e3189180444a6ac661ba15a5f49c00b12e0bc5b1666f2004515f4159ef4d4afe

General

Target
2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Size 547KB
Sample260906-wpnl4sek7s
SHA256 e3189180444a6ac661ba15a5f49c00b12e0bc5b1666f2004515f4159ef4d4afe
MD5 c9407dc4bcf922e7c8644dd8779e78b6
SHA1 6dd5acc3d184f873133cb85c6142d2f7db477912
SHA512 cffcfc1e5ca032ed51d8aad291053493e38b3a8f745683a8eee34623037b2166ff8efc234bb8961ed5f18b0ddee93bf3a4bcab32f648dda93ad0250d0a3fb4ff
SSDEEP 6144:1cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:1SvO2x9mONvKRILSFnOkx2LIaxy6RY
TLSH
T15AC47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3240	fa23e726

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	34	114.114.114.114	368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	35	223.5.5.5	368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	3	114.114.114.114	368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	4	223.5.5.5	368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	fa23e726
File created	C:\Windows\SysWOW64\fa23e726	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	fa23e726
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	fa23e726

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\377850	fa23e726
File opened for modification	C:\Windows\64ce0	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa23e726
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	fa23e726
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	fa23e726
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	fa23e726
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	fa23e726
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	fa23e726
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	fa23e726
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	fa23e726
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	fa23e726
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	fa23e726

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA	fa23e726
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037	fa23e726

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3240	fa23e726
3240	fa23e726
3240	fa23e726
3240	fa23e726
3240	fa23e726
3240	fa23e726
3240	fa23e726
3240	fa23e726
3240	fa23e726
3240	fa23e726
3240	fa23e726
3240	fa23e726
368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	368	2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	3240	fa23e726
Token: SeTcbPrivilege	3240	fa23e726

C:\Users\Admin\AppData\Local\Temp\2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_c9407dc4bcf922e7c8644dd8779e78b6_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368

C:\Windows\Syswow64\fa23e726
C:\Windows\Syswow64\fa23e726
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

377850

Path C:\Windows\377850
Size 506B
SHA256 82f82df40c2f8861a55d101c0554fd8bb870512dfd966e6d2a784580e62d8886
MD5 81915cb6244d485bcfd5dd224f540006
SHA1 934384d78e335c36fc883d018974458d462f320a
SHA512 9662975bec4674803ff8a091054691216dee1148cf1f74c719c0f4ad501fdcad2a921660d12cb607ea6221111d176525b22ef5f04c5084875d5a28d82da6f2d6
TLSH
T179F00EF6AD1D9DB20ADB1CB118036EB82A2FE0AD440F92413CE1374B1997A446443010
MD5 SHA1 SHA512 TLSH

Submit Download

fa23e726

Path C:\Windows\SysWOW64\fa23e726
Size 547KB
SHA256 86c5f837d010d121a352c5f4256f9dd983838da277dc5dbac60294a54a1ac3e5
MD5 0b5c8a90614d429c3ab565686dfa57ea
SHA1 6302fa7e573ab1e05f325a53c50caddb57e41d15
SHA512 196fe42a877ad6669ab372cc6c4a2d5db2b85e13148fec9228215513546744974cf9f7bfe6267e72d37503405ebac3e9b739d643236663b5efbc2cf4741188c0
SSDEEP 6144:8cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:8SvO2x9mONvKRILSFnOkx2LIaxy6RY
TLSH
T188C47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-0-0x0000000000940000-0x00000000009A3000-memory.dmp

Download

memory/3240-4-0x0000000000770000-0x00000000007D3000-memory.dmp