b5a12fdca23ba84ca3a6a3d1d1e1494ac0da7eeb351742b59e72d39cf50315db

Analysis

max time kernel
149s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
Size 2.3MB
Sample260423-gnyncscv5y
SHA256 b5a12fdca23ba84ca3a6a3d1d1e1494ac0da7eeb351742b59e72d39cf50315db
MD5 6aa37f405a24a465d7cbbde8c197116b
SHA1 ac5acf08a7f2902b9010777415b7c57c4726b145
SHA512 9e82477b29454244824f35e2ab407db1214a660cc1d43e373f207009b3077f1bb1bdbd7efaad69067f41c1e3557ee59a29c47eb38ffe264120a435fc2925f62e
SSDEEP 49152:BhsoBdqTDtSQWGtUfcsVaO1j9wP6okw9ja1AmDnROj9NPEiItTo:IoqTB3SfxaOt9wCzwBa1AmDRs9JEzJo
TLSH
T12CB523007EB48073F126113189B9DBB3874E7E12579885CFB75468B92EA1BE09F78367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Custom signature

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/1280-287-0x0000000000A60000-0x0000000000BDA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/1280-295-0x0000000000A60000-0x0000000000BDA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Custom signature

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/1280-287-0x0000000000A60000-0x0000000000BDA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/1280-295-0x0000000000A60000-0x0000000000BDA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Custom signature

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243ab-13.dat	UPX
behavioral1/memory/1280-15-0x0000000000A60000-0x0000000000BDA000-memory.dmp	UPX
behavioral1/memory/1280-287-0x0000000000A60000-0x0000000000BDA000-memory.dmp	UPX
behavioral1/memory/1280-295-0x0000000000A60000-0x0000000000BDA000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	obmaxwcfpe.exe

Executes dropped EXE 4 IoCs

pid	Process
4200	obmaxwcfpe.exe
1280	pikanujepj.exe
3532	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
4948	bindsvc.exe

Loads dropped DLL 7 IoCs

pid	Process
3532	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
3532	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
3532	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
3532	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
3532	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
3532	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
3532	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\racfg.exe	pikanujepj.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	pikanujepj.exe
File created	C:\Windows\system32\msfte.dll	pikanujepj.exe
File created	C:\Windows\system32\oci.dll	pikanujepj.exe
File created	C:\Windows\System32\bindsvc.exe	pikanujepj.exe
File created	C:\Windows\SysWOW64\wideshut.exe	pikanujepj.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	pikanujepj.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	pikanujepj.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000243ab-13.dat	upx
behavioral1/memory/1280-15-0x0000000000A60000-0x0000000000BDA000-memory.dmp	upx
behavioral1/memory/1280-287-0x0000000000A60000-0x0000000000BDA000-memory.dmp	upx
behavioral1/memory/1280-295-0x0000000000A60000-0x0000000000BDA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3012	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	obmaxwcfpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pikanujepj.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036687c1ce6d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cc6db1ce6d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005245a1de6d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c65ba1ce6d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e28de1ce6d2dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ef0a41ce6d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	pikanujepj.exe
1280	pikanujepj.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	1328	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4200	4252	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe	85
PID 4252 wrote to memory of 1280	4252	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe	86
PID 1328 wrote to memory of 4156	1328	SearchIndexer.exe	88
PID 1328 wrote to memory of 1640	1328	SearchIndexer.exe	89
PID 4200 wrote to memory of 3532	4200	obmaxwcfpe.exe	90
PID 1280 wrote to memory of 2556	1280	pikanujepj.exe	91
PID 2556 wrote to memory of 3012	2556	cmd.exe	93
PID 1280 wrote to memory of 2540	1280	pikanujepj.exe	94
PID 1280 wrote to memory of 4948	1280	pikanujepj.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\obmaxwcfpe.exe
  "C:\Users\Admin\AppData\Local\Temp\obmaxwcfpe.exe" "C:\Users\Admin\AppData\Local\Temp\lnmkrjfrlm.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3532
- C:\Users\Admin\AppData\Local\Temp\pikanujepj.exe
  C:\Users\Admin\AppData\Local\Temp\pikanujepj.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BcfjhvhV.bat"
    3⤵
    PID:2540
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4948

