Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 22:53
Behavioral task
behavioral1
Sample
2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe
- Size 255KB
- Sample261102-2tzg3axvbw
- SHA256 54753b10484c617899aba287ef3819381c60968012c275b504e71b393763e545
- MD5 c8cd15a398d2f1041dbdf263c2b7f3a0
- SHA1 2ec43c6e455eed122793d46d8f4388311adc4c72
- SHA512 49831a0ceaa4286f9eaf67cda9b98e90d38c12f294bf0ba48c3f1a44652bb3de66f727d2aeddcb7eca11ad01fef55340c9c536d2032ada82237a0353402d6f34
- SSDEEP 6144:KEa0NC3/rMODyaOmRGXKeixTmAcThAkZThMTMkS9vF3AK8aixTmAcThAkZThMTM1:Kniyeix1c60yjS9vRAKrix1c60yE
- TLSH T1C0447C38E682C8ADC003D6B84276BB71667EFF13904026D57E6EF3104EBAD58E2935D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral2/memory/4056-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000200000001b2c9-4.dat UPX behavioral2/memory/4056-2328-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/memory/4056-2327-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/memory/4056-2632-0x0000000000400000-0x000000000040A000-memory.dmp UPX - Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File created \??\c:\Program Files\desktop.ini 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe -
resource yara_rule behavioral2/memory/4056-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000200000001b2c9-4.dat upx behavioral2/memory/4056-2328-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4056-2327-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4056-2632-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Asn1.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\zip.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\eo.txt 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\mk-MK\tipresx.dll.mui 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\mr-IN\tipresx.dll.mui 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\rtscom.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\msdaps.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Input.Manipulations.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\it_FEMININE.pak 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Contracts.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\prism_common.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\7-Zip\readme.txt 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\System\msadc\msadco.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Controls.Ribbon.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\mr_NEUTER.pak 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.VisualBasic.Forms.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR_NEUTER.pak 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nl_FEMININE.pak 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.TextWriterTraceListener.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jpeg.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\hy-AM\tipresx.dll.mui 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Xml.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\libGLESv2.dll 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4124 4056 WerFault.exe 86 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c8cd15a398d2f1041dbdf263c2b7f3a0_coinminer_conti_elex.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 6722⤵
- Program crash
PID:4124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4056 -ip 40561⤵PID:4144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 320KB
- SHA256 44f0816aeca805cb0b170f72430fe4160d81d4eecef3e8deb1703c78333c81c4
- MD5 c6cb2843f0e3414810ddb642b7f833b8
- SHA1 4069959e5993a95c3534deb425493e38b6e446ea
- SHA512 8178ddaa95ecabb82004a39de68b66272823a51cc0da4790207fbc81767118eb782b2fbe8edac63d9b194445ab5688669c309967c61a9bd26ed9911f5f40069c
- SSDEEP 6144:KEa0NC3/rMODyaOmRGXKeixTmAcThAkZThMTMkS9vF3AK8aixTmAcThAkZThMTMq:Kniyeix1c60yjS9vRAKrix1c60yy
- TLSH T13F649D28B681C8BDC007D6B4467ABB7162BDFF13884026C63F6EF3584E76D94E2825D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512