57feef962a64f6da45d9191e65c4ca38ab77d76265f5dd4e70a070f7cbb6da92

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 910KB
Sample260711-tekflags3y
SHA256 57feef962a64f6da45d9191e65c4ca38ab77d76265f5dd4e70a070f7cbb6da92
MD5 834450a7b92b28c06e8423e132a5ece7
SHA1 f433b1bdecfc9d879ffe29b244429c2e0adb11b2
SHA512 1e4225b82147f713d189336e02b7625d9c8bb457ecd51b7003064bb99863778d3ca79bdb6429b2511dad8996256790b35223cf97a48b90f7fee72591d7afbb03
SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtxqmtqo6r:1hLoBdqTDtSQWGtT/g
TLSH
T190150120F580C036F4A35175CABACB769B2DBE2147A450CBB3CC59AA1F355E5AF3025B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit discovery persistence upx

Malware Config

Signatures

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/4772-20-0x00000000000C0000-0x000000000023A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/4772-177-0x00000000000C0000-0x000000000023A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/4772-20-0x00000000000C0000-0x000000000023A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4772-177-0x00000000000C0000-0x000000000023A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000002459a-13.dat	UPX
behavioral1/memory/4772-20-0x00000000000C0000-0x000000000023A000-memory.dmp	UPX
behavioral1/memory/4772-177-0x00000000000C0000-0x000000000023A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	eiarvyefqj.exe

Executes dropped EXE 4 IoCs

pid	Process
684	eiarvyefqj.exe
4772	mhuxxfwlov.exe
1608	2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4600	bindsvc.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	mhuxxfwlov.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	mhuxxfwlov.exe
File created	C:\Windows\SysWOW64\racfg.exe	mhuxxfwlov.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	mhuxxfwlov.exe
File created	C:\Windows\system32\msfte.dll	mhuxxfwlov.exe
File created	C:\Windows\system32\oci.dll	mhuxxfwlov.exe
File created	C:\Windows\System32\bindsvc.exe	mhuxxfwlov.exe
File created	C:\Windows\SysWOW64\wideshut.exe	mhuxxfwlov.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002459a-13.dat	upx
behavioral1/memory/4772-20-0x00000000000C0000-0x000000000023A000-memory.dmp	upx
behavioral1/memory/4772-177-0x00000000000C0000-0x000000000023A000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4092	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eiarvyefqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhuxxfwlov.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e07c30174e11dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036b6a7174e11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f59124174e11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000579405174e11dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000351ef0164e11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000765448174e11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6f145174e11dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000947e11174e11dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e07c30174e11dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4772	mhuxxfwlov.exe
4772	mhuxxfwlov.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	4416	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4416	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 684	3944	2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	85
PID 3944 wrote to memory of 4772	3944	2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	86
PID 4416 wrote to memory of 2332	4416	SearchIndexer.exe	88
PID 4416 wrote to memory of 5024	4416	SearchIndexer.exe	89
PID 684 wrote to memory of 1608	684	eiarvyefqj.exe	90
PID 4772 wrote to memory of 1744	4772	mhuxxfwlov.exe	93
PID 1744 wrote to memory of 4092	1744	cmd.exe	95
PID 4772 wrote to memory of 2340	4772	mhuxxfwlov.exe	96
PID 4772 wrote to memory of 4600	4772	mhuxxfwlov.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\eiarvyefqj.exe
  "C:\Users\Admin\AppData\Local\Temp\eiarvyefqj.exe" "C:\Users\Admin\AppData\Local\Temp\bidbrayylg.exe" "C:\Users\Admin\AppData\Local\Temp\2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_834450a7b92b28c06e8423e132a5ece7_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:1608
- C:\Users\Admin\AppData\Local\Temp\mhuxxfwlov.exe
  C:\Users\Admin\AppData\Local\Temp\mhuxxfwlov.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hf6mArzo.bat"
    3⤵
    PID:2340
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2332
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bidbrayylg.exe

