Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 19:24
Behavioral task
behavioral1
Sample
2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe
- Size 738KB
- Sample261102-x4lazacy2x
- SHA256 71541be38396807c9e449be364f4aa553c4290d3cd2dbcfaae2aa50b8c16f20d
- MD5 e9992d4ad972aba832949843045f745f
- SHA1 2f190fabaa12a21027d36230d0401eb815b9c8bb
- SHA512 6fa7c442edd480f0421f9194eef7784985583d4d010e5226ceb93b5ab2e143320e0586e41a99fbb3c266bda5841f5bb95946d49af34f46af106999a15f1d9137
- SSDEEP 12288:PaWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:SaHMv6Corjqnyz3/06
- TLSH T15AF4AF12B7D680B6D99338752A7BE32BEB3576190327C4D7ABE02D778F211405A3B361
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral2/memory/1952-0-0x0000000000400000-0x00000000004B7000-memory.dmp UPX behavioral2/files/0x000d00000001c49c-20.dat UPX behavioral2/memory/2192-30-0x0000000000400000-0x00000000004B7000-memory.dmp UPX behavioral2/memory/2192-29-0x0000000000400000-0x00000000004B7000-memory.dmp UPX behavioral2/memory/1952-31-0x0000000000400000-0x00000000004B7000-memory.dmp UPX behavioral2/memory/2192-32-0x0000000000400000-0x00000000004B7000-memory.dmp UPX behavioral2/memory/2192-33-0x0000000000400000-0x00000000004B7000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 2192 tcpscrex.exe - AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1952-0-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral2/files/0x000d00000001c49c-20.dat autoit_exe behavioral2/memory/2192-30-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral2/memory/2192-29-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral2/memory/1952-31-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral2/memory/2192-32-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral2/memory/2192-33-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/1952-0-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/files/0x000d00000001c49c-20.dat upx behavioral2/memory/2192-30-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2192-29-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1952-31-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2192-32-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2192-33-0x0000000000400000-0x00000000004B7000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Managemenot\Monitor\tcpscrex.exe 2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe File opened for modification C:\Program Files\Managemenot\Monitor\tcpscrex.exe 2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe File created C:\Program Files (x86)\Activxr\Rescuer.exe tcpscrex.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tcpscrex.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain tcpscrex.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tcpscrex.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe 2192 tcpscrex.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2192 1952 2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_e9992d4ad972aba832949843045f745f_agent-tesla_backswap_coinminer_elex_stop.exe"1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files\Managemenot\Monitor\tcpscrex.exe"C:\Program Files\Managemenot\Monitor\tcpscrex.exe" 0.0.0.02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2192
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Managemenot\Monitor\tcpscrex.exe
- Size 738KB
- SHA256 724b4cacf057c52e7a644219ad31c10c8ba915bdb43cdb2eb02bca3337d2376e
- MD5 5717a0130a2e2c68f960ccad0de998cb
- SHA1 f430b0cc97a970452c8640be9a5fcc3ddd76b3a5
- SHA512 0013778271953650908243609d070f0d67ad98a63470a722c2befeae9d5488c03ae1957bce3881b825e4ae8e5f6c4b55c8a63336de3b48f76624cecc7112b7af
- SSDEEP 12288:DaWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:maHMv6Corjqnyz3/06
- TLSH T16CF4AF12B7D680B6D9933875297BE32BEB3576190327C4D7ABE02D778F211405A3B361
- MD5 SHA1 SHA512 SSDEEP TLSH