Overview

overview

3

Static

static

3

2026-11-01...op.exe

windows10-2004-x64

3

2026-11-01...op.exe

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 04:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_e7424752a9df3ce8faa21ef1f4b34152_coinminer_elex_stop.exe
  • Size 4.7MB
  • Sample261102-fmch3ahs7q
  • SHA256 0d63f726334005e6655a4a9f5c91fef857921aa301ca17af47c96580e6842059
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_e7424752a9df3ce8faa21ef1f4b34152_coinminer_elex_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_e7424752a9df3ce8faa21ef1f4b34152_coinminer_elex_stop.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5000

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        00[1].svg
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2650NSE1\00[1].svg
        • Size 275B
        • SHA256 c31cd254d7ac2324370d5c0800374c6aed090e92ae4bc731e9dfd5db02e6c3d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0db30b[1].svg
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2650NSE1\0db30b[1].svg
        • Size 9KB
        • SHA256 cddb79f6626da3cde1a2f673071f2badc5e85f0ae3bea3c640c232500da84bb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        boot.fb167a[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2650NSE1\boot.fb167a[1].js
        • Size 159KB
        • SHA256 302e2e1404f1f21b37fdc15058fddff9b849af2f6f1971303b7bcd02bf5b5208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bat[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5TOXJMFV\bat[1].js
        • Size 57KB
        • SHA256 0bcd6648aa08d4e38de85f22b0ce0aa53b5dd757e763006d7bb6aee2e4e279d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        loader[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5TOXJMFV\loader[1].js
        • Size 207KB
        • SHA256 3d6d671515cf8a5de88ff859c92dc32e93b362a47d81c7c31432ea86d4da0136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1b2209[1].svg
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A8BWWIVW\1b2209[1].svg
        • Size 7KB
        • SHA256 66b95455094fd2fffda92b21e4ba5cc80983c2b3f1e4b45bdf1ab7e4c834e506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gtm[1].js
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\A8BWWIVW\gtm[1].js
        • Size 624KB
        • SHA256 3c47c55df265d0508618094725aca39b1d9baef5114921efc32b65dc92a38f07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        046876[1].svg
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E8WK4YG5\046876[1].svg
        • Size 2KB
        • SHA256 db992039b9b61b35592675a5fbd93f8bb6e101747d0485b807911b88d922fa2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/5000-0-0x0000000000400000-0x00000000008BC000-memory.dmp
        Download