9452f98e1f6eae18fbef56a876aa8daa02fcd372e8e4b404f6a2b71a84183034

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 782KB
Sample260823-d67gfaxtcy
SHA256 9452f98e1f6eae18fbef56a876aa8daa02fcd372e8e4b404f6a2b71a84183034
MD5 a1846893e866b8cc9192bb0d30489a8f
SHA1 cbbb5b88277e7833c83305a1fd467192208e491f
SHA512 45d115f31a0bb5ed110c39cefbbd2e9c296024baab0e4d7ac682aa4271ee579787b888b36d2a12acbabfdf6c7bbb28c298f29a26746377ee9d0473465c43f85b
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx+cXh:1hLalj3DSudvGM3MXTVhtSQWGtx+cXh
TLSH
T1B7051221B5D18032F06351308AB9DBB29B2FBD625BB480CF678845AE1E716E1DF3535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution upx

Malware Config

Signatures

Detects Reflective DLL injection artifacts 3 IoCs

resource	yara_rule
behavioral1/memory/4328-16-0x0000000000630000-0x00000000007AA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/4328-186-0x0000000000630000-0x00000000007AA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/4328-195-0x0000000000630000-0x00000000007AA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 3 IoCs

resource	yara_rule
behavioral1/memory/4328-16-0x0000000000630000-0x00000000007AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4328-186-0x0000000000630000-0x00000000007AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4328-195-0x0000000000630000-0x00000000007AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x00090000000244c2-13.dat	UPX
behavioral1/memory/4328-16-0x0000000000630000-0x00000000007AA000-memory.dmp	UPX
behavioral1/memory/4328-186-0x0000000000630000-0x00000000007AA000-memory.dmp	UPX
behavioral1/memory/4328-195-0x0000000000630000-0x00000000007AA000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	rljrmzvmop.exe

Executes dropped EXE 4 IoCs

pid	Process
3092	rljrmzvmop.exe
4328	lwzbytizvu.exe
4580	2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1056	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wideshut.exe	lwzbytizvu.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	lwzbytizvu.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	lwzbytizvu.exe
File created	C:\Windows\SysWOW64\racfg.exe	lwzbytizvu.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	lwzbytizvu.exe
File created	C:\Windows\system32\msfte.dll	lwzbytizvu.exe
File created	C:\Windows\system32\oci.dll	lwzbytizvu.exe
File created	C:\Windows\System32\bindsvc.exe	lwzbytizvu.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000244c2-13.dat	upx
behavioral1/memory/4328-16-0x0000000000630000-0x00000000007AA000-memory.dmp	upx
behavioral1/memory/4328-186-0x0000000000630000-0x00000000007AA000-memory.dmp	upx
behavioral1/memory/4328-195-0x0000000000630000-0x00000000007AA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3724	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljrmzvmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lwzbytizvu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4aa20dbb032dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0ceded9b032dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006659aad9b032dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc09bbd9b032dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ccbfdd9b032dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f92e3d9b032dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	lwzbytizvu.exe
4328	lwzbytizvu.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	4824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4824	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3092	1448	2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	85
PID 1448 wrote to memory of 4328	1448	2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	86
PID 4824 wrote to memory of 3392	4824	SearchIndexer.exe	88
PID 4824 wrote to memory of 5028	4824	SearchIndexer.exe	89
PID 3092 wrote to memory of 4580	3092	rljrmzvmop.exe	90
PID 4328 wrote to memory of 1708	4328	lwzbytizvu.exe	96
PID 1708 wrote to memory of 3724	1708	cmd.exe	98
PID 4328 wrote to memory of 2456	4328	lwzbytizvu.exe	99
PID 4328 wrote to memory of 1056	4328	lwzbytizvu.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\rljrmzvmop.exe
  "C:\Users\Admin\AppData\Local\Temp\rljrmzvmop.exe" "C:\Users\Admin\AppData\Local\Temp\guwqubzmlj.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Users\Admin\AppData\Local\Temp\2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_a1846893e866b8cc9192bb0d30489a8f_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4580
- C:\Users\Admin\AppData\Local\Temp\lwzbytizvu.exe
  C:\Users\Admin\AppData\Local\Temp\lwzbytizvu.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jJ4HDt1G.bat"
    3⤵
    - Executes a command shell one-liner
    PID:2456
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3392
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guwqubzmlj.exe

