Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 07:00
Behavioral task
behavioral1
Sample
2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 801KB
- Sample260913-hs4wlsdn8s
- SHA256 27e0e5831ef45d23b03404460f6e08e0ada215f4c96221dfa75b15003c34eed9
- MD5 0815196eaf27d96957d05f880fe389a4
- SHA1 564994c19a2427fa86fa14b051d422a87ca460cd
- SHA512 0c402c976eb52c7a8f563c6713d57b88e4d0c00533008f3f900c09245844c154bf25f8394d70dec76c90141889651daabc68695462158ef55fa5c67afb01cc6d
- SSDEEP 12288:1Uqs7UXJT+GlGXd4OvXkLGHj0qTDzYUqs7UXJT+GlGXd4OvXkLGHj0qTDz1:1Uqs0NFGmA0UTPYUqs0NFGmA0UTP
- TLSH T162059E2172C0C0B1D86311B046AD97B18BBAB8711B7197CF6B8A4BB64F356D19F3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 8 IoCs
resource yara_rule behavioral2/memory/4540-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/4540-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/4540-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/4540-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/4540-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/4540-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/4540-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/4540-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ARP.EXE 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\resmon.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\finger.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\net.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\psr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\subst.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\attrib.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\notepad.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\compact.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\curl.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\regini.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\cipher.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\fc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe -
resource yara_rule behavioral2/memory/4540-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4540-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4540-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4540-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4540-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4540-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4540-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4540-7-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\r\LockAppHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.26100.1150_none_3d0419d754916346\wslconfig.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_bb53ccdac90dda7a\RegAsm.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\r\explorer.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.26100.1_none_2fa847710e86cbe0\icacls.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmBroker.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\CredentialUIBroker.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\mspaint.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\perfmon.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\r\ManagedWindowsVM.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1_none_5459e3b4a959687e\bitsadmin.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PATHPING.EXE 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-whoami_31bf3856ad364e35_10.0.26100.1_none_d5c4d1091ec38541\whoami.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1150_none_4572dc061ff88008\iissetup.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\WMIADAP.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFaultSecure.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\upnpcont.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.100_none_f29d806b561540f6\ngen.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.26100.1150_none_1c37124e142944f8\DiskSnapshot.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qappsrv.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1591_none_ad4f10ed27892462\TabTip.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.26100.1_none_f69d03cd957c2a05\systeminfo.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\hnsdiag.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_989a65f2aef55b28\ShellExperienceHost.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_5da82f9be48ad513\upnpcont.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.0_none_b4e0bc75d19eec35\ngen.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\r\mmc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\Speech\Common\sapisvr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1150_none_6adbcfcc35357e97\wiaacmgr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_9187ca465243b700\schtasks.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\r\GameInputSvc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\r\cleanmgr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.26100.1591_none_2c8539fa8a63de14\DataStoreCacheDumpTool.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\r\CloudNotifications.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1150_none_9f6738de73cf4ce3\dpnsvr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\r\WpcTok.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\Magnify.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-upprinterinstaller_31bf3856ad364e35_10.0.26100.1150_none_4ef2fca3d76b94b2\r\UPPrinterInstaller.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_b17acfc36f0ec944\r\runonce.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\IMTCLNWZ.EXE 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\mspaint.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\UserAccountBroker.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\fsquirt.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7161e3793d394d15\sc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.26100.1_none_92f5fcf757ed42ed\vbc.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..bootencodeuefi-task_31bf3856ad364e35_10.0.26100.1591_none_8f5a876d69245542\SecureBootEncodeUEFI.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\coredpussvr.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15912.0_none_53903386cd9b843e\cvtres.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15912.0_none_73fd08cefdd719a5\RegAsm.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1_none_36c64bb72fffb46a\Dism.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_13357425571b7ed9\OpenWith.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_ca90d4b7666bc2e5\r\appidtel.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\IMEPADSV.EXE 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\r\DsmUserTask.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1150_none_a3d1faf3bbc1c7d8\r\rekeywiz.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpconfig.exe 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_0815196eaf27d96957d05f880fe389a4_coinminer_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4540