Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 07:57
Behavioral task
behavioral1
Sample
2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe
- Size 830KB
- Sample260910-js811asyhx
- SHA256 d7c0118728632e3c02814e4830db9e164cddb25c3945d27135cae7d55f1d1d99
- MD5 01ecb6291f8419379f8dfd32197aebc8
- SHA1 93bd44b2644c01064575293d370953db8be6ec31
- SHA512 02cf4adca595412eb41061531f16cb61e392ebf53d61c999da8dd913c16c26c7327a5c1da7337ef7bd0b59560cc7207414c7d648d068b5c9282a9941862f83e6
- SSDEEP 12288:TSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:mvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T15D055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/4204-0-0x0000000000860000-0x00000000008EC000-memory.dmp UPX behavioral2/files/0x000c000000019cc9-2.dat UPX behavioral2/memory/4728-3-0x0000000000820000-0x00000000008AC000-memory.dmp UPX behavioral2/memory/4204-10-0x0000000000860000-0x00000000008EC000-memory.dmp UPX behavioral2/memory/4728-11-0x0000000000820000-0x00000000008AC000-memory.dmp UPX behavioral2/memory/4728-34-0x0000000000820000-0x00000000008AC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 4728 d87e757c - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 14 114.114.114.114 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe Destination IP 15 223.5.5.5 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe Destination IP 1 114.114.114.114 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe Destination IP 2 223.5.5.5 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d87e757c File created C:\Windows\SysWOW64\d87e757c 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d87e757c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d87e757c -
resource yara_rule behavioral2/memory/4204-0-0x0000000000860000-0x00000000008EC000-memory.dmp upx behavioral2/files/0x000c000000019cc9-2.dat upx behavioral2/memory/4728-3-0x0000000000820000-0x00000000008AC000-memory.dmp upx behavioral2/memory/4204-10-0x0000000000860000-0x00000000008EC000-memory.dmp upx behavioral2/memory/4728-11-0x0000000000820000-0x00000000008AC000-memory.dmp upx behavioral2/memory/4728-34-0x0000000000820000-0x00000000008AC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\50f1f0 d87e757c File opened for modification C:\Windows\47f958 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d87e757c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d87e757c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d87e757c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d87e757c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d87e757c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d87e757c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d87e757c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d87e757c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d87e757c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d87e757c - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4728 d87e757c 4728 d87e757c 4728 d87e757c 4728 d87e757c 4728 d87e757c 4728 d87e757c 4728 d87e757c 4728 d87e757c 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe Token: SeTcbPrivilege 4204 2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe Token: SeDebugPrivilege 4728 d87e757c Token: SeTcbPrivilege 4728 d87e757c
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_01ecb6291f8419379f8dfd32197aebc8_amadey_coinminer_elex_remcos_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
C:\Windows\Syswow64\d87e757cC:\Windows\Syswow64\d87e757c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d87e757c
- Size 830KB
- SHA256 53e22c9d6788c04e4840a6dc5d0d28144a9e0600a098c0254a56f29e3c367f86
- MD5 35fc1adc5a5942ff857d5e5e0ae87f21
- SHA1 70e4aa0587a89219d59e7633bf72d254b0f7b752
- SHA512 0a6952bd904820e680e984f5dfd638f0f5d806055d0a416e04783ccfad419c50c08f11e0638ec629fe91c80d2020782c82559c49c226c4420162ba52a699eef2
- SSDEEP 12288:hSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:ovO2xJKRw2kOkx2LFRvcUQPK
- TLSH T16D055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH