b5a12fdca23ba84ca3a6a3d1d1e1494ac0da7eeb351742b59e72d39cf50315db

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
Size 2.3MB
Sample260423-gnyncscv5y
SHA256 b5a12fdca23ba84ca3a6a3d1d1e1494ac0da7eeb351742b59e72d39cf50315db
MD5 6aa37f405a24a465d7cbbde8c197116b
SHA1 ac5acf08a7f2902b9010777415b7c57c4726b145
SHA512 9e82477b29454244824f35e2ab407db1214a660cc1d43e373f207009b3077f1bb1bdbd7efaad69067f41c1e3557ee59a29c47eb38ffe264120a435fc2925f62e
SSDEEP 49152:BhsoBdqTDtSQWGtUfcsVaO1j9wP6okw9ja1AmDnROj9NPEiItTo:IoqTB3SfxaOt9wCzwBa1AmDRs9JEzJo
TLSH
T12CB523007EB48073F126113189B9DBB3874E7E12579885CFB75468B92EA1BE09F78367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Custom signature

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/840-174-0x0000000000C40000-0x0000000000DBA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Custom signature

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/memory/840-174-0x0000000000C40000-0x0000000000DBA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Custom signature

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/840-15-0x0000000000C40000-0x0000000000DBA000-memory.dmp	UPX
behavioral2/files/0x001900000002b401-14.dat	UPX
behavioral2/memory/840-174-0x0000000000C40000-0x0000000000DBA000-memory.dmp	UPX

Executes dropped EXE 4 IoCs

pid	Process
1060	ojsqbyrdsb.exe
840	tzcwzfoaqm.exe
2880	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
2920	bindsvc.exe

Loads dropped DLL 7 IoCs

pid	Process
2880	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
2880	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
2880	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
2880	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
2880	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
2880	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
2880	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wimsvc.exe	tzcwzfoaqm.exe
File created	C:\Windows\SysWOW64\racfg.exe	tzcwzfoaqm.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	tzcwzfoaqm.exe
File created	C:\Windows\system32\msfte.dll	tzcwzfoaqm.exe
File created	C:\Windows\system32\oci.dll	tzcwzfoaqm.exe
File created	C:\Windows\System32\bindsvc.exe	tzcwzfoaqm.exe
File created	C:\Windows\SysWOW64\wideshut.exe	tzcwzfoaqm.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	tzcwzfoaqm.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/840-15-0x0000000000C40000-0x0000000000DBA000-memory.dmp	upx
behavioral2/files/0x001900000002b401-14.dat	upx
behavioral2/memory/840-174-0x0000000000C40000-0x0000000000DBA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4848	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojsqbyrdsb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tzcwzfoaqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d0f4c1fe6d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008747851fe6d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000955a981fe6d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009538d1ee6d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a93e7d20e6d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da4b471fe6d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081c7a21ee6d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
840	tzcwzfoaqm.exe
840	tzcwzfoaqm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2996	SearchIndexer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 1060	4152	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe	80
PID 4152 wrote to memory of 840	4152	2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe	81
PID 2996 wrote to memory of 2780	2996	SearchIndexer.exe	83
PID 1060 wrote to memory of 2880	1060	ojsqbyrdsb.exe	84
PID 840 wrote to memory of 1848	840	tzcwzfoaqm.exe	85
PID 1848 wrote to memory of 4848	1848	cmd.exe	87
PID 840 wrote to memory of 576	840	tzcwzfoaqm.exe	88
PID 840 wrote to memory of 2920	840	tzcwzfoaqm.exe	90
PID 2996 wrote to memory of 3836	2996	SearchIndexer.exe	91
PID 2996 wrote to memory of 4652	2996	SearchIndexer.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Local\Temp\ojsqbyrdsb.exe
  "C:\Users\Admin\AppData\Local\Temp\ojsqbyrdsb.exe" "C:\Users\Admin\AppData\Local\Temp\uebbwmnlsl.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-23_6aa37f405a24a465d7cbbde8c197116b_amadey_coinminer_darkgate_elex_lumma-stealer_manuscrypt_.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2880
- C:\Users\Admin\AppData\Local\Temp\tzcwzfoaqm.exe
  C:\Users\Admin\AppData\Local\Temp\tzcwzfoaqm.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NJTPik6x.bat"
    3⤵
    PID:576
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2780
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2796 2640 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3836
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2840 2836 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NJTPik6x.bat

