321b883f300ed74d8cf57e9c5bf7aa67b9b063846ce2c7e606fa7614782a9135

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 4.5MB
Sample260809-rayfjsygmf
SHA256 321b883f300ed74d8cf57e9c5bf7aa67b9b063846ce2c7e606fa7614782a9135
MD5 98d0c32f7dbbe645c4ae32ad1b02311e
SHA1 d52247995a8b1a5428597c138dc2759e461606f2
SHA512 e320146efae06f344f7483998fcdb0e242647efe6a5564b5b1512e49c47591704bdd5b1e3bbe745c57d215867c38c7901870daa794dc2c1b799115c1f7a7a066
SSDEEP 98304:zoqTB3KnEkqIKNhPjeRVdZuTdKo8tc8jzoxu9acGOd:jggIK7PCRVdZkd0tcq+u9aZ4
TLSH
T18226AF21F18294E5D06322B0122DB677EB7CE9250F1FF8DBA680DD6D1674AC0E735A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution upx

Malware Config

Signatures

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/4916-117-0x00000000006F0000-0x000000000086A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/4916-127-0x00000000006F0000-0x000000000086A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/4916-117-0x00000000006F0000-0x000000000086A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4916-127-0x00000000006F0000-0x000000000086A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x00090000000244b5-13.dat	UPX
behavioral1/memory/4916-15-0x00000000006F0000-0x000000000086A000-memory.dmp	UPX
behavioral1/memory/4916-117-0x00000000006F0000-0x000000000086A000-memory.dmp	UPX
behavioral1/memory/4916-127-0x00000000006F0000-0x000000000086A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	knamtwlgny.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Executes dropped EXE 4 IoCs

pid	Process
1928	knamtwlgny.exe
4916	pmggvetgre.exe
772	2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
2520	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bindsvc.exe	pmggvetgre.exe
File created	C:\Windows\system32\msfte.dll	pmggvetgre.exe
File created	C:\Windows\system32\oci.dll	pmggvetgre.exe
File created	C:\Windows\System32\bindsvc.exe	pmggvetgre.exe
File created	C:\Windows\SysWOW64\wideshut.exe	pmggvetgre.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	pmggvetgre.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	pmggvetgre.exe
File created	C:\Windows\SysWOW64\racfg.exe	pmggvetgre.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000244b5-13.dat	upx
behavioral1/memory/4916-15-0x00000000006F0000-0x000000000086A000-memory.dmp	upx
behavioral1/memory/4916-117-0x00000000006F0000-0x000000000086A000-memory.dmp	upx
behavioral1/memory/4916-127-0x00000000006F0000-0x000000000086A000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1000	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
640	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	knamtwlgny.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmggvetgre.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a951a690728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0d85b680728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb67bc640728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad568a640728dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012a598640728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4916	pmggvetgre.exe
4916	pmggvetgre.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	1800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1800	SearchIndexer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1928	2352	2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	85
PID 2352 wrote to memory of 4916	2352	2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	86
PID 1800 wrote to memory of 2036	1800	SearchIndexer.exe	88
PID 1800 wrote to memory of 2660	1800	SearchIndexer.exe	90
PID 4916 wrote to memory of 3372	4916	pmggvetgre.exe	93
PID 3372 wrote to memory of 1000	3372	cmd.exe	95
PID 4916 wrote to memory of 640	4916	pmggvetgre.exe	96
PID 4916 wrote to memory of 2520	4916	pmggvetgre.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\knamtwlgny.exe
  "C:\Users\Admin\AppData\Local\Temp\knamtwlgny.exe" "C:\Users\Admin\AppData\Local\Temp\yuapdwonas.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1928
- - C:\Users\Admin\AppData\Local\Temp\2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_98d0c32f7dbbe645c4ae32ad1b02311e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:772
- C:\Users\Admin\AppData\Local\Temp\pmggvetgre.exe
  C:\Users\Admin\AppData\Local\Temp\pmggvetgre.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:1000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cMOupX9t.bat"
    3⤵
    - Executes a command shell one-liner
    PID:640
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2520

