d5bffcbe747fb154bedcb27206ad3d496fab09da82e968c649a21d4867813ac7

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe
Size 1.2MB
Sample260809-rr2vasag98
SHA256 d5bffcbe747fb154bedcb27206ad3d496fab09da82e968c649a21d4867813ac7
MD5 4eefbd1c3ceec49e01872baa5e095fb5
SHA1 79aa04f10a5ebbcac1143746e2192c374016e913
SHA512 3d6f68700aec9b9c1453277cc68631bc176581fc7602bf9ce72926590de26197dbc530d048cbd29464ca887a549bf60c95e56bd7794dda4d6182dff6725d8a5a
SSDEEP 12288:gmhj4P+t1YdUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxkLP+t1g:Xh5+alj3DSudvGM3MXTVhtSQWGtxkgm
TLSH
T1FA45BF606353CC95C1478430CA28E3B145176C29A6A565EF33A53F6F3B7A9C29F21A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution upx

Malware Config

Signatures

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/4072-137-0x0000000000D50000-0x0000000000ECA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/4072-145-0x0000000000D50000-0x0000000000ECA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/4072-137-0x0000000000D50000-0x0000000000ECA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4072-145-0x0000000000D50000-0x0000000000ECA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e6a4-14.dat	UPX
behavioral1/memory/4072-15-0x0000000000D50000-0x0000000000ECA000-memory.dmp	UPX
behavioral1/memory/4072-137-0x0000000000D50000-0x0000000000ECA000-memory.dmp	UPX
behavioral1/memory/4072-145-0x0000000000D50000-0x0000000000ECA000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	hlqjkfwbnb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe

Executes dropped EXE 4 IoCs

pid	Process
2608	hlqjkfwbnb.exe
4072	upefxcierf.exe
3008	2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe
3564	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\bindsvc.exe	upefxcierf.exe
File created	C:\Windows\SysWOW64\wideshut.exe	upefxcierf.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	upefxcierf.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	upefxcierf.exe
File created	C:\Windows\SysWOW64\racfg.exe	upefxcierf.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	upefxcierf.exe
File created	C:\Windows\system32\msfte.dll	upefxcierf.exe
File created	C:\Windows\system32\oci.dll	upefxcierf.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000300000001e6a4-14.dat	upx
behavioral1/memory/4072-15-0x0000000000D50000-0x0000000000ECA000-memory.dmp	upx
behavioral1/memory/4072-137-0x0000000000D50000-0x0000000000ECA000-memory.dmp	upx
behavioral1/memory/4072-145-0x0000000000D50000-0x0000000000ECA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4840	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5084	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hlqjkfwbnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upefxcierf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000057395130b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f86c30140b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0d2f4130b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e73b4130b28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d16d11140b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c91b60140b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fbc1f140b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d0cf0130b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000820fb2130b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea1093130b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4072	upefxcierf.exe
4072	upefxcierf.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	3032	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 2608	876	2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe	86
PID 876 wrote to memory of 4072	876	2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe	87
PID 3032 wrote to memory of 1792	3032	SearchIndexer.exe	89
PID 3032 wrote to memory of 4016	3032	SearchIndexer.exe	90
PID 2608 wrote to memory of 3008	2608	hlqjkfwbnb.exe	91
PID 4072 wrote to memory of 4768	4072	upefxcierf.exe	92
PID 4768 wrote to memory of 4840	4768	cmd.exe	94
PID 4072 wrote to memory of 5084	4072	upefxcierf.exe	95
PID 4072 wrote to memory of 3564	4072	upefxcierf.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Local\Temp\hlqjkfwbnb.exe
  "C:\Users\Admin\AppData\Local\Temp\hlqjkfwbnb.exe" "C:\Users\Admin\AppData\Local\Temp\ymdvtbnzyu.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_4eefbd1c3ceec49e01872baa5e095fb5_amadey_coinminer_darkgate_elex_manuscrypt_redline-steale.exe"
    3⤵
    - Executes dropped EXE
    PID:3008
- C:\Users\Admin\AppData\Local\Temp\upefxcierf.exe
  C:\Users\Admin\AppData\Local\Temp\upefxcierf.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\n0YIa1QN.bat"
    3⤵
    - Executes a command shell one-liner
    PID:5084
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3564

