Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 07:00
Behavioral task
behavioral1
Sample
2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 801KB
- Sample260913-hs4wlsdn8s
- SHA256 27e0e5831ef45d23b03404460f6e08e0ada215f4c96221dfa75b15003c34eed9
- MD5 0815196eaf27d96957d05f880fe389a4
- SHA1 564994c19a2427fa86fa14b051d422a87ca460cd
- SHA512 0c402c976eb52c7a8f563c6713d57b88e4d0c00533008f3f900c09245844c154bf25f8394d70dec76c90141889651daabc68695462158ef55fa5c67afb01cc6d
- SSDEEP 12288:1Uqs7UXJT+GlGXd4OvXkLGHj0qTDzYUqs7UXJT+GlGXd4OvXkLGHj0qTDz1:1Uqs0NFGmA0UTPYUqs0NFGmA0UTP
- TLSH T162059E2172C0C0B1D86311B046AD97B18BBAB8711B7197CF6B8A4BB64F356D19F3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/2800-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2800-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2800-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2800-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/files/0x00010000000081ea-9.dat UPX behavioral1/memory/2800-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2800-26-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2800-27-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2800-28-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msiexec.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\setup16.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\takeown.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\systray.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\write.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\recover.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\cscript.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\explorer.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\reg.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\regini.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\regedit.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\sfc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\charmap.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\convert.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\autochk.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\fontview.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\dccw.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\instnm.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\tar.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe -
resource yara_rule behavioral1/memory/2800-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2800-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2800-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2800-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x00010000000081ea-9.dat upx behavioral1/memory/2800-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2800-26-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2800-27-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2800-28-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseCncProxy.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\f\SearchFilterHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.1_none_8c3bd3e771e9a0d5\mmgaserver.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1202_none_d965e0f65a4ddcdf\f\BdeUISrv.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\f\LaunchTM.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.19041.1_none_a2b9da391bff31c4\hdwwiz.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\f\agentactivationruntimestarter.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.746_none_61e0347e850155a8\UserOOBEBroker.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\HOSTNAME.EXE 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\ClipUp.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\isoburn.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.1_none_d7372edf29e45655\LanguageComponentsInstallerComHandler.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1202_none_7d4ea219d613c9d8\r\TpmTool.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.789_none_9beee4eb02a5f8c7\r\Narrator.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.1202_none_d081cba554088913\slui.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7\MpCmdRun.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.1_none_75cabfc3071adb42\certutil.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\r\FileHistory.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.1_none_21cb4db26317f32e\netiougc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\f\DismHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\SystemSettingsAdminFlows.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\user.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\f\diskpart.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_3e7b05a1a0865eeb\ktmutil.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\wmpconfig.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e\r\ntoskrnl.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\r\SensorDataService.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\qprocess.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.746_none_5cc81a54cf095c95\f\EASPolicyManagerBrokerHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\iexplore.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\TSTheme.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.19041.1_none_ba28e703f717d172\wlanext.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_4e193eb76ed5f8cb\wiaacmgr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\r\ImeBroker.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\imjpuexc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.1_none_1ec972de354a6d3f\diskpart.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.19041.1_none_8ddc3834fb6f659f\iscsicpl.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1288_none_91a5fb477b6af5a0\r\SIHClient.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\wbengine.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_ee822d264112a470\powershell_ise.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_4b1a1978d1832a5f\OpenWith.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15805.0_none_1bb0d4ac7da3bfe1\ngentask.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\f\VmComputeAgent.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.19041.1_none_da52541188969d5e\mcbuilder.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\winresume.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\r\winresume.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsirdpclient.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.19041.1_none_de83be952b0afb6a\RecoveryDrive.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.19041.1_none_9ed23f0cea1bf54e\DeviceEject.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_15114cf4ffe3136a\cmdl32.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_25afcd12036f5605\RMActivate_ssp.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.153_none_dac5d96a5dc8a9ab\ShellExperienceHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_9fa94241ef63ceb4\wermgr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\f\msra.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.1288_none_1126d5c5c1f1669c\mfpmp.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\r\desktopimgdownldr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_ce6643a69c39f80a\ThumbnailExtractionHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\r\msinfo32.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\r\adamsync.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\LsaIso.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\r\LsaIso.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\f\UNPUXHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\vmms.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 3.6MB
- SHA256 4f7858731f8d4f9869f409f6ef432cdce5589c3bb75ed4aa5c32f8c2137fddf5
- MD5 be0960dda5c67f7f9a821b9f400ae664
- SHA1 f08a789ecfbc88cb79393f2fa513a0f3f42654be
- SHA512 95cc84760ec23c6e9b603e585f2465789947ad3eb7aab88ef753168c8f91f84a689f114f831cc57965156375c6bbea4c03ccb2e47da7139965fdd067f0a0868f
- SSDEEP 49152:4n0UTXn0UTaCG8qJpuUcmUmujq2r8gr/vrhLO+vKXjZJP71IFWdzWQECq8r37UnR:cPi5CbhLajkWHEsr37
- TLSH T172067C16A7A880E5C0AAC0BD8667EA12F6B27C0D8730B6D70A91567B1F377E05F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH