dc7980319230a4223c98accd50a3314b3805497525c3a8be0f3633deeb24ed14

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.7MB
Sample260604-q5xbasfx2w
SHA256 dc7980319230a4223c98accd50a3314b3805497525c3a8be0f3633deeb24ed14
MD5 5ce0e14fceef85d71271f1fcb2115991
SHA1 eaf41b9d915c22c1e86ce9865e85ff733f8c6257
SHA512 3c8e42c80e10353941d0a0ecb1d6e127f7050d171f531d4e124c6871bda14825eefd4a05656e71649d8e0a7e4d709d41d40e4f1c0bcccf9dd77b758ad63b6560
SSDEEP 24576:1healj3DSudvGM3MXTVhtSQWGtxNFOauh++alj3DSudvGM3MXTVhtSQWGtxSA:1heoBdqTDtSQWGtVChToBdqTDtSQWGtN
TLSH
T1A6850212B6D05036F47342B059B9D652BA3A7E221F60D8CF3789565E1D73AC2BEB031B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/5044-81-0x0000000000450000-0x00000000005CA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/memory/5044-81-0x0000000000450000-0x00000000005CA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/files/0x000e000000026144-10.dat	UPX
behavioral2/files/0x001a00000002b4aa-13.dat	UPX
behavioral2/memory/5044-15-0x0000000000450000-0x00000000005CA000-memory.dmp	UPX
behavioral2/memory/5044-81-0x0000000000450000-0x00000000005CA000-memory.dmp	UPX

Executes dropped EXE 4 IoCs

pid	Process
5848	tgrisiaxvg.exe
5044	lwoukwfhsv.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1576	bindsvc.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wideshut.exe	lwoukwfhsv.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	lwoukwfhsv.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	lwoukwfhsv.exe
File created	C:\Windows\SysWOW64\racfg.exe	lwoukwfhsv.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	lwoukwfhsv.exe
File created	C:\Windows\system32\msfte.dll	lwoukwfhsv.exe
File created	C:\Windows\system32\oci.dll	lwoukwfhsv.exe
File created	C:\Windows\System32\bindsvc.exe	lwoukwfhsv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001a00000002b4aa-13.dat	upx
behavioral2/memory/5044-15-0x0000000000450000-0x00000000005CA000-memory.dmp	upx
behavioral2/memory/5044-81-0x0000000000450000-0x00000000005CA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3464	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lwoukwfhsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tgrisiaxvg.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da96153a29f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aadc373929f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008883213a29f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ea3fe3829f4dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006da13c3929f4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000933e3a3929f4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
5044	lwoukwfhsv.exe
5044	lwoukwfhsv.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	5396	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3880	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 5848	3156	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	79
PID 3156 wrote to memory of 5044	3156	2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	80
PID 5396 wrote to memory of 1312	5396	SearchIndexer.exe	82
PID 5848 wrote to memory of 3880	5848	tgrisiaxvg.exe	83
PID 5044 wrote to memory of 2188	5044	lwoukwfhsv.exe	84
PID 2188 wrote to memory of 3464	2188	cmd.exe	86
PID 5044 wrote to memory of 1496	5044	lwoukwfhsv.exe	87
PID 5044 wrote to memory of 1576	5044	lwoukwfhsv.exe	88
PID 5396 wrote to memory of 6068	5396	SearchIndexer.exe	90
PID 5396 wrote to memory of 72	5396	SearchIndexer.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\tgrisiaxvg.exe
  "C:\Users\Admin\AppData\Local\Temp\tgrisiaxvg.exe" "C:\Users\Admin\AppData\Local\Temp\rjmpvprzib.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Users\Admin\AppData\Local\Temp\2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_5ce0e14fceef85d71271f1fcb2115991_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3880
- C:\Users\Admin\AppData\Local\Temp\lwoukwfhsv.exe
  C:\Users\Admin\AppData\Local\Temp\lwoukwfhsv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sGjs6mz4.bat"
    3⤵
    PID:1496
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1576

