98a04e59d2d83a9b763869b7ce57cfff23b60fa65206de4952974eecbad9ef7e

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 731KB
Sample260511-mlk75sft6t
SHA256 98a04e59d2d83a9b763869b7ce57cfff23b60fa65206de4952974eecbad9ef7e
MD5 4a785d005ef7381064fe7b710cbc1f9b
SHA1 9fc1ec3e8ed003eaba7192fc58b75105c883393f
SHA512 02483ebad68b56b343ca4324230c249db26ae20fca1d316a330032c0b38102c8d35914bb971478eb023d80d72e98644bb36fa35afb62541ab492d5112b98c1fc
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmxj:1hLalj3DSudvGM3MXTVhtSQWGtxj
TLSH
T16BF4012072988035F1635530497897B18B2BF912DBB4E2CFA794897E1FE16D8DE30B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/5688-171-0x00000000002E0000-0x000000000045A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/5688-181-0x00000000002E0000-0x000000000045A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/5688-171-0x00000000002E0000-0x000000000045A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/5688-181-0x00000000002E0000-0x000000000045A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/5688-16-0x00000000002E0000-0x000000000045A000-memory.dmp	UPX
behavioral1/files/0x000700000002430b-14.dat	UPX
behavioral1/memory/5688-171-0x00000000002E0000-0x000000000045A000-memory.dmp	UPX
behavioral1/memory/5688-181-0x00000000002E0000-0x000000000045A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Control Panel\International\Geo\Nation	2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Control Panel\International\Geo\Nation	wfkyaxhnpy.exe

Executes dropped EXE 4 IoCs

pid	Process
5328	wfkyaxhnpy.exe
5688	nzummvcvqp.exe
5676	2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
5176	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bindsvc.exe	nzummvcvqp.exe
File created	C:\Windows\system32\msfte.dll	nzummvcvqp.exe
File created	C:\Windows\system32\oci.dll	nzummvcvqp.exe
File created	C:\Windows\System32\bindsvc.exe	nzummvcvqp.exe
File created	C:\Windows\SysWOW64\wideshut.exe	nzummvcvqp.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	nzummvcvqp.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	nzummvcvqp.exe
File created	C:\Windows\SysWOW64\racfg.exe	nzummvcvqp.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5688-16-0x00000000002E0000-0x000000000045A000-memory.dmp	upx
behavioral1/files/0x000700000002430b-14.dat	upx
behavioral1/memory/5688-171-0x00000000002E0000-0x000000000045A000-memory.dmp	upx
behavioral1/memory/5688-181-0x00000000002E0000-0x000000000045A000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2080	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nzummvcvqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wfkyaxhnpy.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b0f319531e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000954c0d9531e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bad2e9531e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c774f59431e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f69ed9531e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ade5679531e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035b1f09431e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d4eee9431e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a09cc9531e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a01c19431e1dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fcfb19531e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c45d3f9531e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002d9d89431e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5688	nzummvcvqp.exe
5688	nzummvcvqp.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	1304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 5328	2488	2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	83
PID 2488 wrote to memory of 5688	2488	2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	84
PID 1304 wrote to memory of 3264	1304	SearchIndexer.exe	86
PID 1304 wrote to memory of 2096	1304	SearchIndexer.exe	87
PID 5328 wrote to memory of 5676	5328	wfkyaxhnpy.exe	88
PID 5688 wrote to memory of 5148	5688	nzummvcvqp.exe	94
PID 5148 wrote to memory of 2080	5148	cmd.exe	96
PID 5688 wrote to memory of 1840	5688	nzummvcvqp.exe	97
PID 5688 wrote to memory of 5176	5688	nzummvcvqp.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\wfkyaxhnpy.exe
  "C:\Users\Admin\AppData\Local\Temp\wfkyaxhnpy.exe" "C:\Users\Admin\AppData\Local\Temp\qtgmxctaal.exe" "C:\Users\Admin\AppData\Local\Temp\2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Users\Admin\AppData\Local\Temp\2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_4a785d005ef7381064fe7b710cbc1f9b_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:5676
- C:\Users\Admin\AppData\Local\Temp\nzummvcvqp.exe
  C:\Users\Admin\AppData\Local\Temp\nzummvcvqp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\eckZQtbR.bat"
    3⤵
    PID:1840
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5176

