Overview

overview

10

Static

static

10

2026-08-09...op.exe

windows10-2004-x64

9

2026-08-09...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 13:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_ecf141b424bad23aecf2a590f077ded3_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
  • Size 728KB
  • Sample260809-qqbfaaybre
  • SHA256 f8020847ef45f32fc7a0eb207c81b96e3148566967d6460f0828e4ac44029afd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionupx

Malware Config

Signatures

  • Detects Reflective DLL injection artifacts 2 IoCs
  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 7 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_ecf141b424bad23aecf2a590f077ded3_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_ecf141b424bad23aecf2a590f077ded3_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5840
    • C:\Users\Admin\AppData\Local\Temp\lrpanczkoa.exe
      "C:\Users\Admin\AppData\Local\Temp\lrpanczkoa.exe" "C:\Users\Admin\AppData\Local\Temp\knkbdyxqco.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_ecf141b424bad23aecf2a590f077ded3_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3516
      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_ecf141b424bad23aecf2a590f077ded3_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-09_ecf141b424bad23aecf2a590f077ded3_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
        3⤵
        • Executes dropped EXE
        PID:5708
    • C:\Users\Admin\AppData\Local\Temp\wdescazoor.exe
      C:\Users\Admin\AppData\Local\Temp\wdescazoor.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\System32\cmd.exe
        /c sc config msdtc obj= LocalSystem
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Windows\system32\sc.exe
          sc config msdtc obj= LocalSystem
          4⤵
          • Launches sc.exe
          PID:4216
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\QHDeoF24.bat"
        3⤵
        • Executes a command shell one-liner
        PID:6060
      • C:\Windows\System32\bindsvc.exe
        "C:\Windows\System32\bindsvc.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:244
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Modifies data under HKEY_USERS
      PID:2804
    • C:\Windows\System32\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
        PID:2648
      • C:\Windows\System32\SearchFilterHost.exe
        "C:\Windows\System32\SearchFilterHost.exe" 844 2760 2788 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
        2⤵
          PID:1708
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 844 2812 2824 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
          • Modifies data under HKEY_USERS
          PID:1284
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2204
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 844 2812 2824 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
          2⤵
            PID:5376
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 844 2760 2788 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:3848

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                Windows.db
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                • Size 968KB
                • SHA256 cfb24b9f0b3b55c6371e04709a91afa7e2ec4a3ec701e26d39c23264880bc3b7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows.db-wal
                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                • Size 1.3MB
                • SHA256 f2e2c368247140d9094f1005b4f5f4408cf65169946ccf27c712cc42e943c09d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                QHDeoF24.bat
                • Path C:\Users\Admin\AppData\Local\Temp\QHDeoF24.bat
                • Size 196B
                • SHA256 e99ded91f0262c46955f19b8183ffce51ff283a22bb538e45b8c752b58ca58c8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                knkbdyxqco.exe
                • Path C:\Users\Admin\AppData\Local\Temp\knkbdyxqco.exe
                • Size 22KB
                • SHA256 37c8378fd7c883e77e2fd211c8a759b61037168bdec87c234c73082c50b7f0cc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                lrpanczkoa.exe
                • Path C:\Users\Admin\AppData\Local\Temp\lrpanczkoa.exe
                • Size 51KB
                • SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wdescazoor.exe
                • Path C:\Users\Admin\AppData\Local\Temp\wdescazoor.exe
                • Size 580KB
                • SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                trnmg.sdb
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
                • Size 1KB
                • SHA256 0ecf8103df6b0fe0f1f43eb359aa6fda8bd76e4653b54a96224efd98f422baea
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                bindsvc.exe
                • Path C:\Windows\System32\bindsvc.exe
                • Size 291KB
                • SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/572-34-0x0000000000780000-0x00000000008FA000-memory.dmp
                Download

                memory/572-25-0x0000000000780000-0x00000000008FA000-memory.dmp
                Download

                memory/572-16-0x0000000000780000-0x00000000008FA000-memory.dmp
                Download

                memory/1284-56-0x000001E7CB370000-0x000001E7CB5FB000-memory.dmp
                Download

                memory/2920-46-0x000001B0E1B30000-0x000001B0E1DCE000-memory.dmp
                Download