ramsay | a668ebbb215e83d18b3510ffcc85b0cccdb8dc9f2cb5410e9273adac84434c27

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.6MB
Sample260928-v3dhmaca58
SHA256 a668ebbb215e83d18b3510ffcc85b0cccdb8dc9f2cb5410e9273adac84434c27
MD5 2171c956396c16f825f48c3b358e4249
SHA1 d3a7dd7fcea7dec5b08623c6e177379d1c8114b8
SHA512 eed00ff6ff319c6e2a88acbd4c11297a8ee3bb339fe6ff34e93703eed7dad5b66aa9aee72010a544a957c7546c371681bd80a0ea3648095a991fced85b224f2d
SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtx8EMWOX6jKvSM4Smw+bI0YLoOQ2xiAn5Vqkir:1hLoBdqTDtSQWGtG3RVaxrbIRoWiA5o7
TLSH
T1C485AE10FB87A0F2E92301704996E3BB9330F611C425DEB7FB9D5B5EF923552293621A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/1740-20-0x0000000000780000-0x00000000008FA000-memory.dmp	family_ramsay_payload
behavioral1/memory/1740-179-0x0000000000780000-0x00000000008FA000-memory.dmp	family_ramsay_payload
behavioral1/files/0x0007000000024454-178.dat	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/1740-20-0x0000000000780000-0x00000000008FA000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/1740-179-0x0000000000780000-0x00000000008FA000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/1740-20-0x0000000000780000-0x00000000008FA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/1740-179-0x0000000000780000-0x00000000008FA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/1740-20-0x0000000000780000-0x00000000008FA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/1740-179-0x0000000000780000-0x00000000008FA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000002444f-13.dat	UPX
behavioral1/memory/1740-20-0x0000000000780000-0x00000000008FA000-memory.dmp	UPX
behavioral1/memory/1740-179-0x0000000000780000-0x00000000008FA000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	vfzkdgrgtm.exe

Executes dropped EXE 4 IoCs

pid	Process
3180	vfzkdgrgtm.exe
1740	ggxktwqzje.exe
4648	2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4508	bindsvc.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\D:\	bindsvc.exe
\??\F:\	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wimsvc.exe	ggxktwqzje.exe
File created	C:\Windows\SysWOW64\racfg.exe	ggxktwqzje.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	ggxktwqzje.exe
File created	C:\Windows\system32\msfte.dll	ggxktwqzje.exe
File created	C:\Windows\system32\oci.dll	ggxktwqzje.exe
File created	C:\Windows\System32\bindsvc.exe	ggxktwqzje.exe
File created	C:\Windows\SysWOW64\wideshut.exe	ggxktwqzje.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	ggxktwqzje.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002444f-13.dat	upx
behavioral1/memory/1740-20-0x0000000000780000-0x00000000008FA000-memory.dmp	upx
behavioral1/memory/1740-179-0x0000000000780000-0x00000000008FA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
212	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1860	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bindsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bindsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vfzkdgrgtm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ggxktwqzje.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000647654126f4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002034f4126f4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc9b7a126f4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000deadac126f4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009d7a9d136f4fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000376c4c136f4fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b1c5d136f4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d53032136f4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8c0bf126f4fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	ggxktwqzje.exe
1740	ggxktwqzje.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	4980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4980	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3180	760	2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 760 wrote to memory of 1740	760	2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	92
PID 4980 wrote to memory of 684	4980	SearchIndexer.exe	94
PID 4980 wrote to memory of 1256	4980	SearchIndexer.exe	95
PID 3180 wrote to memory of 4648	3180	vfzkdgrgtm.exe	96
PID 1740 wrote to memory of 2296	1740	ggxktwqzje.exe	105
PID 2296 wrote to memory of 212	2296	cmd.exe	107
PID 1740 wrote to memory of 1860	1740	ggxktwqzje.exe	108
PID 1740 wrote to memory of 4508	1740	ggxktwqzje.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\vfzkdgrgtm.exe
  "C:\Users\Admin\AppData\Local\Temp\vfzkdgrgtm.exe" "C:\Users\Admin\AppData\Local\Temp\gqmxqdhpbj.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Users\Admin\AppData\Local\Temp\2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:4648
- C:\Users\Admin\AppData\Local\Temp\ggxktwqzje.exe
  C:\Users\Admin\AppData\Local\Temp\ggxktwqzje.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dx2P8T7b.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1860
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:684
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dx2P8T7b.bat