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4156
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BcfjhvhV.bat

Path C:\Users\Admin\AppData\Local\Temp\BcfjhvhV.bat
Size 196B
SHA256 1bd2d3ea3dbb6cad0ea8e3b9993ec65cb2dbd554019f86170ffd5bf3f0c8ff61
MD5 ed60975743d3245c8499bf85f880a581
SHA1 73af9f51ecb1f45faae6a0f48985362c3e2a46ff
SHA512 92da2843f5837ff9cda744b80d6cda885cb804e0baf776e7efdcbb6a8e9276e918b5bbf1ecca4d05226c7496c1483ca69e7883ec97ffa3a0fccb358ad5229759
TLSH
T115D0121543DFCA6E0848A55B07B1A28EC560992C3F462B25A660C84E31D692FBBE3301
MD5 SHA1 SHA512 TLSH

Submit Download

lnmkrjfrlm.exe

Path C:\Users\Admin\AppData\Local\Temp\lnmkrjfrlm.exe
Size 1.6MB
SHA256 5b04832d4bfb44e37bcd858ecb0e0a113e893633aca4f211b1411d695852db08
MD5 3d3044d4b06540d06d65c50b9bb8fa87
SHA1 22a8725f77212dfc175a2f6c5016c55ea200e53c
SHA512 88aa0e2fe5f9fd114896920ac7afb9ce48a1e7cc8ad51b2b69fbf1fbbd993f93898c9b7fb67003ee144db4115714794d9a1180bf0f8f9f02e01f6e46dcd1e64a
SSDEEP 49152:VfcsVaO1j9wP6okw9ja1AmDnROj9NPEiItTa:VfxaOt9wCzwBa1AmDRs9JEzJa
TLSH
T1B67533407F7994B7F529063184B6AE6741C53E15678ECB0FB720E8F828D5BA05B6C1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjE89C.tmp\InstallOptions.dll
Size 15KB
SHA256 3ccb4385cd22b5c69bc2583e181da4085477906c193f04eb5a400801e00dbcd5
MD5 786110d3394edf4bb5c14e3e9a49f9e6
SHA1 4adf64a5999a1a41870fedefba22f67840f36f3a
SHA512 e85e49b492a04188c46c90fef6ba5b177f85c670848f902748ec1540839ffb2f5d88563c14026328dd2100a48979ff8e67e7af1eee70fea0eb477c78db4d9524
SSDEEP 192:JsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mn8ozxGUWumle:JsUHd9GN2d2iwl0impATIPdAn8Ov6
TLSH
T11C621A2077C750B3EF6226312AFF63179BA5711418D29C0B9E7329472D39640EF356A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjE89C.tmp\System.dll
Size 11KB
SHA256 6ec9fde89f067b1807325b05089c3ae4822ce7640d78e6f32dbe52f582de1d92
MD5 301a9c8739ed3ed955a1bdc472d26f32
SHA1 a830ab9ae6e8d046b7ab2611bea7a0a681f29a43
SHA512 41d88489ecb5ec64191493a1ed2ed7095678955d9fa72cccea2ae76dd794e62e7b5bd3aa2c313fb4bdf41c2f89f29e4cafe43d564ecad80fce1bf0a240b1e094
SSDEEP 192:hCPej3uzvJwqJMQKN4GbeWZksMI4ETWcEbcBZ8ep2Kra7yAG:hCQ2HgN4GbeWmbI4Eybogia7yA
TLSH
T17A325B269BA091F2E4A4427809A73D332B7A650452B50D5BDFF74885FC197D2BE3D323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjE89C.tmp\UserInfo.dll
Size 4KB
SHA256 4a775a8062dcbd2a960076af0395c8182523d65ab1bcf3da3f77f94d31051568
MD5 e47edd32aa6f55c5e0f3d7807ef7801e
SHA1 a09626786256653c23d3c704417caf4a5f584759
SHA512 f7543ae3e73d29a83f80deabd5e5ace19cbf1a150bdf888ac35a5c64ba32a3261dd7644475e4a18e942808f4ee8ed73cf11c4bfae44f27473ea40989752b1167
TLSH
T11E81577B23F45473E09A4BBB01E60CD752A2D9309316442F498B4D6A14C1AA7FD6EB17
MD5 SHA1 SHA512 TLSH

