Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 615KB
- Sample260910-dmm9fsdr3x
- SHA256 81006bb727287d20ce81a362d8d1222312b028b106746aac5d318d81f7f4e65d
- MD5 bb7f20b482ccafce630d0640de1e2d35
- SHA1 fdb05c460af3553b99465e99962a3598eb251091
- SHA512 24635a11350195058011524165fc7d6903191080f38ee8a11a6ab2cfab4a85d5cd24d4ed0e315f77b8be322c9e9032f7ba78edcd6ce81635ffc963e3a7e99b75
- SSDEEP 12288:rSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:evO2xJKRI2FOkx2LFicUV
- TLSH T12ED44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 664 3d43585d - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 42 114.114.114.114 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 43 223.5.5.5 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 3 114.114.114.114 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\3d43585d 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3d43585d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3d43585d - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\b5e30 3d43585d File opened for modification C:\Windows\cbcd0 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d43585d - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3d43585d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3d43585d Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3d43585d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3d43585d Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3d43585d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3d43585d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3d43585d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3d43585d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3d43585d - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 664 3d43585d 664 3d43585d 664 3d43585d 664 3d43585d 664 3d43585d 664 3d43585d 664 3d43585d 664 3d43585d 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 744 2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 664 3d43585d Token: SeTcbPrivilege 664 3d43585d
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_bb7f20b482ccafce630d0640de1e2d35_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744
-
C:\Windows\Syswow64\3d43585dC:\Windows\Syswow64\3d43585d1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:664
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\3d43585d
- Size 615KB
- SHA256 dfd0b99e04d544cd2d9dd005296bf82171eaa327de32384e71db7ee9777ece78
- MD5 f3ee52d85c382f4a229b53a5bf333c25
- SHA1 0b8d03de33adbb510eb5902c1bc0ec57aa328d6c
- SHA512 719c4aba091c449ee458fd8fd376e767dcb2a455d8c283d52ebc4e9710fa4318539dc6af775ef1174fcc188f10dc02b34a44127351baec4292c29d49e2a2c15a
- SSDEEP 12288:JSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:wvO2xJKRI2FOkx2LFicUV
- TLSH T145D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH