Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 16:37
Behavioral task
behavioral1
Sample
2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe
- Size 568KB
- Sample261110-t415msbs8n
- SHA256 15ec99e69a3311d9dd99758faa1be1fa63745c5c137707571495e468f3cfda97
- MD5 6e67335c26499af39c1d0ef107eb3703
- SHA1 2218ff3235409fadbcfcd3dba52bcab2416f406c
- SHA512 4d0c99162644a18c0fd1c11758ad7b7e5f2e3e626c32866fcfe3e501ba754680d46bf05b3bc74ba04c137dcb204f27da3260d9ff4dbf1287983d85c9af235a35
- SSDEEP 12288:KrIFhNGpWvLcQna/qdKnwlnGGrymiy28KU99H+ZjdEhC:WIFhNGpWvAQ0qdKnwlnGiyD8jf+chC
- TLSH T112C4AE2276D0C032E4520275D9A8E721BBB6FD614B328507B3D9BB8E1E713D2E636717
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4068-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000300000001b2d0-4.dat UPX behavioral2/memory/4068-2603-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/memory/4068-2604-0x0000000000400000-0x000000000040A000-memory.dmp UPX - Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-4057491610-3392471755-192832105-1000\desktop.ini 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-4057491610-3392471755-192832105-1000\desktop.ini 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\desktop.ini 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe -
resource yara_rule behavioral2/memory/4068-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000300000001b2d0-4.dat upx behavioral2/memory/4068-2603-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4068-2604-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ar_NEUTER.pak 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.ThreadPool.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el.pak 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ta_FEMININE.pak 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\pa-in.txt 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-US_FEMININE.pak 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.UnmanagedMemoryStream.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\WindowsFormsIntegration.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\hi-IN\tipresx.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\tr_NEUTER.pak 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\LICENSE 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.Intelligence.TextInput.Implementation.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\System\Ole DB\msdasql.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tools.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Csp.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationTypes.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\WindowsFormsIntegration.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Input.Manipulations.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationCore.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi_MASCULINE.pak 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\tipresx.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\sv.txt 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\mshwstaging.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Json.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Controls.Ribbon.resources.dll 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1060 4068 WerFault.exe 89 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_6e67335c26499af39c1d0ef107eb3703_coinminer_conti_elex_rhadamanthys_stop.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 8642⤵
- Program crash
PID:1060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4068 -ip 40681⤵PID:4504
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 634KB
- SHA256 731b915f90b595a4662f0bb26f666b04f0d5c7409522432f318f19fc038965f7
- MD5 8b012fa79d89102db0fafe2f488186f5
- SHA1 921270b9ffb4743cda20f0e85740fcfd1e163794
- SHA512 b276fa3d55e7f0d44961ef1996fc5c5e99ede38a56e8b43ad88c33bcdcf935fd9716f63c5ecab00694534be81928f8a91293878b88789890584f59c16162c424
- SSDEEP 12288:KrIFhNGpWvLcQna/qdKnwlnGGrymiy28KU99H+ZjdEhQ:WIFhNGpWvAQ0qdKnwlnGiyD8jf+chQ
- TLSH T190D4AD2276D0C032E4520235D9A8E721B6BAFD614F728507B3D9BB8E1E713D2E636717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg_NEUTER.pak
- Size 23B
- SHA256 b189beaa211d90f2d81ce45beb5790fe72e9fff13dca5f46ad1461489fe59106
- MD5 b3f6ee17e4d70043651e0205fd942631
- SHA1 09659cf4c7613e3196125ecc6b491ea345993980
- SHA512 bda3d9506c22cdb0f06bc4ff08b7948530dd23dc4f39e544c604bd892ff9b73665f0bf2e7c7228e3d0fc4d72c8a285e40b71443ef57beac0df993a572626dc76
- MD5 SHA1 SHA512
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\cs.pak
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
- Size 158B
- SHA256 4efa929dd372e5605deaa5710c04b3f40b965d6f7b7a86bca77b4d2ee73a5f10
- MD5 1323d459f0d07c80afd57cee2e786393
- SHA1 b5265613fd2648dee98f4db7c9023ce05fbe44d0
- SHA512 6f9639b80c7453cb23252b3ef142a1eac79c7fbac932da822c880402a2993df34a0f66bc6cb389c35b887d5ba1bc7a133544b2bdaec6c5528ad9e883211d1420
- TLSH T194C08C88F34C88828A4AD2385878178D69A4C4BB9A324B88144A6A94A3935A6C1D4702
- MD5 SHA1 SHA512 TLSH
