Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/08/2026, 02:52
Behavioral task
behavioral1
Sample
2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
- Size 1.2MB
- Sample260827-dcqltsdj4v
- SHA256 4b048c315c7a53512eb7dc4e2c79b15c8ea4d4ab69619a6c18b3c50ff532c5dd
- MD5 f27d65e3f8f4f8e99b1c6682c3bf3a3c
- SHA1 f41cb1288b96ddc42548c0f8f62ea7af753e5960
- SHA512 238f3efba8844acc59f9b603cc073c976f3e24c16c3bf11c04e66508b36d74c2289d25aebcf5cf5f90415a22c218139aac87e3c448f0318d21d1e712fd01a90e
- SSDEEP 24576:CvO2xJKRw2kOkx2LFRvcUQPxuZ98Es8k3OH3C0rQS:CHHKe2WQX5QZuTtS0rQS
- TLSH T1A4458C31E641C036D4A70175C6BA4BBFA9787D25032565C7E3D43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral1/memory/2820-0-0x00000000002B0000-0x000000000033C000-memory.dmp UPX behavioral1/files/0x000a0000000243ee-2.dat UPX behavioral1/memory/4520-4-0x00000000004B0000-0x000000000053C000-memory.dmp UPX behavioral1/memory/2820-18-0x00000000002B0000-0x000000000033C000-memory.dmp UPX behavioral1/memory/4520-19-0x00000000004B0000-0x000000000053C000-memory.dmp UPX behavioral1/memory/4520-30-0x00000000004B0000-0x000000000053C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 4520 cc57c693 - Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 104 114.114.114.114 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 105 223.5.5.5 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 174 114.114.114.114 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 175 223.5.5.5 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 3 114.114.114.114 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 4 223.5.5.5 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 55 114.114.114.114 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 58 223.5.5.5 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cc57c693 File created C:\Windows\SysWOW64\cc57c693 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cc57c693 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cc57c693 -
resource yara_rule behavioral1/memory/2820-0-0x00000000002B0000-0x000000000033C000-memory.dmp upx behavioral1/files/0x000a0000000243ee-2.dat upx behavioral1/memory/4520-4-0x00000000004B0000-0x000000000053C000-memory.dmp upx behavioral1/memory/2820-18-0x00000000002B0000-0x000000000033C000-memory.dmp upx behavioral1/memory/4520-19-0x00000000004B0000-0x000000000053C000-memory.dmp upx behavioral1/memory/4520-30-0x00000000004B0000-0x000000000053C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4d6250 cc57c693 File opened for modification C:\Windows\304788 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cc57c693 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cc57c693 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cc57c693 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cc57c693 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cc57c693 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cc57c693 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cc57c693 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cc57c693 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cc57c693 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cc57c693 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4520 cc57c693 4520 cc57c693 4520 cc57c693 4520 cc57c693 4520 cc57c693 4520 cc57c693 4520 cc57c693 4520 cc57c693 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Token: SeTcbPrivilege 2820 2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Token: SeDebugPrivilege 4520 cc57c693 Token: SeTcbPrivilege 4520 cc57c693
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-26_f27d65e3f8f4f8e99b1c6682c3bf3a3c_amadey_coinminer_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
C:\Windows\Syswow64\cc57c693C:\Windows\Syswow64\cc57c6931⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\cc57c693
- Size 1.2MB
- SHA256 10396947d800ab7dd07e6cecd253e0b80913d086fc2b9af14bddee296c272be8
- MD5 8cbb06bec7a7908abdd3e859397e3781
- SHA1 82f772abe15fe2ad637655ed3bb8d4765961cb28
- SHA512 6b006af8d9c01c62c4a32761b3974f70de97f57fd79241e31221893b5e4b9e499abed67919d3b178d0e2b3251ee53d32861e6276254cf68c16656a48b95577b4
- SSDEEP 24576:fvO2xJKRw2kOkx2LFRvcUQPxuZ98Es8k3OH3C0rQS:fHHKe2WQX5QZuTtS0rQS
- TLSH T185458C31E641C036D4A70175C6BA4BBFA9787D25032565C7E3D43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH