ramsay | e26be66872f534c29b11dd06cac6126fa7f3d99724b1b8e6ff0da6f800bf5859

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 733KB
Sample261002-hlmczstenb
SHA256 e26be66872f534c29b11dd06cac6126fa7f3d99724b1b8e6ff0da6f800bf5859
MD5 a65dd9117853653442c15353f68108b9
SHA1 42d70979b271e470f4b529901719cc28889ace56
SHA512 f76bbd78cc18a6a38450620462a9453c356a69828ecb082f8fc58b155afb3c58ba96265cec0f5d3b4b1466c301342e8a763d24f3ca01c684b3c6131d2eba7b1b
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxGCT1eYPe:1hLalj3DSudvGM3MXTVhtSQWGtxGCxPe
TLSH
T134F40211B1958072F06351348AB9C7728B2FBD224BB891DBB7CC59AE1F626D09F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/332-169-0x0000000000C00000-0x0000000000D7A000-memory.dmp	family_ramsay_payload
behavioral1/memory/332-178-0x0000000000C00000-0x0000000000D7A000-memory.dmp	family_ramsay_payload
behavioral1/files/0x0007000000024375-175.dat	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/332-169-0x0000000000C00000-0x0000000000D7A000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/332-178-0x0000000000C00000-0x0000000000D7A000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/332-169-0x0000000000C00000-0x0000000000D7A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/332-178-0x0000000000C00000-0x0000000000D7A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/332-169-0x0000000000C00000-0x0000000000D7A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/332-178-0x0000000000C00000-0x0000000000D7A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/332-15-0x0000000000C00000-0x0000000000D7A000-memory.dmp	UPX
behavioral1/files/0x000800000002420d-17.dat	UPX
behavioral1/memory/332-169-0x0000000000C00000-0x0000000000D7A000-memory.dmp	UPX
behavioral1/memory/332-178-0x0000000000C00000-0x0000000000D7A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	jcdjgxgotz.exe

Executes dropped EXE 4 IoCs

pid	Process
4872	jcdjgxgotz.exe
332	jxmzipvaws.exe
2108	2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4396	bindsvc.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\D:\	bindsvc.exe
\??\F:\	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wimsvc.exe	jxmzipvaws.exe
File created	C:\Windows\SysWOW64\racfg.exe	jxmzipvaws.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	jxmzipvaws.exe
File created	C:\Windows\system32\msfte.dll	jxmzipvaws.exe
File created	C:\Windows\system32\oci.dll	jxmzipvaws.exe
File created	C:\Windows\System32\bindsvc.exe	jxmzipvaws.exe
File created	C:\Windows\SysWOW64\wideshut.exe	jxmzipvaws.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	jxmzipvaws.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/332-15-0x0000000000C00000-0x0000000000D7A000-memory.dmp	upx
behavioral1/files/0x000800000002420d-17.dat	upx
behavioral1/memory/332-169-0x0000000000C00000-0x0000000000D7A000-memory.dmp	upx
behavioral1/memory/332-178-0x0000000000C00000-0x0000000000D7A000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4740	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
240	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bindsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bindsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jxmzipvaws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jcdjgxgotz.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000555386343a52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c40f61333a52dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4bdaf333a52dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cd0c2333a52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef1b0f343a52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008eb2a7343a52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6f8aa333a52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041f064343a52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
332	jxmzipvaws.exe
332	jxmzipvaws.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	3456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4872	4908	2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4908 wrote to memory of 332	4908	2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3456 wrote to memory of 2476	3456	SearchIndexer.exe	91
PID 3456 wrote to memory of 1880	3456	SearchIndexer.exe	92
PID 4872 wrote to memory of 2108	4872	jcdjgxgotz.exe	93
PID 332 wrote to memory of 1896	332	jxmzipvaws.exe	102
PID 1896 wrote to memory of 4740	1896	cmd.exe	104
PID 332 wrote to memory of 240	332	jxmzipvaws.exe	105
PID 332 wrote to memory of 4396	332	jxmzipvaws.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\jcdjgxgotz.exe
  "C:\Users\Admin\AppData\Local\Temp\jcdjgxgotz.exe" "C:\Users\Admin\AppData\Local\Temp\emqdiayesh.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\AppData\Local\Temp\2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_a65dd9117853653442c15353f68108b9_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:2108
- C:\Users\Admin\AppData\Local\Temp\jxmzipvaws.exe
  C:\Users\Admin\AppData\Local\Temp\jxmzipvaws.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\oIcUuWnt.bat"
    3⤵
    - Executes a command shell one-liner
    PID:240
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4396

