86386092d1a7a5ccdc9732f0327d45846c43edebeaee4cdc3107e9c87019caee

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-20_7784cbc5092bb0fa139c4e50735c5737_coinminer_elex_rhadamanthys_stop.exe
Size 715KB
Sample260920-xt97cacm7v
SHA256 86386092d1a7a5ccdc9732f0327d45846c43edebeaee4cdc3107e9c87019caee
MD5 7784cbc5092bb0fa139c4e50735c5737
SHA1 284ee7904d7a1c24671b05430e1249ca4277b5b7
SHA512 a69e6c53bca15f36dc85c1710856b95913a1c378adb81f9e7490a375cbdf9d6d5ea939f6e155380e2950051d63f2d78b4b60431869eba93508cc38db3d9d0556
SSDEEP 12288:h8uXT0uXQe5imEuhPDos5+3On/POkXM9RmwF0:h8uXTTARszW9
TLSH
T167F49D15E600E12AED9715B16DEEC758692C7FB4071830C3B2C46EAE1AB16F33B36617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/2800-0-0x0000000000400000-0x00000000004B4000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2800-0-0x0000000000400000-0x00000000004B4000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-20_7784cbc5092bb0fa139c4e50735c5737_coinminer_elex_rhadamanthys_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-20_7784cbc5092bb0fa139c4e50735c5737_coinminer_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-20_7784cbc5092bb0fa139c4e50735c5737_coinminer_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-0-0x0000000000400000-0x00000000004B4000-memory.dmp

Download