198383270dbaba6b6a1004bed0374676d28ffc16f5cb5170dfc686ca249834ec

General

Target
2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Size 547KB
Sample260909-cdl5csae95
SHA256 198383270dbaba6b6a1004bed0374676d28ffc16f5cb5170dfc686ca249834ec
MD5 4e45e5264054068c4c7a0e4ec2a9514d
SHA1 b8bca1375474ea6d160139b6160a396fc0d9943b
SHA512 9b3db5bc64e22e944c111e8702ecbdf3578ef4e6d03ffe722e987f2027586adc506634c0cc5e21435677be6a63f33514df484117fe7de0750258d69834c2d6f3
SSDEEP 6144:4cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:4SvO2x9mONvKRILSFnOkx2LIaxy6RY
TLSH
T16EC47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4432	42d0ede2

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	25	223.5.5.5	4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	3	114.114.114.114	4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	4	223.5.5.5	4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Destination IP	24	114.114.114.114	4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	42d0ede2
File created	C:\Windows\SysWOW64\42d0ede2	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1	42d0ede2
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	42d0ede2

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\4be0a0	42d0ede2
File opened for modification	C:\Windows\547008	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42d0ede2

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	42d0ede2
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	42d0ede2
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	42d0ede2
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	42d0ede2
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	42d0ede2
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	42d0ede2
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	42d0ede2
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	42d0ede2
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	42d0ede2

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA	42d0ede2
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037	42d0ede2

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4432	42d0ede2
4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	4932	2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4432	42d0ede2
Token: SeTcbPrivilege	4432	42d0ede2

C:\Users\Admin\AppData\Local\Temp\2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_4e45e5264054068c4c7a0e4ec2a9514d_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Windows\Syswow64\42d0ede2
C:\Windows\Syswow64\42d0ede2
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4be0a0

Path C:\Windows\4be0a0
Size 506B
SHA256 f08082c69e33e573f303d500477331ec855b6d8bee91bd3710250c991720a44f
MD5 16b66b99f7612032fe6ef4dcfd93995f
SHA1 8232a32c75145b8af8e1090a40b55cdcfe3b29db
SHA512 5011e51a43c38cfa47bdc688c3da6aff0b58c7c441a4b05c5b7f39fbbdffff191b34d911c78d5bc2796bf52dee0e882499d56ebb91997e8358629bd87947b577
TLSH
T1A3F0C93FBABBA3901ACB2FA2250354210802E30BC07FA31DBDC032410CF10995D0F829
MD5 SHA1 SHA512 TLSH

Submit Download

42d0ede2

Path C:\Windows\SysWOW64\42d0ede2
Size 547KB
SHA256 a5e6b009f1f08a099ea090f5fedf1e2a58b99bf24d61a02c786cce4807a6708e
MD5 6262466c1224c352ff817423e40ac0bb
SHA1 41a0a586fc7ebfa06d85d6fb1fbf1c2c32ea1097
SHA512 63abbb9d715489977a23adf2e674c53b03afac31a86eaa3851cb267e750a31b076457cfff1f46944393967c410bae17c2a276192a17e0ccc7fb4f4f6b528b80e
SSDEEP 6144:gcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:gSvO2x9mONvKRILSFnOkx2LIaxy6RY
TLSH
T1F1C47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4432-4-0x0000000000F40000-0x0000000000FA3000-memory.dmp

Download

memory/4932-0-0x00000000001E0000-0x0000000000243000-memory.dmp