Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 08:18
Behavioral task
behavioral1
Sample
2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe
- Size 2.9MB
- Sample260913-j7clcaem2w
- SHA256 d281d20ff48b99d58fb8d779d2a01e2e4546785206ba22a81dec7f479ed00b34
- MD5 f85068a8d6bced4bce1cc8fb7f1a7883
- SHA1 e75f11214362ee1cadd236db2a18c7d109e37f02
- SHA512 f998632635639192e2abea3b87d5ff2e13ce2137b9f8ae47215c39ca374e9824331c711faae3351ecfd868a87f46c34cd98c48a365a16e7548e6655feb440456
- SSDEEP 24576:zkTzBXH3+mBW0FL8I7OD3daGEWem1gXq5L9uSWidgpm6hbpOSRKQ:ITzBXOm9wUzXq5L9uiibpJKQ
- TLSH T1F6E52A01BBA14028F9F716F689FE616C953DB9E00B24D0CB62C82AED5B25BE07D31757
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral2/memory/424-0-0x0000000000400000-0x0000000000410000-memory.dmp UPX behavioral2/memory/424-1-0x0000000000400000-0x0000000000410000-memory.dmp UPX behavioral2/memory/424-2-0x0000000000400000-0x0000000000410000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\instnm.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\systray.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\hh.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\relog.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\control.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\print.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\printui.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\raserver.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\sethc.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\comp.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\dialer.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\fontview.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\cipher.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\user.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\getmac.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\msra.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\proquota.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\choice.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\makecab.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\psr.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\reg.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SysWOW64\runas.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe -
resource yara_rule behavioral2/memory/424-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/424-1-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/424-2-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PING.EXE 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_1ac5fa16ecade80d\stordiag.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\tcmsetup.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qappsrv.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\r\IMJPDCT.EXE 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\ndadmin.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.26100.1150_none_4c8f142bf82279e1\dcomcnfg.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.26100.1301_none_6b46da31a1bd9a38\DmOmaCpMo.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_9609b71ef8d18dee\dfrgui.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\r\powershell_ise.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.26100.1591_none_5b0badbc2600416b\r\SecurityHealthSystray.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\comp.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.26100.1_none_b345269d05057414\winver.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.26100.1_none_39fcf1c342e78ddb\icacls.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.26100.1591_none_a93e455bb3388085\msoobe.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_7c2eaa615e99e234\r\IMCCPHR.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\SpatialAudioLicenseSrv.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\r\dmcertinst.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1150_none_fb8846b4a7c2bad5\netsh.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\win32calc.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_38dc86afc79cd565\reg.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAppMonitor.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..bootencodeuefi-task_31bf3856ad364e35_10.0.26100.1591_none_8f5a876d69245542\SecureBootEncodeUEFI.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandbox.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1150_none_da9d1a28d73a79cb\r\GamePanel.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_msbuild_b03f5f7f11d50a3a_4.0.15912.0_none_07ea43e35ad4fd3b\MSBuild.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1_none_1093cc6b1440f8d9\RMActivate_ssp.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\r\aspnetca.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\r\WmsManager.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\DlpUserAgent.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\setup16.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\PrintIsolationHost.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\r\slui.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\TCPSVCS.EXE 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\servicing\TrustedInstaller.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_9f7bcd3ea63a7384\grpconv.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\LiveCaptions.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.26100.1591_none_1fa6e4d8d638e827\UserOOBEBroker.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61e02e661eddd7ec\aspnet_state.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\r\VmComputeAgent.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\r\hvax64.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\r\drvinst.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\msdtc.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1_none_4bac5ff253646284\fontview.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\r\IMTCPROP.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\logoff.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrshost.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1_none_0f32fd2fa8c53bd5\rekeywiz.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.26100.1150_none_05da7b3a4b13ee64\TapiUnattend.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_d3f029e4b58d022b\iexplore.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_6650e9df0164e801\aspnet_regbrowsers.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\r\curl.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.26100.1150_none_d519484bd1dd0a29\inetinfo.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1150_none_56532b8e4ca54ecd\verifiergui.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\subst.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpshare.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVStreamingUX.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmproxyd.exe 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_f85068a8d6bced4bce1cc8fb7f1a7883_amadey_coinminer_elex_luca-stealer_memery_njrat_redline-.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:424