Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 04:19
Behavioral task
behavioral1
Sample
2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 4.1MB
- Sample260913-exmlcafa45
- SHA256 22ba70cf06cce9d0e48a5413607fa784691f5bdaa4f2f1e64e5aa423729edb6e
- MD5 2d3928119df05926d935e3df8e9abaf1
- SHA1 31f2508b4f5016d3e9e61f60237ca8c81295cc90
- SHA512 3d5bd54de3dd9efee1d3a69d74ab0816a1d4565034a57773eafc7448e9ec169e0310703df576837a841f10a0e36849943501d8eb4b43b7beb08ae4652b769960
- SSDEEP 49152:o5dlen0UTT5dlen0UTF5dlen0UTT5dlen0UTl+VsZJYJCHeGEFnbX1GDNsyE:o5nOr5nOt5nOr5nOQJ5bkDJE
- TLSH T1C7163A10A7E7A636ECA336F454B683A14775BE221B35D1CF5A82366DCD307C29A30376
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 11 IoCs
resource yara_rule behavioral2/memory/3704-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3704-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\netsh.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\fc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\getmac.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\logagent.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\msra.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\sudo.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\instnm.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\PING.EXE 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\newdev.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\replace.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\setup16.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\wextract.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\print.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\takeown.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\compact.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SysWOW64\sethc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe -
resource yara_rule behavioral2/memory/3704-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3704-10-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1_none_5449f71c20d1e235\at.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_51f923c23ace47fd\r\msdt.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiFileFetcher.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\licensingdiag.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAppMonitor.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.26100.1591_none_5ae89417c15099f2\r\CompatTelRunner.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\fsutil.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\r\HealthAttestationClientAgent.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\r\iotstartup.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\containerworker.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\r\sort.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.26100.1591_none_5b0badbc2600416b\r\SecurityHealthSystray.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\r\bootsect.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\csvde.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.26100.1_none_e3755908c2899c00\VaultCmd.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_55053aa4ab175950\CheckNetIsolation.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_4deff3472ce5cb34\IMJPSET.EXE 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\setupugc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFaultSecure.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\r\PresentationSettings.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5e775e7a6735dc2c\label.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.26100.1150_none_f1b736c7de0a2b05\CExecSvc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuaucltcore.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.26100.1_none_c811e1884be875a8\AddInUtil.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_ad1d52a56b0a48f7\WsatConfig.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_824861107299001b\r\imecfmui.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\WerFaultSecure.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1_none_e42fc57779c55fcd\cmdkey.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\r\wbengine.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\r\IMEPADSV.EXE 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\dvdplay.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-pkcs11-helper.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\SearchHost.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\r\mspaint.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1_none_4b6c4168906f5df6\dllhst3g.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1_none_2e77de14f6a20404\findstr.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_a8be556815a4e811\r\Utilman.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\MoUsoCoreWorker.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.26100.1742_none_46ef5cca15f489f9\RMActivate.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\r\CredentialUIBroker.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\r\dvdplay.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\r\ctfmon.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_530ca0a73ce97b04\ftp.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.26100.1150_none_7e5b72d9f82ad1d1\hdwwiz.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_a7c632dbdc1d61bb\w3wp.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.27000.360_none_db37a096a5a2d301\vbc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\MicrosoftEdgeDevTools.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\r\vfpctrl.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.26100.1150_none_066fd0a833dca900\r\provlaunch.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUxStub.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_c6fec8639b4d0909\r\sfc.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.27000.360_none_f51d83e935d81a1d\aspnet_regiis.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\CustomInstallExec.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrm.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.26100.1_none_ec48597b611b680a\systeminfo.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\containerworker.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15912.0_none_feb4ea54186c4c66\AddInUtil.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\Defrag.exe 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_2d3928119df05926d935e3df8e9abaf1_amadey_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3704