5EF83B4F5E85308F1350BE7BEA523AD2980328D67FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 c3c97cd4a71efb0e45d5e88f703e7b05a7a83db518222621147db7d71c234bfa
MD5 c7f20f58437eacc8f6e632b37d314b4f
SHA1 e12a93300b0ab81fb24f0900737b45dbb6c116be
SHA512 0cfa65edd4a9867b8d207b6a0c3cdbc0f51d589f225749752c7b5ee6ae00d320d794f3959e8d7aec7f790a26daf122253948eb848f18bee406719545e0cc49cd
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOO1YA+wgo:s6F0eMpAAYEhpD+hwd
TLSH
T136655CD5EF83B4F5E85308F1350BE7BEA523AD2980328D67FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 6eb1b7d610c843a5aac41d2c1e76ab8e27b2ea53b6e9885186077411a0ca75ab
MD5 5f4f20bf2333533c0e132346912c882c
SHA1 beedac55de7c9c4d8d254d401c863c8612b03da8
SHA512 326a09f3f9f7c222f7fb88fcc42d206e5d6010e73bed556421258046319eab3e0fe06dc2ad23b62330456e6de5c6407f7a4b3ef5fce7db1cee430c02b88cd03c
SSDEEP 24576:v7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO81YA+w2K:U6F0eMpAAYEhpJ+hwh
TLSH
T17E654CD5EF83B4F5E85308F1350BE7BEA523AD2980328D67FA87FF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-170-0x0000000000400000-0x0000000000571000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads