Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 19:23
Behavioral task
behavioral1
Sample
2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe
- Size 282KB
- Sample261027-x3274atz4m
- SHA256 2dd6b04061b6b6a6e0ca3405e4624865ac60e581f23b8d8b6148d01f006012e2
- MD5 ffa5f89a62cc3a3d18e1dbcd803c8410
- SHA1 0603779a32ff414dfd8d9934e7d2d7bcec8f82a7
- SHA512 7e323ac373bff9e4dfc8ee46ae899618308ef4bdd1947dcb0f64d193716c603eb16eafa52f2cbc83281f1c3577431e650b2bec1b2ece70d41f17309cee3638df
- SSDEEP 6144:KEFRzQjFhNGpWcIhTyuwJuxtxujXabuFhNGpWU:KKRzqFhNGpW9TUJuxtxujXabuFhNGpWU
- TLSH T1BD54D591B5A16D11D864063BE7E85000AA7CBCAB43FE80FE38CE35654B7DD96173BB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral2/memory/3212-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000200000001b221-4.dat UPX behavioral2/memory/3212-2669-0x0000000000400000-0x000000000040A000-memory.dmp UPX - Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File created \??\c:\Program Files\desktop.ini 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File created \??\c:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe -
resource yara_rule behavioral2/memory/3212-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000200000001b221-4.dat upx behavioral2/memory/3212-2669-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\7-Zip\Lang\mng2.txt 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Mail.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Json.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\lib\dt.jar 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ne-NP\tipresx.dll.mui 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-PT_FEMININE.pak 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\7-Zip\7z.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\System\ado\msado21.tlb 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clrgc.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Xaml.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Forms.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_FEMININE.pak 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoCanary.png 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\uz-cyrl.txt 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\7-Zip\readme.txt 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Channels.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\PresentationUI.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\zip.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-GB_FEMININE.pak 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr_FEMININE.pak 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\te_MASCULINE.pak 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5844 3212 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_ffa5f89a62cc3a3d18e1dbcd803c8410_coinminer_conti_elex.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 7642⤵
- Program crash
PID:5844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3212 -ip 32121⤵PID:5556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 347KB
- SHA256 0a15896c9d857822ff7ed59f59cea16846412a097b0ca8612dc4ffb39d184c0e
- MD5 69ffb9ed75d666a598c48aff3e42fb17
- SHA1 cfb99a8adfc848fb64655dbe5d8d58ab85c74b98
- SHA512 e1c55aaa6cf27497b07db2ce04eed6c4ffab745d513dbeb3cd5909305172c764d495ea257386b164201d60a025a573390a10ed1cbde7b734ae53921a6a8d9237
- SSDEEP 6144:KEFRzQjFhNGpWcIhTyuwJuxtxujXabuFhNGpWpsRz/Y:KKRzqFhNGpW9TUJuxtxujXabuFhNGpWi
- TLSH T17F741941B5E06D21D964073BE7E850006A7CBCAB47FE80EA38CD365A4B7DD96533BB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\lib\jvm.lib
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif
- Size 158B
- SHA256 4efa929dd372e5605deaa5710c04b3f40b965d6f7b7a86bca77b4d2ee73a5f10
- MD5 1323d459f0d07c80afd57cee2e786393
- SHA1 b5265613fd2648dee98f4db7c9023ce05fbe44d0
- SHA512 6f9639b80c7453cb23252b3ef142a1eac79c7fbac932da822c880402a2993df34a0f66bc6cb389c35b887d5ba1bc7a133544b2bdaec6c5528ad9e883211d1420
- TLSH T194C08C88F34C88828A4AD2385878178D69A4C4BB9A324B88144A6A94A3935A6C1D4702
- MD5 SHA1 SHA512 TLSH
