Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 04:19
Behavioral task
behavioral1
Sample
2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 4.1MB
- Sample260913-exmlcafa45
- SHA256 22ba70cf06cce9d0e48a5413607fa784691f5bdaa4f2f1e64e5aa423729edb6e
- MD5 2d3928119df05926d935e3df8e9abaf1
- SHA1 31f2508b4f5016d3e9e61f60237ca8c81295cc90
- SHA512 3d5bd54de3dd9efee1d3a69d74ab0816a1d4565034a57773eafc7448e9ec169e0310703df576837a841f10a0e36849943501d8eb4b43b7beb08ae4652b769960
- SSDEEP 49152:o5dlen0UTT5dlen0UTF5dlen0UTT5dlen0UTl+VsZJYJCHeGEFnbX1GDNsyE:o5nOr5nOt5nOr5nOQJ5bkDJE
- TLSH T1C7163A10A7E7A636ECA336F454B683A14775BE221B35D1CF5A82366DCD307C29A30376
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 14 IoCs
resource yara_rule behavioral1/memory/3172-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/files/0x00010000000081ea-13.dat UPX behavioral1/memory/3172-28-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-30-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-31-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3172-33-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\bthudtask.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\net1.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\cttune.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\whoami.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\regini.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\winver.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\label.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\tar.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\doskey.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\psr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\setx.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\icacls.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\regedit.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\dccw.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\runas.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\systray.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\PING.EXE 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe -
resource yara_rule behavioral1/memory/3172-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x00010000000081ea-13.dat upx behavioral1/memory/3172-28-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-30-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-31-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3172-33-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\Microsoft.Uev.CscUnpinTool.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\r\BioIso.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.1_none_c3249fe181844dfb\MsSpellCheckingHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\WindowsSandbox.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.19041.1_none_fad576d8cf74b38a\dispdiag.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\msoobe.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\LsaIso.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\r\DataStoreCacheDumpTool.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_ac711518659a66a5\ComSvcConfig.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\NETSTAT.EXE 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_6331d348ae4a8fa9\TiFileFetcher.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\f\pcalua.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\WerFaultSecure.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1_none_0e98e5367a9d834f\mighost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\wscadminui.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\tpmvscmgrsvr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_fe5852f864c5941f\wermgr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\r\auditpol.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.84_none_cbe289218fb48371\f\wsqmcons.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchFilterHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_eddf8132c42e0857\AssignedAccessLockApp.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\f\msconfig.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\sxstrace.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\f\WSManHTTPConfig.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.19041.1_none_a541e711f3b2a478\mobsync.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.1266_none_14b8c34dbc1df417\runexehelper.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_d38e81565538dedf\logagent.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.19041.1_none_8a1c4327a89528e3\help.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\imecfmui.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\f\diskpart.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1_none_f35caf2131abed9a\lsass.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.1_none_37ab35f7e4b21a45\PrintBrmUi.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.1202_none_05856bbd8f935e6b\r\DataStoreCacheDumpTool.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_vmconnect6.2_31bf3856ad364e35_10.0.19041.1_none_5c4aee22bbc45ef1\vmconnect6.2.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_f23fc9b9908be4fc\iexpress.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\wdagtool.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\BioIso.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_48cfaff3d4e720e6\ktmutil.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\VmComputeAgent.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\LockScreenContentServer.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_b1e0044e8cab889e\setupugc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\fontdrvhost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\auditpol.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\fontdrvhost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adaminstall.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\HvsiSettingsWorker.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1202_none_d965e0f65a4ddcdf\f\BdeUISrv.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.1_none_bafc9f61651f37d2\SystemUWPLauncher.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\TRACERT.EXE 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.1266_none_d375b5361b806b32\r\WpcTok.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_da5b9e6604736fbe\IEChooser.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_684a86f0f0d0d27d\mountvol.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1_none_71d70fbd497cca66\Windows.Media.BackgroundPlayback.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\f\StartMenuExperienceHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_3f7ee0a8ee28ef7d\r\netiougc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.19041.1_none_e51212a36c631d23\CasPol.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\SysResetErr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.19041.1_none_68bc95ae68779efe\jsc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\f\nvspinfo.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.19041.789_none_b38221af158e5881\EDPCleanup.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browser_broker.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.19041.1_none_83ab1c56c187ef65\Windows.WARP.JITService.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3172
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 6.9MB
- SHA256 10e53cf6315f2ba8b868f1b5ea901e5a8c0c678eb60dc9c165f417aa624b8106
- MD5 4cbfaf9ff0cd1f14bf114b22f87920a3
- SHA1 55d0662937c7a566dc97298365ec615c8f0ab48d
- SHA512 c6970bfd4d6f7dc2e1e5c5398701a77f2e2c3cf0339346acd3e136e31126e11b93759a9a5418650fa188740389bed735b5ff81a2c70bd8a46fb6a860af81b591
- SSDEEP 98304:o5nOr5nOt5nOr5nOQJ5bkDJr5CbhLajkWHEsr37:w4a4T7kD5KhLajki
- TLSH T139768C11A7F791B2DCA7B0B844768762D7717D194B31E1CF4A82662E8F327D29E34322
- MD5 SHA1 SHA512 SSDEEP TLSH