Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 20:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 615KB
- Sample260919-yxpkgsbf53
- SHA256 ebb4ee2b129d0417e2a1f8293a6cff32c36cfa37e22d3a8951d2f9ccfe810853
- MD5 d466dc2fcf64c5d05818db9ea0ed6e4a
- SHA1 c08b1a870fbe6619dbfe789107bb17223de8525f
- SHA512 46d434d67df87dc360d3065f1a3cd1b2fb59bb010dddf04ce8c1984c10a0d42c30db2e3084c3b69b1411ae2eadfab835e4eaa0fcc2239786457d42c1e6e6650b
- SSDEEP 12288:0SvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:HvO2xJKRI2FOkx2LFicUV
- TLSH T158D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4984 79e32908 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 4 223.5.5.5 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 17 114.114.114.114 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 18 223.5.5.5 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 79e32908 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 79e32908 File created C:\Windows\SysWOW64\79e32908 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5553f0 79e32908 File opened for modification C:\Windows\63a3f8 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79e32908 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 79e32908 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 79e32908 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 79e32908 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 79e32908 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 79e32908 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 79e32908 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 79e32908 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 79e32908 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 79e32908 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 4984 79e32908 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 5820 2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 4984 79e32908 Token: SeTcbPrivilege 4984 79e32908
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-19_d466dc2fcf64c5d05818db9ea0ed6e4a_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5820
-
C:\Windows\Syswow64\79e32908C:\Windows\Syswow64\79e329081⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\5553f0
- Size 1KB
- SHA256 ca65843e3687693b74860f963a435c02d653a17b87f40a96b7d63611755aee07
- MD5 6bd7ecb63f81b3cbc55b59b5f0115fbe
- SHA1 3a25d12635e84eaa24cc225cb745629a8e6e185a
- SHA512 d8a44c1b0b023e06929b4c412c354df405b3021a001a34587cf3934814b1540d7a4fefbe33a757bb1ab6e1ba1384121e9b57ff7e12b99d8c0c5ef2dc8fb188dd
- TLSH T10F21AFF679DEC7D128EAB86975D10DEF2B24F6C6E18A002701D9A9921D032C9CC36542
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\79e32908
- Size 615KB
- SHA256 5e94f3528fe4332a2faa05244e105aa8783cf3f86dc406fa85bd75f0da903c0d
- MD5 b993fed8175b55b6f3644195d94a787d
- SHA1 431f3b2ed694406fcb5f406666f71547735d8486
- SHA512 090f9084e7b20887dc4ef311955242a68b1e82edbc404e5e7410a474866eaac26fcfbbcd10480ee4ae801d60a6d9f6f8417119bfda9e654caaf90fbd40059852
- SSDEEP 12288:ISvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:DvO2xJKRI2FOkx2LFicUV
- TLSH T17BD44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH