Analysis
-
max time kernel
123s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2025, 21:30
Behavioral task
behavioral1
Sample
2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
30 signatures
150 seconds
General
-
Target
2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe
-
Size
1.3MB
-
MD5
802bbf197df190c983e75aa6d2d396eb
-
SHA1
8afe134719ef1d94ee196744882d4141e51ded69
-
SHA256
2dfd2a26f46e4c9e325ad0064cbcaadc2e0d6ce60e82c88bb8b7467fb7d2b384
-
SHA512
58b1ca3c92d627e263266621943ea0dff879cea31b2348212274bc58fae1de359e47fe80ea1dc480abca6b6451956d2e8af16119d7426fa752f9eed7ae440b04
-
SSDEEP
24576:VnsJ39LyjbJkQFMhmC+6GD9txyCzASo7ZxPOiKYG:VnsHyjtk2MYC5GD9jzC7ZzKp
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Xred family
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Deletes itself 1 IoCs
pid Process 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Executes dropped EXE 5 IoCs
pid Process 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1484 Synaptics.exe 5184 Synaptics.exe 4992 ._cache_Synaptics.exe 5736 ._cache_Synaptics.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\O: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\Q: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\U: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\W: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\Z: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\H: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\L: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\N: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\P: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\R: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\G: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\I: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\J: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\M: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\X: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\S: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\T: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\V: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\Y: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened (read-only) \??\E: ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification F:\autorun.inf ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe -
resource yara_rule behavioral1/memory/1468-105-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-109-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-108-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-106-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-115-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-101-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-231-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-119-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-229-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-250-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-249-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-253-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-260-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-259-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-273-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-274-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-275-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-285-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-286-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-290-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-291-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-293-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-298-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-300-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-302-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral1/memory/1468-304-0x0000000002280000-0x000000000330E000-memory.dmp upx -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3192 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe Token: SeDebugPrivilege 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 4992 ._cache_Synaptics.exe 5736 ._cache_Synaptics.exe 3192 EXCEL.EXE 3192 EXCEL.EXE 3192 EXCEL.EXE 3192 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3644 wrote to memory of 1468 3644 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 81 PID 3644 wrote to memory of 1468 3644 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 81 PID 3644 wrote to memory of 1468 3644 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 81 PID 3644 wrote to memory of 1484 3644 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 84 PID 3644 wrote to memory of 1484 3644 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 84 PID 3644 wrote to memory of 1484 3644 2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 84 PID 1468 wrote to memory of 788 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 9 PID 1468 wrote to memory of 796 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 10 PID 1468 wrote to memory of 1016 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 13 PID 1468 wrote to memory of 2640 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 45 PID 1468 wrote to memory of 2668 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 46 PID 1468 wrote to memory of 2964 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 52 PID 1468 wrote to memory of 3460 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 56 PID 1468 wrote to memory of 3576 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 57 PID 1468 wrote to memory of 3764 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 58 PID 1468 wrote to memory of 3900 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 59 PID 1468 wrote to memory of 3968 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 60 PID 1468 wrote to memory of 4044 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 61 PID 1468 wrote to memory of 3856 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 62 PID 1468 wrote to memory of 3164 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 65 PID 1468 wrote to memory of 4528 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 78 PID 1468 wrote to memory of 3644 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 80 PID 1468 wrote to memory of 5408 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 82 PID 1468 wrote to memory of 1168 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 83 PID 1468 wrote to memory of 1484 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 84 PID 1468 wrote to memory of 1484 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 84 PID 5408 wrote to memory of 5184 5408 cmd.exe 85 PID 5408 wrote to memory of 5184 5408 cmd.exe 85 PID 5408 wrote to memory of 5184 5408 cmd.exe 85 PID 1484 wrote to memory of 4992 1484 Synaptics.exe 86 PID 1484 wrote to memory of 4992 1484 Synaptics.exe 86 PID 1484 wrote to memory of 4992 1484 Synaptics.exe 86 PID 5184 wrote to memory of 5736 5184 Synaptics.exe 88 PID 5184 wrote to memory of 5736 5184 Synaptics.exe 88 PID 5184 wrote to memory of 5736 5184 Synaptics.exe 88 PID 1468 wrote to memory of 788 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 9 PID 1468 wrote to memory of 796 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 10 PID 1468 wrote to memory of 1016 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 13 PID 1468 wrote to memory of 2640 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 45 PID 1468 wrote to memory of 2668 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 46 PID 1468 wrote to memory of 2964 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 52 PID 1468 wrote to memory of 3460 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 56 PID 1468 wrote to memory of 3576 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 57 PID 1468 wrote to memory of 3764 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 58 PID 1468 wrote to memory of 3900 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 59 PID 1468 wrote to memory of 3968 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 60 PID 1468 wrote to memory of 4044 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 61 PID 1468 wrote to memory of 3856 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 62 PID 1468 wrote to memory of 3164 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 65 PID 1468 wrote to memory of 4528 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 78 PID 1468 wrote to memory of 4992 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 86 PID 1468 wrote to memory of 4992 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 86 PID 1468 wrote to memory of 3192 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 87 PID 1468 wrote to memory of 5736 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 88 PID 1468 wrote to memory of 5736 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 88 PID 1468 wrote to memory of 5872 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 92 PID 1468 wrote to memory of 1232 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 94 PID 1468 wrote to memory of 788 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 9 PID 1468 wrote to memory of 796 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 10 PID 1468 wrote to memory of 1016 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 13 PID 1468 wrote to memory of 2640 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 45 PID 1468 wrote to memory of 2668 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 46 PID 1468 wrote to memory of 2964 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 52 PID 1468 wrote to memory of 3460 1468 ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe 56 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1016
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2668
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2964
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1468
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4992
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\Synaptics\Synaptics.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1168
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5736
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3576
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3900
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3968
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4044
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3856
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3164
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4528
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3192
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5872
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1232
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5802bbf197df190c983e75aa6d2d396eb
SHA18afe134719ef1d94ee196744882d4141e51ded69
SHA2562dfd2a26f46e4c9e325ad0064cbcaadc2e0d6ce60e82c88bb8b7467fb7d2b384
SHA51258b1ca3c92d627e263266621943ea0dff879cea31b2348212274bc58fae1de359e47fe80ea1dc480abca6b6451956d2e8af16119d7426fa752f9eed7ae440b04
-
C:\Users\Admin\AppData\Local\Temp\._cache_2025-04-10_802bbf197df190c983e75aa6d2d396eb_amadey_coinminer_darkgate_elex_smoke-loader.exe
Filesize594KB
MD5ed2a71269716b3ca10400e3a024aa19a
SHA194bcc42a9b9a7d756d1c6c98a6e925b702dbddd3
SHA256556444d7fc6cb8cc620ddd591833ca1d90ce4f0131de42cace6e4db3483fecd0
SHA512e68519e72078e3ae833c73c7fc49c37844b2652070864537fea66805570ed9aca61fd953566f2a5d073be5ecb6b7f15c0f1944c3b3eeee0eabd3a88ea1a680b1
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
-
Filesize
100KB
MD59c3e33587f981539c1a66559a9df86a5
SHA114b873898c46fc83ca046c59a6189b57756d1c16
SHA256bbaa269016fff32433c0e79210d66b5f4f48f78c46cb0b4e0c92493a1ad207bb
SHA512ce25297610411040e48cbfe01b21e8bb23738d72af7b199d88073f74f8fa0579ac35e806c6441c0b595095c58a19b3a4b18164cbfcd4fe16074a6f2722d0be6c