Analysis
-
max time kernel
123s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2025, 21:27
Behavioral task
behavioral1
Sample
2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
30 signatures
150 seconds
General
-
Target
2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe
-
Size
1.3MB
-
MD5
802bbf197df190c983e75aa6d2d396eb
-
SHA1
8afe134719ef1d94ee196744882d4141e51ded69
-
SHA256
2dfd2a26f46e4c9e325ad0064cbcaadc2e0d6ce60e82c88bb8b7467fb7d2b384
-
SHA512
58b1ca3c92d627e263266621943ea0dff879cea31b2348212274bc58fae1de359e47fe80ea1dc480abca6b6451956d2e8af16119d7426fa752f9eed7ae440b04
-
SSDEEP
24576:VnsJ39LyjbJkQFMhmC+6GD9txyCzASo7ZxPOiKYG:VnsHyjtk2MYC5GD9jzC7ZzKp
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Xred family
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Deletes itself 1 IoCs
pid Process 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Executes dropped EXE 5 IoCs
pid Process 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1704 Synaptics.exe 4832 Synaptics.exe 4240 ._cache_Synaptics.exe 3256 ._cache_Synaptics.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\S: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\G: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\I: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\N: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\R: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\U: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\X: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\Z: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\H: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\K: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\O: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\W: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\Y: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\J: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\M: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\P: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\Q: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\T: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\E: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\L: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification F:\autorun.inf ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe -
resource yara_rule behavioral1/memory/4052-99-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-101-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-117-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-116-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-115-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-100-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-77-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-107-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-73-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-254-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-255-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-256-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-258-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-259-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-280-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-281-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-282-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-283-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-294-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-296-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-298-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-300-0x0000000002250000-0x00000000032DE000-memory.dmp upx behavioral1/memory/4052-304-0x0000000002250000-0x00000000032DE000-memory.dmp upx -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2120 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4240 ._cache_Synaptics.exe 3256 ._cache_Synaptics.exe 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3956 wrote to memory of 4052 3956 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 84 PID 3956 wrote to memory of 4052 3956 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 84 PID 3956 wrote to memory of 4052 3956 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 84 PID 4052 wrote to memory of 788 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 8 PID 4052 wrote to memory of 796 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 9 PID 4052 wrote to memory of 336 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 13 PID 4052 wrote to memory of 2688 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 45 PID 4052 wrote to memory of 2720 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 46 PID 4052 wrote to memory of 2972 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 52 PID 4052 wrote to memory of 3392 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 56 PID 4052 wrote to memory of 3552 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 57 PID 4052 wrote to memory of 3740 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 58 PID 4052 wrote to memory of 3836 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 59 PID 4052 wrote to memory of 3900 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 60 PID 4052 wrote to memory of 3996 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 61 PID 4052 wrote to memory of 376 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 62 PID 4052 wrote to memory of 5672 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 77 PID 4052 wrote to memory of 5688 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 79 PID 4052 wrote to memory of 3956 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 80 PID 4052 wrote to memory of 3956 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 80 PID 4052 wrote to memory of 5872 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 82 PID 4052 wrote to memory of 1528 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 83 PID 4052 wrote to memory of 3820 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 85 PID 4052 wrote to memory of 5992 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 86 PID 3956 wrote to memory of 1704 3956 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 87 PID 3956 wrote to memory of 1704 3956 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 87 PID 3956 wrote to memory of 1704 3956 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 87 PID 3820 wrote to memory of 4832 3820 cmd.exe 88 PID 3820 wrote to memory of 4832 3820 cmd.exe 88 PID 3820 wrote to memory of 4832 3820 cmd.exe 88 PID 1704 wrote to memory of 4240 1704 Synaptics.exe 89 PID 1704 wrote to memory of 4240 1704 Synaptics.exe 89 PID 1704 wrote to memory of 4240 1704 Synaptics.exe 89 PID 4832 wrote to memory of 3256 4832 Synaptics.exe 90 PID 4832 wrote to memory of 3256 4832 Synaptics.exe 90 PID 4832 wrote to memory of 3256 4832 Synaptics.exe 90 PID 4052 wrote to memory of 788 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 8 PID 4052 wrote to memory of 796 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 9 PID 4052 wrote to memory of 336 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 13 PID 4052 wrote to memory of 2688 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 45 PID 4052 wrote to memory of 2720 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 46 PID 4052 wrote to memory of 2972 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 52 PID 4052 wrote to memory of 3392 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 56 PID 4052 wrote to memory of 3552 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 57 PID 4052 wrote to memory of 3740 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 58 PID 4052 wrote to memory of 3836 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 59 PID 4052 wrote to memory of 3900 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 60 PID 4052 wrote to memory of 3996 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 61 PID 4052 wrote to memory of 376 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 62 PID 4052 wrote to memory of 5672 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 77 PID 4052 wrote to memory of 5872 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 82 PID 4052 wrote to memory of 1528 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 83 PID 4052 wrote to memory of 1704 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 87 PID 4052 wrote to memory of 1704 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 87 PID 4052 wrote to memory of 4240 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 89 PID 4052 wrote to memory of 4240 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 89 PID 4052 wrote to memory of 3256 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 90 PID 4052 wrote to memory of 3256 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 90 PID 4052 wrote to memory of 2120 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 91 PID 4052 wrote to memory of 788 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 8 PID 4052 wrote to memory of 796 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 9 PID 4052 wrote to memory of 336 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 13 PID 4052 wrote to memory of 2688 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 45 PID 4052 wrote to memory of 2720 4052 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 46 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2720
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2972
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4052
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4240
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\Synaptics\Synaptics.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5992
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3256
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3740
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:376
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:5672
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5688
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5872
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1528
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2120
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3844
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5802bbf197df190c983e75aa6d2d396eb
SHA18afe134719ef1d94ee196744882d4141e51ded69
SHA2562dfd2a26f46e4c9e325ad0064cbcaadc2e0d6ce60e82c88bb8b7467fb7d2b384
SHA51258b1ca3c92d627e263266621943ea0dff879cea31b2348212274bc58fae1de359e47fe80ea1dc480abca6b6451956d2e8af16119d7426fa752f9eed7ae440b04
-
C:\Users\Admin\AppData\Local\Temp\._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe
Filesize594KB
MD5ed2a71269716b3ca10400e3a024aa19a
SHA194bcc42a9b9a7d756d1c6c98a6e925b702dbddd3
SHA256556444d7fc6cb8cc620ddd591833ca1d90ce4f0131de42cace6e4db3483fecd0
SHA512e68519e72078e3ae833c73c7fc49c37844b2652070864537fea66805570ed9aca61fd953566f2a5d073be5ecb6b7f15c0f1944c3b3eeee0eabd3a88ea1a680b1
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
-
Filesize
100KB
MD5d251f77034f8491de1c0526699a9abc6
SHA179c41508c9c55419e4ecf290b0f39193b5ed2a17
SHA256aea9ebfc09c2e7982cab5b1853003de4147bedfb8e98e726bee1a77cfddd72d9
SHA51288ed3c212a4c4424a3cdf5cfc4bc28d33fcd2e873c1dd217d74bd8083e39bb6d90b8ac3422a4195400592000060103002dec093a0e5cfb53dee59cf13cbae90b