d3044a144e3ff5cb3add762c3b252bad48a1ad3a27aa60d1bfd1a541d49eb649

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 4.6MB
Sample260629-xt7ffsds71
SHA256 d3044a144e3ff5cb3add762c3b252bad48a1ad3a27aa60d1bfd1a541d49eb649
MD5 ea5de100c725924a81675cec1dc325fc
SHA1 19e65ae0ce1ef2559152de7e81e92559a65ee712
SHA512 0b1f8539201a2f86067378606fe06b8ca670bdd2a9c21724aee5b77a06baa256051b98406b21140684348d8c2369e3a7aefe74bdaba08a89d0d26b0c59daf6bf
SSDEEP 98304:zoqTB3Lerbr2pdDtH8q3ORKXLV4+0M02u8F5V58P:jLcbr2pdtH8q32mGuu8F18P
TLSH
T1EC26AE21F18294E5D06332B01629B676EB7CED244F1FB4DB6684CC6E1674AC0EB35B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/4824-117-0x0000000000310000-0x000000000048A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/4824-126-0x0000000000310000-0x000000000048A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/4824-117-0x0000000000310000-0x000000000048A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4824-126-0x0000000000310000-0x000000000048A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e6dc-14.dat	UPX
behavioral1/memory/4824-15-0x0000000000310000-0x000000000048A000-memory.dmp	UPX
behavioral1/memory/4824-117-0x0000000000310000-0x000000000048A000-memory.dmp	UPX
behavioral1/memory/4824-126-0x0000000000310000-0x000000000048A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	toekbczohv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Executes dropped EXE 4 IoCs

pid	Process
1832	toekbczohv.exe
4824	ocgttmdwze.exe
1176	2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2692	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\oci.dll	ocgttmdwze.exe
File created	C:\Windows\System32\bindsvc.exe	ocgttmdwze.exe
File created	C:\Windows\SysWOW64\wideshut.exe	ocgttmdwze.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	ocgttmdwze.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	ocgttmdwze.exe
File created	C:\Windows\SysWOW64\racfg.exe	ocgttmdwze.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	ocgttmdwze.exe
File created	C:\Windows\system32\msfte.dll	ocgttmdwze.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000300000001e6dc-14.dat	upx
behavioral1/memory/4824-15-0x0000000000310000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/4824-117-0x0000000000310000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/4824-126-0x0000000000310000-0x000000000048A000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3080	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toekbczohv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ocgttmdwze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000420868d3af08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ccaaad3af08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ebe56d1af08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000911713d2af08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b3364d2af08dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000388966d2af08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4824	ocgttmdwze.exe
4824	ocgttmdwze.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	2976	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2976	SearchIndexer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 1832	4840	2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4840 wrote to memory of 4824	4840	2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2976 wrote to memory of 2244	2976	SearchIndexer.exe	90
PID 2976 wrote to memory of 4044	2976	SearchIndexer.exe	91
PID 4824 wrote to memory of 2044	4824	ocgttmdwze.exe	99
PID 2044 wrote to memory of 3080	2044	cmd.exe	101
PID 4824 wrote to memory of 1564	4824	ocgttmdwze.exe	102
PID 4824 wrote to memory of 2692	4824	ocgttmdwze.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\toekbczohv.exe
  "C:\Users\Admin\AppData\Local\Temp\toekbczohv.exe" "C:\Users\Admin\AppData\Local\Temp\krrvrqnlnv.exe" "C:\Users\Admin\AppData\Local\Temp\2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1832
- - C:\Users\Admin\AppData\Local\Temp\2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-25_ea5de100c725924a81675cec1dc325fc_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:1176
- C:\Users\Admin\AppData\Local\Temp\ocgttmdwze.exe
  C:\Users\Admin\AppData\Local\Temp\ocgttmdwze.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:3080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MyvmHUDN.bat"
    3⤵
    PID:1564
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2244
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MyvmHUDN.bat

Path C:\Users\Admin\AppData\Local\Temp\MyvmHUDN.bat
Size 196B
SHA256 587497b6db942a9c4d68938759ca23e7517676a3f1e2cc2e99bb3f541eb33e0f
MD5 580702aa44b824cfc54cc0a6d2e64a2a
SHA1 a13d05df86e0ec2a475d4c936900746abfa806e4
SHA512 b5b5643647d112c160c1f18dac7dfb5564d40dac7a4a9943a8596093099a3593c0c579b540257e1120d84880d5776ca76b513ba5cba1ae3d2cc64390ea747d3a
TLSH
T1C1D0121147EBCA6F2888E15F46B1629DD5A09C5C3FCE3712762A844C71C740EB9CB383
MD5 SHA1 SHA512 TLSH

Submit Download

krrvrqnlnv.exe

Path C:\Users\Admin\AppData\Local\Temp\krrvrqnlnv.exe
Size 3.9MB
SHA256 8f9e616bd67d85e8c94b0383d2ac14b73461345864789c1cc9c11442425cdeb5
MD5 2ea8eb4b21e1a4ef0ca67d280db70220
SHA1 a003be93a39c62f2b0dd49bd44ad7a8b598c44b7
SHA512 577c9c2eee696779201b6ddb46017ce310dc6bccc4d8180f9eb052f5be5ccd70fa6e6f55da55908c16ed9fa2f2e854b7afe5f363b27ea0e7e816f0d515501dc5
SSDEEP 98304:ierbr2pdDtH8q3ORKXLV4+0M02u8F5V58H:icbr2pdtH8q32mGuu8F18H
TLSH
T17D169E21F18394E5D06332B01229B67AEBBCED244F1FB4DB6684DC6D1674AC0E735A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocgttmdwze.exe

Path C:\Users\Admin\AppData\Local\Temp\ocgttmdwze.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toekbczohv.exe

Path C:\Users\Admin\AppData\Local\Temp\toekbczohv.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2976-37-0x000001B7C13B0000-0x000001B7C13C0000-memory.dmp

Download

memory/2976-21-0x000001B7C12B0000-0x000001B7C12C0000-memory.dmp

Download

memory/2976-53-0x000001B7C9890000-0x000001B7C9898000-memory.dmp

Download

memory/2976-115-0x000001B7CC730000-0x000001B7CC738000-memory.dmp

Download

memory/4044-87-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-93-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-69-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-72-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-71-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-70-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-82-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-81-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-80-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-79-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-78-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-77-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-76-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-75-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-74-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-73-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-83-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-84-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-85-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-86-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-88-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-67-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-89-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-92-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-94-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-68-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-91-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-98-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-97-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-96-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-95-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-90-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-100-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-104-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-103-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-102-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-101-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-99-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-112-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-114-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-113-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-111-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-110-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-109-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-108-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-107-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-106-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4044-105-0x0000019E038A0000-0x0000019E038B0000-memory.dmp

Download

memory/4824-15-0x0000000000310000-0x000000000048A000-memory.dmp

Download

memory/4824-117-0x0000000000310000-0x000000000048A000-memory.dmp

Download

memory/4824-126-0x0000000000310000-0x000000000048A000-memory.dmp

Download