870505d12a09039174acc83895c2684b50c3fefc4d9896c3cc3a01e9dbb1fd85

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_918c06cc480731fc10489650e3ff2107_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 740KB
Sample260809-rcbdssstfv
SHA256 870505d12a09039174acc83895c2684b50c3fefc4d9896c3cc3a01e9dbb1fd85
MD5 918c06cc480731fc10489650e3ff2107
SHA1 544ef20ef992b8e7624969c9f0c1c00df7a7bad3
SHA512 d71e071149df54192a5c21b66da47e577f5817b7b591a79b790adacc72eb74828e2f59a2b9d011cf361361d0b2e446dea756595050e5e2b42134c7b9e12f1039
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxME:1hLalj3DSudvGM3MXTVhtSQWGtxZ
TLSH
T145F41221B2948032F06752348EB9D7A18B3EBE525BA484DF7788066F2EB16D5DF30357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution upx

Malware Config

Signatures

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral1/memory/2260-137-0x0000000000040000-0x00000000001BA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral1/memory/2260-137-0x0000000000040000-0x00000000001BA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/2260-20-0x0000000000040000-0x00000000001BA000-memory.dmp	UPX
behavioral1/files/0x000700000002441e-14.dat	UPX
behavioral1/memory/2260-137-0x0000000000040000-0x00000000001BA000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-08-09_918c06cc480731fc10489650e3ff2107_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	nlauyjohti.exe

Executes dropped EXE 3 IoCs

pid	Process
2996	nlauyjohti.exe
2260	cnrjeirtds.exe
2848	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wideshut.exe	cnrjeirtds.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	cnrjeirtds.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	cnrjeirtds.exe
File created	C:\Windows\SysWOW64\racfg.exe	cnrjeirtds.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	cnrjeirtds.exe
File created	C:\Windows\system32\msfte.dll	cnrjeirtds.exe
File created	C:\Windows\system32\oci.dll	cnrjeirtds.exe
File created	C:\Windows\System32\bindsvc.exe	cnrjeirtds.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2260-20-0x0000000000040000-0x00000000001BA000-memory.dmp	upx
behavioral1/files/0x000700000002441e-14.dat	upx
behavioral1/memory/2260-137-0x0000000000040000-0x00000000001BA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
388	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3692	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlauyjohti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cnrjeirtds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_918c06cc480731fc10489650e3ff2107_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2bb8db80728dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099b9cbb80728dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000101dceb80728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bea799b80728dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000219102b90728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af1dafb80728dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a82d00b90728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049dd10b90728dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2260	cnrjeirtds.exe
2260	cnrjeirtds.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	3548	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3548	SearchIndexer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2996	556	2026-08-09_918c06cc480731fc10489650e3ff2107_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	85
PID 556 wrote to memory of 2260	556	2026-08-09_918c06cc480731fc10489650e3ff2107_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	86
PID 3548 wrote to memory of 5096	3548	SearchIndexer.exe	88
PID 3548 wrote to memory of 4996	3548	SearchIndexer.exe	89
PID 2260 wrote to memory of 2240	2260	cnrjeirtds.exe	90
PID 2240 wrote to memory of 388	2240	cmd.exe	92
PID 2260 wrote to memory of 3692	2260	cnrjeirtds.exe	93
PID 2260 wrote to memory of 2848	2260	cnrjeirtds.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-09_918c06cc480731fc10489650e3ff2107_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_918c06cc480731fc10489650e3ff2107_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\nlauyjohti.exe
  "C:\Users\Admin\AppData\Local\Temp\nlauyjohti.exe" "C:\Users\Admin\AppData\Local\Temp\fhdynkmisc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_918c06cc480731fc10489650e3ff2107_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\cnrjeirtds.exe
  C:\Users\Admin\AppData\Local\Temp\cnrjeirtds.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\YfzU0oX6.bat"
    3⤵
    - Executes a command shell one-liner
    PID:3692
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2848

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5096
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YfzU0oX6.bat

Path C:\Users\Admin\AppData\Local\Temp\YfzU0oX6.bat
Size 196B
SHA256 29942f963d3a23a9b5cf621d6718160a44f512c928808497b6c284be41d0656c
MD5 0bfc120cb70261264f29423c34b22aa1
SHA1 b608e42565aff3590385368ef68f48534d49081b
SHA512 46e43f1008ac72e39c32157f3e8d5aaf216542ab72eb5a441e48d1e2594dd8692b493935c96b8349a63b7e533823da9d55a608f6dd1d5d9dda47547d58408629
TLSH
T136D0C71142F7CE5E0444D15F16B1518E8061A8AC3F8627127A558898719640DB5D2342
MD5 SHA1 SHA512 TLSH

Submit Download

cnrjeirtds.exe

Path C:\Users\Admin\AppData\Local\Temp\cnrjeirtds.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhdynkmisc.exe

Path C:\Users\Admin\AppData\Local\Temp\fhdynkmisc.exe
Size 34KB
SHA256 d3770593c7c3b85acba86281237fcbd2f0f3517a3d5aa46099018166ebb2a6eb
MD5 9300b00d1324c98f9afd030273a3208e
SHA1 c8b91166bd460156a0b98d39913657e49d1e40e0
SHA512 2e15a87bea5b3878ad3fa8e75f5c740d1baf88f3d78f62ab609dfb8c815e0f41527cf062c2fda701eed16773a4d9a849b29501ab89540c146b1071a3999b93f9
SSDEEP 384:rZPBUu5UyDWWcynwW7H0xnTrgmnkS6ZpaFIJiUea02ud2zpOpm2mSQaNQWmc22OQ:XFLDJnxUxPgmDnKPeaUres++zwcR
TLSH
T1FDF23A02D384C273F91A4F7C1EA6D651D3BDF74567828F8F26588B1E3CA63944A31B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlauyjohti.exe

Path C:\Users\Admin\AppData\Local\Temp\nlauyjohti.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2260-20-0x0000000000040000-0x00000000001BA000-memory.dmp

Download

memory/2260-137-0x0000000000040000-0x00000000001BA000-memory.dmp

Download

memory/3548-21-0x0000022D670F0000-0x0000022D67100000-memory.dmp

Download

memory/3548-37-0x0000022D67330000-0x0000022D67340000-memory.dmp

Download

memory/3548-53-0x0000022D6F6E0000-0x0000022D6F6E8000-memory.dmp

Download

memory/4996-81-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-74-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-67-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-68-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-69-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-70-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-71-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-72-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-73-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-96-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-95-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-94-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-93-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-92-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-91-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-90-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-89-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-88-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-87-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-86-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-85-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-84-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-83-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-82-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-66-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-80-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-79-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-78-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-77-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-76-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-75-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-65-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-97-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-98-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-125-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-124-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-123-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-122-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-121-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-120-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-119-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-118-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-117-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-116-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-115-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-114-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-113-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-112-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-111-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-110-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-109-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-108-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-107-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-106-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-105-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-103-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-104-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-102-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-101-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-100-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download

memory/4996-99-0x000001D94D2F0000-0x000001D94D300000-memory.dmp

Download