Path C:\Users\Admin\AppData\Local\Temp\NJTPik6x.bat
Size 196B
SHA256 727eafc04c715a597b96b229929f4a29c330dc123f6f2add0a49ed28fdff8331
MD5 fda82f21b10ae96de5d4eafcdbadd36b
SHA1 ac2ef4185430f569458a3bce54c0f082a5e68039
SHA512 ce238c3f0dcf54a0428a764c7f7fe0cdd15acb2e2002b9cbb09379a9d1c2bdd5d50801f009328264a3e1b9395ca15e5a9a937b63818e824b89c950fa14c23dbf
TLSH
T129D0121183EBCE6E144CA21F06A557CED0608C1C3F4A27156F34C88933D641DFAD3702
MD5 SHA1 SHA512 TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5753.tmp\InstallOptions.dll
Size 15KB
SHA256 3ccb4385cd22b5c69bc2583e181da4085477906c193f04eb5a400801e00dbcd5
MD5 786110d3394edf4bb5c14e3e9a49f9e6
SHA1 4adf64a5999a1a41870fedefba22f67840f36f3a
SHA512 e85e49b492a04188c46c90fef6ba5b177f85c670848f902748ec1540839ffb2f5d88563c14026328dd2100a48979ff8e67e7af1eee70fea0eb477c78db4d9524
SSDEEP 192:JsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mn8ozxGUWumle:JsUHd9GN2d2iwl0impATIPdAn8Ov6
TLSH
T11C621A2077C750B3EF6226312AFF63179BA5711418D29C0B9E7329472D39640EF356A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5753.tmp\System.dll
Size 11KB
SHA256 6ec9fde89f067b1807325b05089c3ae4822ce7640d78e6f32dbe52f582de1d92
MD5 301a9c8739ed3ed955a1bdc472d26f32
SHA1 a830ab9ae6e8d046b7ab2611bea7a0a681f29a43
SHA512 41d88489ecb5ec64191493a1ed2ed7095678955d9fa72cccea2ae76dd794e62e7b5bd3aa2c313fb4bdf41c2f89f29e4cafe43d564ecad80fce1bf0a240b1e094
SSDEEP 192:hCPej3uzvJwqJMQKN4GbeWZksMI4ETWcEbcBZ8ep2Kra7yAG:hCQ2HgN4GbeWmbI4Eybogia7yA
TLSH
T17A325B269BA091F2E4A4427809A73D332B7A650452B50D5BDFF74885FC197D2BE3D323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5753.tmp\UserInfo.dll
Size 4KB
SHA256 4a775a8062dcbd2a960076af0395c8182523d65ab1bcf3da3f77f94d31051568
MD5 e47edd32aa6f55c5e0f3d7807ef7801e
SHA1 a09626786256653c23d3c704417caf4a5f584759
SHA512 f7543ae3e73d29a83f80deabd5e5ace19cbf1a150bdf888ac35a5c64ba32a3261dd7644475e4a18e942808f4ee8ed73cf11c4bfae44f27473ea40989752b1167
TLSH
T11E81577B23F45473E09A4BBB01E60CD752A2D9309316442F498B4D6A14C1AA7FD6EB17
MD5 SHA1 SHA512 TLSH