Submit Download

csp.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjE89C.tmp\csp.ini
Size 658B
SHA256 502e84cbd037e6b30b8338793897cbbaaaf23339abba4f1ceb596b5bc3b19203
MD5 2b539244b8769a61c33c9a0b2a823128
SHA1 9b0133fdee1ee250fdb9e58c07536d7cd0e2107a
SHA512 b2f0eabf0fa4e71def01b0c16521787637aa4fe6ee12a06f0adea3f43d5dea9152bc212b3ad8e95457c16fba6e0776fad8d24d8e275d08ba0b4760411a9dea7a
TLSH
T1F5011D132BFD0504F49BF10CEBF68436A3397116152DC91EC0D41E0E49E9680456BBDB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjE89C.tmp\ioSpecial.ini
Size 1KB
SHA256 06979f73a95c7aaf149b84ba21f81db6d39d47381d142b0da8d9f731335cb2f7
MD5 24c3f42f4e0a2a4eaa2c9c6597b8e8f3
SHA1 33df1f26a5219648d92f7a34e3e9ebea208d9e72
SHA512 2cb92561ae0202d1e71b7e6bd70e991055d50efd831170a2d057da9272a5fa3a44595dbeabcf4792d7073497fee6a3e4e7ef2ab64cdba04dffc5dba38fa316fe
TLSH
T1FE21B0137BFC1504F2BBBB14FEF585758B3A7C569839C60D81C00A0E09E5B508923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

obmaxwcfpe.exe

Path C:\Users\Admin\AppData\Local\Temp\obmaxwcfpe.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pikanujepj.exe

Path C:\Users\Admin\AppData\Local\Temp\pikanujepj.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-15-0x0000000000A60000-0x0000000000BDA000-memory.dmp

Download

memory/1280-295-0x0000000000A60000-0x0000000000BDA000-memory.dmp

Download

memory/1280-287-0x0000000000A60000-0x0000000000BDA000-memory.dmp

Download

memory/1328-21-0x000001B8D2200000-0x000001B8D2210000-memory.dmp

Download

memory/1328-37-0x000001B8D2300000-0x000001B8D2310000-memory.dmp

Download

memory/1328-53-0x000001B8DA7F0000-0x000001B8DA7F8000-memory.dmp

Download

memory/1328-67-0x000001B8DBA70000-0x000001B8DBA78000-memory.dmp

Download

memory/1640-203-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-209-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-181-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-180-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-179-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-178-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-177-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-176-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-175-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-174-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-173-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-182-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-183-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-184-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-185-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-187-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-186-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-193-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-196-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-197-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-195-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-170-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-213-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-212-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-211-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-210-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-208-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-215-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-214-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-172-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-216-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-219-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-218-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-217-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-222-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-225-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-224-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-223-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-221-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-220-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-207-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-206-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-205-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-204-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-202-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-201-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-200-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-199-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-198-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-194-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-192-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-191-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-190-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-189-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-188-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-171-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-169-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-168-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-167-0x0000018152930000-0x0000018152940000-memory.dmp

Download

memory/1640-166-0x0000018152930000-0x0000018152940000-memory.dmp

Download