Path C:\Users\Admin\AppData\Local\Temp\bidbrayylg.exe
Size 204KB
SHA256 43d9674005156a494cfc06e4848fb672123fcf2469a25a6fe9286fba4d2dd80e
MD5 2b42024d1089c4646f893a58cef4a0c3
SHA1 0bc4d21d9e4f5757dc3c346f6b9c083f69f0d7ae
SHA512 5713c82a04fc3b1116f4f492bd73cac28192113c63f4ddb13437492dc8090ac512b8c8d18b5723e5ca768ab514d53825aae8fa3c6302b56fafa97ac45f04b309
SSDEEP 3072:7EenkxFJB4bpqxXhbsnTf/Y6zrrei4oaB:YenkxFZhonTo6zrrei
TLSH
T16D142A20E641D03EE8E751FADBFB8B7AE5689A30034410C7F3DCA9A967294E57D3144E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eiarvyefqj.exe

Path C:\Users\Admin\AppData\Local\Temp\eiarvyefqj.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hf6mArzo.bat

Path C:\Users\Admin\AppData\Local\Temp\hf6mArzo.bat
Size 196B
SHA256 2566914efe1a51be0691afccbfd3a63b4f87ab15b5711704453d1039956111ed
MD5 8c4c3621658f1104d0af9cd19000ee87
SHA1 482a646a644e052c77b8af714be0f27bd6b0f07b
SHA512 77d7aaeac8afc153b6c4f7f55fc16f89ecf177f455e99aa44ba845fa5052acd8752fec2c7c25b5835170a8afb6a35eb257d3ec2d7b5e81a9af02b8f7b191eea5
TLSH
T13BD0125243DBCA6E56C8D51F4AE15B8EC070983C7F563751AAA484DC72C280DF7D3341
MD5 SHA1 SHA512 TLSH

Submit Download

mhuxxfwlov.exe

Path C:\Users\Admin\AppData\Local\Temp\mhuxxfwlov.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 2b5ca0c74a700668079ef6ce6ce9372b3db2af2f1c9b7e4bb8938fa94c4f6138
MD5 f524d875263c2cfe683d032650f9043e
SHA1 c23d4791eb4614a35d97c3aaa02244d242e0f979
SHA512 55bbfe290ca2f3ff459934354c81868c999a28c3c78222a765cdd3b90852426d4f7b404845d89e61c2996d7dfb3eabd0309d1e27fccbd1e6eec4a11d56b716d5
TLSH
T11D21E3AE0BC3A86381BE4B66ABB8C8F7C597F44D6F90174581437622C35B4EE531864F
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4416-21-0x0000021ACBAC0000-0x0000021ACBAD0000-memory.dmp

Download

memory/4416-37-0x0000021ACBBC0000-0x0000021ACBBD0000-memory.dmp

Download

memory/4416-53-0x0000021AD40B0000-0x0000021AD40B8000-memory.dmp

Download

memory/4416-65-0x0000021AD5740000-0x0000021AD5748000-memory.dmp

Download

memory/4772-20-0x00000000000C0000-0x000000000023A000-memory.dmp

Download

memory/4772-177-0x00000000000C0000-0x000000000023A000-memory.dmp

Download

memory/5024-92-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-87-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-72-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-71-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-70-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-82-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-81-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-80-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-79-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-78-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-77-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-76-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-75-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-74-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-73-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-83-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-84-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-85-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-98-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-97-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-96-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-95-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-94-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-93-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-67-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-91-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-90-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-89-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-88-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-69-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-86-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-99-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-100-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-101-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-114-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-113-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-112-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-111-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-110-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-109-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-108-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-107-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-106-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-105-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-104-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-103-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-102-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-126-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-125-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-124-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-123-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-122-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-121-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-120-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-119-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-118-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-68-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-117-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-116-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download

memory/5024-115-0x000001E9FE4E0000-0x000001E9FE4F0000-memory.dmp

Download