Path C:\Users\Admin\AppData\Local\Temp\guwqubzmlj.exe
Size 76KB
SHA256 2c77581dde3aa46b7a280e6f628c0fa571b1f1dc6b3161efeb07b68aee6ae94a
MD5 54b54716f35654dbeaf9e638f050b875
SHA1 af325ecb749dbbc4aa87ab2b99f30b5f1d650265
SHA512 103a39190c1c25ca7258dcd82b341ec192c57b9982e2a839130a126fe64c1143122dbed567d728d15c64663d5f204f6481de06d2c6f839e06a4eebbe4ce2c4c6
SSDEEP 384:Bs9K5Kg+WPo3IcX1nS1pCMjNf2Fxuml+9oLayySgRjhP2EhisGoH2xQ5OerW:Bs9Kp5PoYcX8XxjNeJaxpdosGoH2GOz
TLSH
T12A738C27BEE24072D897423058759BBB6B7BBE72073185CB8B509A5E2D320E1CD76307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jJ4HDt1G.bat

Path C:\Users\Admin\AppData\Local\Temp\jJ4HDt1G.bat
Size 196B
SHA256 3ca655da8f53ca0d0673edacc44448bee66d99a1cc6098fc509603dd80e39ebf
MD5 ae6f252d4bc67df86ae9a9f996b303a7
SHA1 6a13ec1fba8e91d0fecc82f95e152f98f75eff1a
SHA512 a364c6c50e82fde82a969a837c20c47a005accf1fb308f2ef859d073f835f013d6c2e34d0bd069167aba951e1be984bbd98d354980eb87d48d12f8722e4b7a44
TLSH
T11CD0129167DBCA5F0889912B1EF152CEC160895C3F4737127A20C48D72C340EB9C3301
MD5 SHA1 SHA512 TLSH

Submit Download

lwzbytizvu.exe

Path C:\Users\Admin\AppData\Local\Temp\lwzbytizvu.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljrmzvmop.exe

Path C:\Users\Admin\AppData\Local\Temp\rljrmzvmop.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 d473f886769e48ebbaf45acacd41bc86e907373e1b271d2e455956e0b9cc8a1d
MD5 bfdb1cdaedb214982d6190c577c7c7e4
SHA1 bff973902cabe47b357bf8ad41fc7f44cfc84f68
SHA512 21dc6f6c05fa2d70402ee4ec5cc73da8a4e32b213a185629053c4cb35f74839e1017d648fc3a32b0c55b0cf7b6dfe7eeaf910d7558278cd4fc6b7ab637f0cfad
TLSH
T13F21345B0BE23833813A4764ABB9C5FBC953E16D5EA0A70681737B31C3538E9031C49E
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4328-16-0x0000000000630000-0x00000000007AA000-memory.dmp

Download

memory/4328-186-0x0000000000630000-0x00000000007AA000-memory.dmp

Download

memory/4328-195-0x0000000000630000-0x00000000007AA000-memory.dmp

Download

memory/4580-67-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4580-184-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4824-53-0x0000016F21140000-0x0000016F21148000-memory.dmp

Download

memory/4824-68-0x0000016F223D0000-0x0000016F223D8000-memory.dmp

Download

memory/4824-21-0x0000016F18B50000-0x0000016F18B60000-memory.dmp

Download

memory/4824-37-0x0000016F18D80000-0x0000016F18D90000-memory.dmp

Download

memory/5028-95-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-102-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-73-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-85-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-84-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-83-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-82-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-81-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-80-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-79-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-78-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-77-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-76-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-86-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-87-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-101-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-100-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-99-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-98-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-97-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-96-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-75-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-94-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-93-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-92-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-91-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-90-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-89-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-88-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-74-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-103-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-104-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-105-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-106-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-107-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-108-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-112-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-114-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-115-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-117-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-116-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-113-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-111-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-110-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-109-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-118-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-119-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-129-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-128-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-127-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-126-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-125-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-124-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-123-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-70-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-71-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-72-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-122-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-121-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download

memory/5028-120-0x00000216E1770000-0x00000216E1780000-memory.dmp

Download