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1312
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 3044 1912 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6068
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 3060 3056 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:72

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lwoukwfhsv.exe

Path C:\Users\Admin\AppData\Local\Temp\lwoukwfhsv.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rjmpvprzib.exe

Path C:\Users\Admin\AppData\Local\Temp\rjmpvprzib.exe
Size 1008KB
SHA256 0d4e06f1def56de1c5418b8fb9d6124d2eb54c88a57a2d1e4c292c4b783dee40
MD5 badddbbe32d73c722496b50835c4571c
SHA1 fb2cbbde64d1e5f25fdbcf0332a51c528058f559
SHA512 61c5906524995be5df13d04523ba8cbd35e16257268511849ebea46805dfaddb94d6e2832a8a6394c4ecb9149bc7ccfcce2057a6072882683fece4f124dc30aa
SSDEEP 24576:UFOauh++alj3DSudvGM3MXTVhtSQWGtxS7:kChToBdqTDtSQWGtA
TLSH
T11E25E113B7D45036F47346B068B5D652B93A7E221F60EC8F2789675E1933AC2B9B031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sGjs6mz4.bat

Path C:\Users\Admin\AppData\Local\Temp\sGjs6mz4.bat
Size 196B
SHA256 504abba42c21b5cc11bdc5b295103325b1d38c7ed0e3113d60efc0204c6f1c75
MD5 bec079ac9c799ad352834e14a546d2f4
SHA1 faaac22920c68d853e1e5a305947967dcca99121
SHA512 87b79624345e1529c5c1b58f57cb38e0da505cc3a1385eaab537723c9f401af2f486ebf4dfeaa10ad689cf178778e8d15a6dc150b904460c702f2d9a278fed12
TLSH
T114D0122247EBDA5F0C5C912B07B1628EC065897C3F8737126660A54D72C240DB5C3301
MD5 SHA1 SHA512 TLSH

Submit Download

tgrisiaxvg.exe

Path C:\Users\Admin\AppData\Local\Temp\tgrisiaxvg.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 f1e4db91569f6001a150503fb28ee273f4de05c532b6941de73ecdd902e4dac2
MD5 2722aa2b3d5b27e45a8f9838ecd9d0e2
SHA1 64b923c0006af9f129ba49dbee1c0629db698d25
SHA512 3bd14ee44bb53154d80b1ef47437d17134175c25d88ef821dad0836caa690b8324d11fc0a714026128276ca84758db9db56ed3e6743cf4a357a0d959c37ffa3a
TLSH
T118213A9B2BC37C23813A47789AB5C5F7D953F40D6FA413028523B62187E29ED03184AF
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3880-67-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3880-72-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5044-81-0x0000000000450000-0x00000000005CA000-memory.dmp

Download

memory/5044-15-0x0000000000450000-0x00000000005CA000-memory.dmp

Download

memory/5396-21-0x000002A5440B0000-0x000002A5440C0000-memory.dmp

Download

memory/5396-37-0x000002A5441B0000-0x000002A5441C0000-memory.dmp

Download

memory/5396-53-0x000002A54C8A0000-0x000002A54C8A8000-memory.dmp

Download

memory/5396-125-0x000002A54DB00000-0x000002A54DB08000-memory.dmp

Download

memory/6068-120-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-102-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-97-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-98-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-96-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-99-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-101-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-104-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-103-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-106-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-108-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-107-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-110-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-112-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-114-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-113-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-111-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-119-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-124-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-123-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-121-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-122-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-94-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-118-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-117-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-116-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-115-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-109-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-105-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-95-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-100-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-93-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-127-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-128-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-129-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-132-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-131-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-130-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-133-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-142-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-141-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-140-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-139-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-138-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-137-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-136-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-135-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-134-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-143-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-144-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-145-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-148-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-147-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-146-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-154-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-153-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-152-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-151-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-150-0x000002560B740000-0x000002560B750000-memory.dmp

Download

memory/6068-149-0x000002560B740000-0x000002560B750000-memory.dmp

Download