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2036
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cMOupX9t.bat

Path C:\Users\Admin\AppData\Local\Temp\cMOupX9t.bat
Size 196B
SHA256 9d4ca9231d6e229f492c79f410632966c6857d66a9e8c38fd113de3c0584b607
MD5 cfaba70fd2e6a27123e6fbd158891f38
SHA1 c08e655e6d0982679bfa0fcbc9ce0daa92b1efa8
SHA512 3e31fa5a6542bd8e0bc79836c992ea2ff23c8646c94dedea0e7ab4e433f0cf00b07b2f1a0c8ef7731544a0ff55e5c9ff9fe41213d2505d9b1f1054a05c23500a
TLSH
T11BD01211C2EBCA6F444C912B0AA1DA8EC0B48C2C3F9B27217B31C49831D390DBDD3302
MD5 SHA1 SHA512 TLSH

Submit Download

knamtwlgny.exe

Path C:\Users\Admin\AppData\Local\Temp\knamtwlgny.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmggvetgre.exe

Path C:\Users\Admin\AppData\Local\Temp\pmggvetgre.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yuapdwonas.exe

Path C:\Users\Admin\AppData\Local\Temp\yuapdwonas.exe
Size 3.8MB
SHA256 e497bc1220e4c02fa5402a962bcfa121582999da00eaea6017ddd455f5796706
MD5 4d59f470985d08139e42d15842816c47
SHA1 ef31a02e25904e6eb225758a7b0adaf19404031c
SHA512 c168c96b82b10227b8112e6783eb11a74b15212cf19b8861df933a1b0f96b0648b536ec3a53fcdac257fa3ea907b20347f5dc981176c44d68307b15a7e459319
SSDEEP 98304:FnEkqIKNhPjeRVdZuTdKo8tc8jzoxu9acGO5:VgIK7PCRVdZkd0tcq+u9aZq
TLSH
T15B069E21F18294E5D06322B0122DB677EB7CE9250F1FF8DBA680DD6D1674AC0E735A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 24a20d609dfa1e2202eef897a519a5d72057fee00f99fade18e7fda184b12830
MD5 72ae7f4cedc0dfa8730eab00d26078f9
SHA1 c4bb0eca9252660651a7154a1117fd5cd11e0765
SHA512 e6aea6e638ef14ccfdf1e6dc3fa788a28bd79c79b8785c84e704ba88893767a54be94a4a6ada34edfe12c145310e3ba5d52b949e6d6dfcef90a74d34f32b1011
TLSH
T104214C9E1B813867823A47641FB8C4F7CA53F41D5EC04742921ABB21C29B9ED4B1C49E
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1800-21-0x000001B3A4010000-0x000001B3A4020000-memory.dmp

Download

memory/1800-37-0x000001B3A4110000-0x000001B3A4120000-memory.dmp

Download

memory/1800-53-0x000001B3AC600000-0x000001B3AC608000-memory.dmp

Download

memory/1800-139-0x000001B3AF530000-0x000001B3AF531000-memory.dmp

Download

memory/1800-138-0x000001B3AF540000-0x000001B3AF548000-memory.dmp

Download

memory/1800-136-0x000001B3AF510000-0x000001B3AF518000-memory.dmp

Download

memory/2660-87-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-98-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-70-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-82-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-81-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-80-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-79-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-78-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-77-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-76-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-75-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-74-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-73-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-83-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-84-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-85-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-86-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-88-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-72-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-89-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-91-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-92-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-93-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-94-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-97-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-71-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-96-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-90-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-95-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-114-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-113-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-112-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-111-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-110-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-109-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-108-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-107-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-106-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-105-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-104-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-103-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-102-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-101-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-100-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-99-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-67-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-68-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/2660-69-0x0000024E01B30000-0x0000024E01B40000-memory.dmp

Download

memory/4916-117-0x00000000006F0000-0x000000000086A000-memory.dmp

Download

memory/4916-15-0x00000000006F0000-0x000000000086A000-memory.dmp

Download

memory/4916-127-0x00000000006F0000-0x000000000086A000-memory.dmp

Download