Path C:\Users\Admin\AppData\Local\Temp\dx2P8T7b.bat
Size 196B
SHA256 54396a2548428454028ef3c9ed7984c6f8be799d3808628ed9c77acfb7296f80
MD5 03dc1991dcb1f1596c3dc03c48ed08f5
SHA1 c53c41426dfa7d0723ea3278ea99acfbbf818641
SHA512 d7f8fd3890750692d27982055ce5a43d39237ff0a2ac842e5e272bf78ff80f78b090ca6120d7066367750fda37b2d3fe734aa00689546ecd645d6c40e4a9df7a
TLSH
T1BBD0121287DBCB6E144C916B06A5978DC0A5982C3F472721B7A5D44931CB50DB6D3303
MD5 SHA1 SHA512 TLSH

Submit Download

ggxktwqzje.exe

Path C:\Users\Admin\AppData\Local\Temp\ggxktwqzje.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gqmxqdhpbj.exe

Path C:\Users\Admin\AppData\Local\Temp\gqmxqdhpbj.exe
Size 973KB
SHA256 28dc6495b834cead5a6f3fa9eb10edff2b56bd8a8afd838383e65f7454845d3d
MD5 d3a5b7dc8e19b07c8a570499b6567cfe
SHA1 1ed6b953c32c2157954e1638871c1aa119124caf
SHA512 6960a4f66e765e5e885639ac43fda9d3dcc2f8c34fde0e94dc8e358ad1415247a1e8a5a73e027c5212f6caa99084e92bb061a262d670c370cbc0750eb38c854f
SSDEEP 24576:zEMWOX6jKvSM4Smw+bI0YLoOQ2xiAn5VqkiL:z3RVaxrbIRoWiA5ob
TLSH
T189254B44FB87A4F2E927057049C7E3BB9330E211C025DEB2FB9D9B5EF9235122936619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vfzkdgrgtm.exe

Path C:\Users\Admin\AppData\Local\Temp\vfzkdgrgtm.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 8cc2af2a993efc5a76b77c47df1265cd06807f5a3dcb402aa7c6a0ea51639783
MD5 82dfcabab44add2f13a7e6b75c2b15d3
SHA1 8057e8ee869ae576ffda7756e69d2b48805a5c20
SHA512 ab74bb854d09afafb3c054abc25a3bf0875f9191ccba1a8e72292dbdb1e9c7a39ce4ee86cb1252891392c3b58ee0f01639efd2ef6888c70077d881b8913ae01f
TLSH
T17D21079A6B537827827A4765DBB8C8F7CA53E80D5EA067868422F721C3674ED031C54E
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-87-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-114-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-85-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-69-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-73-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-74-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-72-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-79-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-80-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-81-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-84-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-83-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-82-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-78-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-77-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-76-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-75-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-100-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-99-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-98-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-97-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-96-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-95-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-94-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-93-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-92-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-91-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-90-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-89-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-88-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-70-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-86-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-71-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-102-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-123-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-103-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-104-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-106-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-105-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-116-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-115-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-101-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-113-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-112-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-110-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-111-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-109-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-108-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-107-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-118-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-117-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-119-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-122-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-121-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-120-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-126-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-125-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1256-124-0x000001E1C0B30000-0x000001E1C0B40000-memory.dmp

Download

memory/1740-179-0x0000000000780000-0x00000000008FA000-memory.dmp

Download

memory/1740-20-0x0000000000780000-0x00000000008FA000-memory.dmp

Download

memory/4980-37-0x000001D27D400000-0x000001D27D410000-memory.dmp

Download

memory/4980-21-0x000001D27D1E0000-0x000001D27D1F0000-memory.dmp

Download

memory/4980-53-0x000001D27D7C0000-0x000001D27D7C8000-memory.dmp

Download

memory/4980-57-0x000001D27E9D0000-0x000001D27E9D8000-memory.dmp

Download

memory/4980-58-0x000001D27E9C0000-0x000001D27E9C1000-memory.dmp

Download

memory/4980-60-0x000001D27E9C0000-0x000001D27E9C8000-memory.dmp

Download