Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 12:40
Behavioral task
behavioral1
Sample
2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe
- Size 525KB
- Sample261009-pwh7msgv4y
- SHA256 9c771af60b0e15646bcb1a39830dc6b32d0cd1fa36b329d5c46c0dd25af01dcd
- MD5 69d4969a3f65c490b8de975dcbde8652
- SHA1 df1b60c936cfe3a6d36284c9d185afcfa4eebe78
- SHA512 96d84df3078d71168bfab354a19982158dc7f8eda61fdb954de1017958a776d0c9a62db847bdeaf1f6b54c6952aaa9ec68227109fd20349f7f658636160201ea
- SSDEEP 6144:9cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:9SvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T15CB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/300-0-0x0000000000500000-0x000000000058C000-memory.dmp UPX behavioral2/memory/3036-3-0x00000000005A0000-0x000000000062C000-memory.dmp UPX behavioral2/files/0x000900000001b2e2-2.dat UPX behavioral2/memory/300-18-0x0000000000500000-0x000000000058C000-memory.dmp UPX behavioral2/memory/3036-19-0x00000000005A0000-0x000000000062C000-memory.dmp UPX behavioral2/memory/3036-42-0x00000000005A0000-0x000000000062C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3036 e323d758 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 400 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 401 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 455 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 4 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 315 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 40 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 150 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 347 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 454 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 41 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 95 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 181 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 182 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 235 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 236 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 283 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 285 223.5.5.5 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 1 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 94 114.114.114.114 3036 e323d758 Destination IP 149 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 314 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Destination IP 346 114.114.114.114 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e323d758 File created C:\Windows\SysWOW64\e323d758 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e323d758 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e323d758 -
resource yara_rule behavioral2/memory/300-0-0x0000000000500000-0x000000000058C000-memory.dmp upx behavioral2/memory/3036-3-0x00000000005A0000-0x000000000062C000-memory.dmp upx behavioral2/files/0x000900000001b2e2-2.dat upx behavioral2/memory/300-18-0x0000000000500000-0x000000000058C000-memory.dmp upx behavioral2/memory/3036-19-0x00000000005A0000-0x000000000062C000-memory.dmp upx behavioral2/memory/3036-42-0x00000000005A0000-0x000000000062C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\33fa38 e323d758 File opened for modification C:\Windows\522d8 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e323d758 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e323d758 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e323d758 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e323d758 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e323d758 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e323d758 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e323d758 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e323d758 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e323d758 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e323d758 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e323d758 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e323d758 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3036 e323d758 3036 e323d758 3036 e323d758 3036 e323d758 3036 e323d758 3036 e323d758 3036 e323d758 3036 e323d758 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeTcbPrivilege 300 2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3036 e323d758 Token: SeTcbPrivilege 3036 e323d758
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-08_69d4969a3f65c490b8de975dcbde8652_amadey_coinminer_elex_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:300
-
C:\Windows\Syswow64\e323d758C:\Windows\Syswow64\e323d7581⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e323d758
- Size 525KB
- SHA256 fcfb056be83be1d05686c580173ee55446fceaedab4b2ac21b4be041bf9caed5
- MD5 a4e860ecf335c1c9fa7f29951e4d72c9
- SHA1 d770f520cbdac6a988c2235240664a7878eddf62
- SHA512 10a123fb1a6a385142b8352fc13460f5c7eeff7a288af4a858f92067d9d41995ec79e1fd896956353e06ec5bf3c8b5b4db5b7241f846c67b8bf8030393105dfb
- SSDEEP 6144:dcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:dSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T1BDB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH