Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 21:12
Behavioral task
behavioral1
Sample
2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe
- Size 60KB
- Sample261110-z2fc2sbb98
- SHA256 87fb494f881fa1c55c2b29417402510f242e8144cedb904bc4d5646fa670c926
- MD5 44c176885080071278b16090328e5f47
- SHA1 4d8456ed5f083426f8b6a08043251d822aa6abd8
- SHA512 552c19dcebce093a80c9c0cd76a0dfc1f629f8c271651115fc196640bb55b78025b6a0b698770ae4781fca18bb501611bf0cdd5b04c3ad41315927faaa408164
- SSDEEP 1536:KEq3GcOfFhNGpWvi/mEFMFnMFFhNGpW+XUdeimEFMFnM/MjCAWlFhNGpWBFhNGpP:KEqmFhNGpWvi+EFMFnyFhNGpWkEFMFnN
- TLSH T170536C2EB2DE52B6E14601B576FE81B9B331B9458678230C30DDD7492332A1913B776F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/5080-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000200000001b2c8-3.dat UPX behavioral2/memory/5080-2926-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/memory/5080-2927-0x0000000000400000-0x000000000040A000-memory.dmp UPX - Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File created \??\c:\Program Files\desktop.ini 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe -
resource yara_rule behavioral2/memory/5080-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000200000001b2c8-3.dat upx behavioral2/memory/5080-2926-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/5080-2927-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\System\ado\msader15.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ms-MY\tipresx.dll.mui 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java.exe 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\mshwstaging.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hu_NEUTER.pak 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ko.txt 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\sqloledb.rll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\PresentationCore.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\external_extensions.json 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Claims.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Design.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ca_MASCULINE.pak 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\jfxswt.jar 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Input.Manipulations.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Royale.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\lib\classlist 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XPath.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Buffers.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fil-PH\tipresx.dll.mui 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\sq-AL\tipresx.dll.mui 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\adcvbs.inc 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ReachFramework.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ReachFramework.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jmc.txt 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\et_NEUTER.pak 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe - Program crash 1 IoCs
pid pid_target Process procid_target 564 5080 WerFault.exe 89 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_44c176885080071278b16090328e5f47_coinminer_conti_elex.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 4962⤵
- Program crash
PID:564
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5080 -ip 50801⤵PID:592
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll
- Size 159KB
- SHA256 367eb2e9e109492f3fb26076403213960a58bdf1114872ec887505c594016fc9
- MD5 d1627640500a75e3d3f0fb2a285212f6
- SHA1 15467df30d8982655faefa484673c7837c546801
- SHA512 08d1f7a66f9e870de82dc4a76992d830de3628385bced945a056ce628e12299e359a0557288775a89012f2ab26628470f2a13d5f5f3c8d9a49c1866fab011091
- SSDEEP 3072:KEqmFhNGpWvi+EFMFnyFhNGpWkEFMFnOM+lFhNGpWBFhNGpWImxDF5tGVFBZxHeJ:KE1FhNGpWvi+EFMFnyFhNGpWkEFMFnRJ
- TLSH T180F30929B2A48375D077C0B9C9D296A9E63178419F3047CF224AE74D1F32BDA8D36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512