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3264
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eckZQtbR.bat

Path C:\Users\Admin\AppData\Local\Temp\eckZQtbR.bat
Size 196B
SHA256 7e6edced0715d1fa481c1dbe52888061fb7f79f1b51d418573cee428ed8261b5
MD5 8479ac83ea2b3278fff19cfd056f3e38
SHA1 227ccc0e0e25dac7832c2714585fa0cfb390617c
SHA512 491c219d1a9b54bfc0a577ea7d84da8c5509537ad83a88ad3ff1daefd4b39ccfe039959e1e200cfc8e45969dd7f6246153be39ee655cbe061a56cd0e5a59a658
TLSH
T1FFD0122143DBCB5E449C912F0AA2628ED0749E5C3F4737117732C48E31C680DB9C3302
MD5 SHA1 SHA512 TLSH

Submit Download

nzummvcvqp.exe

Path C:\Users\Admin\AppData\Local\Temp\nzummvcvqp.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtgmxctaal.exe

Path C:\Users\Admin\AppData\Local\Temp\qtgmxctaal.exe
Size 25KB
SHA256 b3f3be2eeda8c739b27b3728392fe9789c9e559d6ff6c9dd2e96eeba5064a5d3
MD5 26ae9670bb76718c4bdee0fedf0b734f
SHA1 8f9ace46370b50b07661584dfda55afcd0cc6565
SHA512 3266dee5eb83ee18573a7cc5071dcfd6d906014912348ed48248107ea8e2fc3627d63e713d478f73427bc1ceccb6adcf84bddd74ac7961cdd7714f52acadb191
SSDEEP 384:b9rSub3v1cVG+3pvgpi6NvFVYb8lWycVWNb167Qo:RrSWSZvL6B49
TLSH
T1A0B2D93152AD502CF6A26E76056927F45627FA21DAA5F78BC320CC7C17E09CC9834FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wfkyaxhnpy.exe

Path C:\Users\Admin\AppData\Local\Temp\wfkyaxhnpy.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 2838f2fb4ae598443751a082a00549bcd691d4e2a6ac2278558259a09e6f74de
MD5 ab2c4e7729bdeac56294c7f741665e35
SHA1 aaffb4b2885c609c5e6a802935deeea53b85047d
SHA512 93d987ab84670a05d488d63f298e29ceedef5d5e2b56f99ac33cb3e62c3a89c50320395537dacd1594b6deacc270a75dc675366456f8fd313972858bdf3a9827
TLSH
T14E217F5E0BC2752381794B69ABB5C4E7C9E3F04E2FC11740922331B28B634ED222465E
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1304-22-0x0000024724150000-0x0000024724160000-memory.dmp

Download

memory/1304-38-0x0000024724250000-0x0000024724260000-memory.dmp

Download

memory/1304-54-0x000002472C740000-0x000002472C748000-memory.dmp

Download

memory/1304-68-0x000002472E560000-0x000002472E568000-memory.dmp

Download

memory/2096-97-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-105-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-75-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-86-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-85-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-84-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-83-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-82-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-81-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-80-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-79-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-78-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-77-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-87-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-88-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-89-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-92-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-91-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-90-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-93-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-95-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-102-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-101-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-100-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-99-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-98-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-74-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-96-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-94-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-103-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-104-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-76-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-106-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-107-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-108-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-109-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-118-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-117-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-116-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-115-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-114-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-113-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-112-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-111-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-110-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-119-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-120-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-121-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-124-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-123-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-122-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-125-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-127-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-128-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-126-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-71-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-72-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2096-73-0x000001D32DF80000-0x000001D32DF90000-memory.dmp

Download

memory/2488-15-0x0000000003400000-0x00000000034E3000-memory.dmp

Download

memory/5328-70-0x0000000000E00000-0x0000000000E7A000-memory.dmp

Download

memory/5688-171-0x00000000002E0000-0x000000000045A000-memory.dmp

Download

memory/5688-16-0x00000000002E0000-0x000000000045A000-memory.dmp

Download

memory/5688-181-0x00000000002E0000-0x000000000045A000-memory.dmp

Download