Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 04:24
Behavioral task
behavioral1
Sample
2026-10-10_b82665eb84633df894aa7ce13cc940aa_coinminer_elex_stop.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
General
- Target 2026-10-10_b82665eb84633df894aa7ce13cc940aa_coinminer_elex_stop.exe
- Size 700KB
- Sample261011-e1kwxsdx8l
- SHA256 2248b05bd00b102c579bf4356cd03912e3117876f5fdd22027b57bfb2424c2f3
- MD5 b82665eb84633df894aa7ce13cc940aa
- SHA1 d006e864c6e5c2d96fbcfbf1885a72c66db83fdf
- SHA512 b23ebac4af1de84b130b630e6d0782f52d9610875f4b3340f43b1dedf678d41c40febc37259b56077ff5a35ad89bd82706466ebd02df83f53deaae4f31674756
- SSDEEP 6144:Gpqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcZwsli:GpqiC/2OGAtkCP4cejGSOpRKP0G6qy
- TLSH T196E49E02B7C680F6D89339711577E32AEB3979154336CA9BEFE02D668E114709E3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/5076-0-0x0000000000400000-0x00000000004B1000-memory.dmp UPX behavioral2/memory/5076-2-0x0000000000400000-0x00000000004B1000-memory.dmp UPX - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5076-0-0x0000000000400000-0x00000000004B1000-memory.dmp autoit_exe behavioral2/memory/5076-2-0x0000000000400000-0x00000000004B1000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/5076-0-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral2/memory/5076-2-0x0000000000400000-0x00000000004B1000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-10_b82665eb84633df894aa7ce13cc940aa_coinminer_elex_stop.exe