Submit Download

csp.ini

Path C:\Users\Admin\AppData\Local\Temp\nsm5753.tmp\csp.ini
Size 736B
SHA256 9853b29f578d15a84fa0035de89a2377de046e7b0b4c8b68b42f252227169641
MD5 73ecc1a01b2fcdea1ad5a18296b2e2bd
SHA1 ea894d7f845ff774f3e2172f488c0c703583513a
SHA512 989122e4840a7f8a76b8e760b41451a34c47b26c1f04e7c98871804c54e3b24976b914b586302e1052b113ca9d358dd1977ce87a69f0785f68d886e08aec048d
TLSH
T1AE014F272FFE0504F0ABF15CEBF5843AA3397106551EC91E90D41E0F49EAA80596B7DB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsm5753.tmp\ioSpecial.ini
Size 1KB
SHA256 e2cfa24bb0133ac7b36a4b5be3011d8d80f99435e05188aa0721c960b7dac0dd
MD5 d641a0c8182dad2b6bfd7fa3c34a5c8c
SHA1 c3393d1dee98fe4425ea6876733492cdfb87fe0f
SHA512 00651bba571abce22fb497817044e7adc9753942a35dbc3be276f3097c89897e78af39f116f730ff5e98d5527ae72ad565be24d26f3116008d4782adbd944a76
TLSH
T1C931DE137AFC1614F2BBB714FEF581758B3A7806983DC60D90C10A4E08F6E408923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ojsqbyrdsb.exe

Path C:\Users\Admin\AppData\Local\Temp\ojsqbyrdsb.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzcwzfoaqm.exe

Path C:\Users\Admin\AppData\Local\Temp\tzcwzfoaqm.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uebbwmnlsl.exe

Path C:\Users\Admin\AppData\Local\Temp\uebbwmnlsl.exe
Size 1.6MB
SHA256 5b04832d4bfb44e37bcd858ecb0e0a113e893633aca4f211b1411d695852db08
MD5 3d3044d4b06540d06d65c50b9bb8fa87
SHA1 22a8725f77212dfc175a2f6c5016c55ea200e53c
SHA512 88aa0e2fe5f9fd114896920ac7afb9ce48a1e7cc8ad51b2b69fbf1fbbd993f93898c9b7fb67003ee144db4115714794d9a1180bf0f8f9f02e01f6e46dcd1e64a
SSDEEP 49152:VfcsVaO1j9wP6okw9ja1AmDnROj9NPEiItTa:VfxaOt9wCzwBa1AmDRs9JEzJa
TLSH
T1B67533407F7994B7F529063184B6AE6741C53E15678ECB0FB720E8F828D5BA05B6C1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 b3f64c5bf3a5494927774f2ad7048ad1484d0bb34a4da7eef05b4ba2653c65e9
MD5 38b99950668b9ab83deabdaf86756399
SHA1 fc0d32a585527c845af94894c73d927a44ccc926
SHA512 053b2d72ec17e05366af6deaaca5b87adcdfc9f59e2886326a5b47ed57f632cc97af18be5dbe03e46410083619beee8825cab8fe20aa80a8f5b9f13ea834b022
TLSH
T1B221345B2B23386381BA47649BB9C4FBCA63E14E5DA043059280B721C7D39EA072C48E
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/840-174-0x0000000000C40000-0x0000000000DBA000-memory.dmp

Download

memory/840-15-0x0000000000C40000-0x0000000000DBA000-memory.dmp

Download

memory/1060-165-0x0000000002140000-0x00000000021A4000-memory.dmp

Download

memory/2996-38-0x0000029E0B260000-0x0000029E0B270000-memory.dmp

Download

memory/2996-22-0x0000029E0B160000-0x0000029E0B170000-memory.dmp

Download

memory/2996-54-0x0000029E135C0000-0x0000029E135C8000-memory.dmp

Download

memory/2996-218-0x0000029E14BC0000-0x0000029E14BC8000-memory.dmp

Download

memory/3836-215-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-205-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-199-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-198-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-197-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-196-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-195-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-194-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-193-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-192-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-191-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-190-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-189-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-188-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-202-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-203-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-204-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-217-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-216-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-214-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-201-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-213-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-212-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-211-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-210-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-209-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-208-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-207-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-206-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-200-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-187-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-222-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-223-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-226-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-227-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-225-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-224-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-234-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-237-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-236-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-235-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-233-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-232-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-231-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-230-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-229-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-228-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-239-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-247-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-246-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-245-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-244-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-243-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-242-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-241-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-240-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-238-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/3836-186-0x000002273BBF0000-0x000002273BC00000-memory.dmp

Download

memory/4152-16-0x0000000001800000-0x0000000001864000-memory.dmp

Download