Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 14:56
Behavioral task
behavioral1
Sample
2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe
- Size 548KB
- Sample261011-sa5ejas1e1
- SHA256 09afa46b4e3eb1b127d2cceabcf410b13db25b7a4f1b6d2e0a8cb46a47cf0c45
- MD5 4ae7d216f59220ed0655bff0addc4cdf
- SHA1 b85ee61823045176916e2bbbd8f6016822314873
- SHA512 ea900ee9c619958923b6e246e16770e445442e37784d54fba40b7f7dff8c608341248bb9bf16142f3b30300a0ce308c61e330bf4c449c20a4af598f80579273c
- SSDEEP 12288:2kbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:fbOgbEqy9RKejHPOwOkx2LF
- TLSH T114C4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/4768-0-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral2/memory/3028-3-0x0000000000030000-0x00000000000B9000-memory.dmp UPX behavioral2/files/0x0009000000019cb3-2.dat UPX behavioral2/memory/4768-25-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral2/memory/3028-27-0x0000000000030000-0x00000000000B9000-memory.dmp UPX behavioral2/memory/3028-28-0x0000000000030000-0x00000000000B9000-memory.dmp UPX behavioral2/memory/3028-34-0x0000000000030000-0x00000000000B9000-memory.dmp UPX behavioral2/memory/4768-55-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral2/memory/3028-56-0x0000000000030000-0x00000000000B9000-memory.dmp UPX behavioral2/memory/4768-57-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral2/memory/4768-61-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral2/memory/4768-64-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral2/memory/4768-69-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral2/memory/4768-72-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral2/memory/4768-76-0x0000000000810000-0x0000000000899000-memory.dmp UPX behavioral2/memory/4768-77-0x0000000000810000-0x0000000000899000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3028 cfb33df7 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 323 223.5.5.5 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 3 114.114.114.114 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 5 223.5.5.5 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 40 114.114.114.114 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 95 114.114.114.114 3028 cfb33df7 Destination IP 125 114.114.114.114 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 235 114.114.114.114 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 236 223.5.5.5 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 293 223.5.5.5 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 41 223.5.5.5 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 96 223.5.5.5 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 182 223.5.5.5 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 322 114.114.114.114 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 376 114.114.114.114 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 377 223.5.5.5 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 181 114.114.114.114 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 292 114.114.114.114 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Destination IP 127 223.5.5.5 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\cfb33df7 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cfb33df7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cfb33df7 -
resource yara_rule behavioral2/memory/4768-0-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral2/memory/3028-3-0x0000000000030000-0x00000000000B9000-memory.dmp upx behavioral2/files/0x0009000000019cb3-2.dat upx behavioral2/memory/4768-25-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral2/memory/3028-27-0x0000000000030000-0x00000000000B9000-memory.dmp upx behavioral2/memory/3028-28-0x0000000000030000-0x00000000000B9000-memory.dmp upx behavioral2/memory/3028-34-0x0000000000030000-0x00000000000B9000-memory.dmp upx behavioral2/memory/4768-55-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral2/memory/3028-56-0x0000000000030000-0x00000000000B9000-memory.dmp upx behavioral2/memory/4768-57-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral2/memory/4768-61-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral2/memory/4768-64-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral2/memory/4768-69-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral2/memory/4768-72-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral2/memory/4768-76-0x0000000000810000-0x0000000000899000-memory.dmp upx behavioral2/memory/4768-77-0x0000000000810000-0x0000000000899000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\51a140 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\33d728 cfb33df7 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname cfb33df7 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain cfb33df7 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfb33df7 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cfb33df7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cfb33df7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cfb33df7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cfb33df7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cfb33df7 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cfb33df7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cfb33df7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cfb33df7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cfb33df7 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 3028 cfb33df7 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Token: SeTcbPrivilege 4768 2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe Token: SeDebugPrivilege 3028 cfb33df7 Token: SeTcbPrivilege 3028 cfb33df7
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_4ae7d216f59220ed0655bff0addc4cdf_amadey_coinminer_elex_graphican_rhadamanthys_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
C:\Windows\Syswow64\cfb33df7C:\Windows\Syswow64\cfb33df71⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\33d728
- Size 916B
- SHA256 7061e02b9b7af85fccacec8930efdd2a945f60b79836e195cd86195dc7329c60
- MD5 330bd0fcba7876a85cd1597c488f2b3d
- SHA1 dac40bf32b89b6ad1573a94a5d4c3eca771f23ca
- SHA512 25be81a850a5d52b5af14a664db147424c718d9673cead0601ba6f2c1bec1fefd219cefc0cd0e993966d4eef422a072e714f4405da2b1e061c7d68df65931992
- TLSH T1DF113A735E8DD5E07DD88166F1E1BECC6930A449CEDD015E09C2199212B2FA9E582427
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\cfb33df7
- Size 548KB
- SHA256 89bf56ef84405d1d82775603be921e87854d05d6c564fb463e9bb4f44eaeaa78
- MD5 27a26ddf5cd1727086f73b1b9d49e591
- SHA1 7863414ef735f60f0a7b40e4f62af6e338f8da14
- SHA512 22547057557f1cbab41e2c6fa7574960c51dfcfc8da740ab90f019ce4cdabc54239673d601e54ef7e30db73b0df85167a9e3bebb64b090c617350ff224f7d334
- SSDEEP 12288:7kbOgbKcMoxy9RLW3uqXUHkUXe39+Okx2LIa:AbOgbEqy9RKejHPOwOkx2LF
- TLSH T119C4AE26F6A0C032C4B79574C4A34AAAFBB1742167204ACFA395475A1F737E2BE3531D
- MD5 SHA1 SHA512 SSDEEP TLSH