Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/11/2026, 16:37
Behavioral task
behavioral1
Sample
2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe
- Size 568KB
- Sample261110-t415msbs8n
- SHA256 15ec99e69a3311d9dd99758faa1be1fa63745c5c137707571495e468f3cfda97
- MD5 6e67335c26499af39c1d0ef107eb3703
- SHA1 2218ff3235409fadbcfcd3dba52bcab2416f406c
- SHA512 4d0c99162644a18c0fd1c11758ad7b7e5f2e3e626c32866fcfe3e501ba754680d46bf05b3bc74ba04c137dcb204f27da3260d9ff4dbf1287983d85c9af235a35
- SSDEEP 12288:KrIFhNGpWvLcQna/qdKnwlnGGrymiy28KU99H+ZjdEhC:WIFhNGpWvAQ0qdKnwlnGiyD8jf+chC
- TLSH T112C4AE2276D0C032E4520275D9A8E721BBB6FD614B328507B3D9BB8E1E713D2E636717
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral1/memory/4016-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral1/files/0x0002000000022b61-4.dat UPX behavioral1/memory/4016-2334-0x0000000000400000-0x000000000040A000-memory.dmp UPX - Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-939655444-3071939294-1401108526-1000\desktop.ini 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-939655444-3071939294-1401108526-1000\desktop.ini 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\desktop.ini 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe -
resource yara_rule behavioral1/memory/4016-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0002000000022b61-4.dat upx behavioral1/memory/4016-2334-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\ConnectComplete.ods 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsBase.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\tipskins.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ba.txt 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Printing.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationFramework.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\Microsoft.VisualBasic.Forms.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\msadce.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es_MASCULINE.pak 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th.pak 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Internet Explorer\SIGNUP\install.ins 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.deps.json 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Debug.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\UIAutomationProvider.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ro_MASCULINE.pak 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\bg.txt 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\pa-in.txt 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\System\ado\msadomd.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\nio.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.TraceSource.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ValueTuple.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2804 4016 WerFault.exe 83 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 4642⤵
- Program crash
PID:2804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4016 -ip 40161⤵PID:3268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 634KB
- SHA256 731b915f90b595a4662f0bb26f666b04f0d5c7409522432f318f19fc038965f7
- MD5 8b012fa79d89102db0fafe2f488186f5
- SHA1 921270b9ffb4743cda20f0e85740fcfd1e163794
- SHA512 b276fa3d55e7f0d44961ef1996fc5c5e99ede38a56e8b43ad88c33bcdcf935fd9716f63c5ecab00694534be81928f8a91293878b88789890584f59c16162c424
- SSDEEP 12288:KrIFhNGpWvLcQna/qdKnwlnGGrymiy28KU99H+ZjdEhQ:WIFhNGpWvAQ0qdKnwlnGiyD8jf+chQ
- TLSH T190D4AD2276D0C032E4520235D9A8E721B6BAFD614F728507B3D9BB8E1E713D2E636717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af.pak
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am_FEMININE.pak
- Size 23B
- SHA256 b189beaa211d90f2d81ce45beb5790fe72e9fff13dca5f46ad1461489fe59106
- MD5 b3f6ee17e4d70043651e0205fd942631
- SHA1 09659cf4c7613e3196125ecc6b491ea345993980
- SHA512 bda3d9506c22cdb0f06bc4ff08b7948530dd23dc4f39e544c604bd892ff9b73665f0bf2e7c7228e3d0fc4d72c8a285e40b71443ef57beac0df993a572626dc76
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
- Size 158B
- SHA256 4efa929dd372e5605deaa5710c04b3f40b965d6f7b7a86bca77b4d2ee73a5f10
- MD5 1323d459f0d07c80afd57cee2e786393
- SHA1 b5265613fd2648dee98f4db7c9023ce05fbe44d0
- SHA512 6f9639b80c7453cb23252b3ef142a1eac79c7fbac932da822c880402a2993df34a0f66bc6cb389c35b887d5ba1bc7a133544b2bdaec6c5528ad9e883211d1420
- TLSH T194C08C88F34C88828A4AD2385878178D69A4C4BB9A324B88144A6A94A3935A6C1D4702
- MD5 SHA1 SHA512 TLSH