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1792
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hlqjkfwbnb.exe

Path C:\Users\Admin\AppData\Local\Temp\hlqjkfwbnb.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n0YIa1QN.bat

Path C:\Users\Admin\AppData\Local\Temp\n0YIa1QN.bat
Size 196B
SHA256 c37c347b32b7f79463413d8b61a1aa9f58dd1378bd41aa4db2eced242e471988
MD5 ce5169ce6de98fc2b5a5e14a2d1ba6ab
SHA1 3eea6f50ac39bf52fbcf5d9e7ec5de9b947d74d8
SHA512 0227b524568901577ffb6c98ab5f4b7d2ff24277a6cf445a2755ba1accf2c5c62b9aa9797309cac1c96a340305f675d85443ea96e72e59298e82637515282ae0
TLSH
T1C9D012A183EBEA9F088C912B06A2528ED4A1881C7F4A3725767D858831C640DB9E3341
MD5 SHA1 SHA512 TLSH

Submit Download

upefxcierf.exe

Path C:\Users\Admin\AppData\Local\Temp\upefxcierf.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ymdvtbnzyu.exe

Path C:\Users\Admin\AppData\Local\Temp\ymdvtbnzyu.exe
Size 284KB
SHA256 446155f3ab94bf33db91e7c2c1eed57ed449d82710bfc96dfa07dba1d346399e
MD5 a005676b30aeb3c7703c317d992b193a
SHA1 236f195e2e5f6f613be8f6d924061ff8985b258b
SHA512 4958bb1f70d5c499ffedf3bd7c7c1c7e894b2119ad28a2c0a3838a9fe183890b0c24584f89824be6c275d6e916715b9e167e5706d95b37b327c49896e95314d6
SSDEEP 3072:z6tdq0swIP+WVnyL8QhJmxn90RAqt/7kDX1+WrlSs:+PqXznUAFA9tkU65
TLSH
T18F5418606343CC99C2468830C928E3F144276C29A5A565EF37A53F5F7B7A9829F11E3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 99186b43ae5dc7a134f76c3dc3e5104f69a14c5cbd46ab6a0968368adac6e3f6
MD5 eb2e974c93122488e71a50948c0da881
SHA1 067a5ea7d74fdc232ded6d8edb184775e087c5b9
SHA512 073dade22bfd9cce4addb361ea22fda96693ab93e8c29290dd1abbadc9da86fa82d1955b73ecc1c0bfda3b7d964e4820a9451fef0db32402adf5def0ab01fe22
TLSH
T196213D6A1B873833817987649BB4D4F7CA97F40D5E9087468252BB35C757CEE031898F
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3032-37-0x0000021E5A060000-0x0000021E5A070000-memory.dmp

Download

memory/3032-21-0x0000021E59E30000-0x0000021E59E40000-memory.dmp

Download

memory/3032-53-0x0000021E62420000-0x0000021E62428000-memory.dmp

Download

memory/3032-67-0x0000021E63AA0000-0x0000021E63AA8000-memory.dmp

Download

memory/4016-99-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-91-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-71-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-72-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-74-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-73-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-75-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-76-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-84-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-83-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-82-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-81-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-80-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-79-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-78-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-77-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-85-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-86-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-88-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-89-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-90-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-87-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-92-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-96-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-95-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-100-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-69-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-98-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-97-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-94-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-93-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-70-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-116-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-115-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-114-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-113-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-112-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-111-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-110-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-109-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-108-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-107-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-106-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-104-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-105-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-103-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-102-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-101-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-117-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-118-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-119-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-128-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-127-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-126-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-125-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-124-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-123-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-122-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-121-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4016-120-0x0000019B92590000-0x0000019B925A0000-memory.dmp

Download

memory/4072-15-0x0000000000D50000-0x0000000000ECA000-memory.dmp

Download

memory/4072-137-0x0000000000D50000-0x0000000000ECA000-memory.dmp

Download

memory/4072-145-0x0000000000D50000-0x0000000000ECA000-memory.dmp

Download