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2476
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

emqdiayesh.exe

Path C:\Users\Admin\AppData\Local\Temp\emqdiayesh.exe
Size 27KB
SHA256 2fce94d1ea7d8e8feae3da15fedcbfdf80116ef4717b18f1cb069741f0eb1dc6
MD5 69bddf39015e2a5fd025c7f0c7ac34b6
SHA1 ccee073b94a0c49f21e6c2b932c5eea77a30a14f
SHA512 1be95f8a161688c1e538df2b6ffb4019930ab0540c921d7f5f30e3112fbdd0f70b4111a84d812bacad391aa133e6ffb931c8234e8b6fae25d3dbba3cbefe9678
SSDEEP 384:sSq5Rlq1I9DVQn0owTluf6nZRC46ILNrbiGPS/ykawpg5B0VnqZCz+pn72:sX5XqWQU8CTCBuXq/Y8gXZRn72
TLSH
T12AC2390EA206C5FAF45B907818F9873B8BB2F5128D3E5776FBDCED182B234801526794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcdjgxgotz.exe

Path C:\Users\Admin\AppData\Local\Temp\jcdjgxgotz.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oIcUuWnt.bat

Path C:\Users\Admin\AppData\Local\Temp\oIcUuWnt.bat
Size 196B
SHA256 6221349ad1b07adc2bdac95de8ac29b4ba59cf77d9c28a65a65c57ebccc43277
MD5 850dfa1cdf2b26ccafc96e29065ed9e8
SHA1 e6545364399c0199a8721c0d2fc6c02ccf56a85b
SHA512 2a0ccbff49fab738f8597711af2bfb2659214c62a4a6bfdd0e757fe2acb0257dff6d91a2ae86bfa40de333fc606d551dadc36476b25de0a7ed395847b7d399c1
TLSH
T101D0C92147DBCA5E084C927F0BF162CD9170D8283F4627217621C8C931C280DB5D7701
MD5 SHA1 SHA512 TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 486B
SHA256 87f62a6b3ce3e0790fee91f51233b889f96cc3c6bf7db4005bdf2be90883f156
MD5 06822b4c7681611eee54df23215b2434
SHA1 b6a9802784ae7d35648069a63904fdc38e0d9d1b
SHA512 b3c4e6540f2924f605cdc088a8325b7c2b41ef78a6511acd6e65268d25c3a8e32ffe85874bb1582c0339b76e8ecba64e03f546c737588d444c9f7a5dd6b1c08a
TLSH
T137F0A5767F97682784354B25AB78D4F3CA17F60D3A940342C221B666C2D75E80728E8E
MD5 SHA1 SHA512 TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 d09c1af6f32db8a72f8496fa3f53ab2a15188d096966c960e7b6d79a3cfd15e3
MD5 f470ac20a6833498f6899bccd0383829
SHA1 2cfba96079ea41b7f2d01f05e8297c73cf141419
SHA512 797f69f3c5be091fcefedb41b6dee3dc3214adcc889670a56f0eced090eb6041e8b73492f5451b91e9ad527ae23d215617874f5612d33065002e92b2341f2559
TLSH
T1B32100667B937823C1754B249BB8C8F7CA57F20D7A9003058251B761C3E75E9072998E
MD5 SHA1 SHA512 TLSH

Submit Download

wimsvc.exe

Path C:\Windows\SysWOW64\wimsvc.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/332-15-0x0000000000C00000-0x0000000000D7A000-memory.dmp

Download

memory/332-178-0x0000000000C00000-0x0000000000D7A000-memory.dmp

Download

memory/332-169-0x0000000000C00000-0x0000000000D7A000-memory.dmp

Download

memory/1880-96-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-116-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-86-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-85-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-84-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-83-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-82-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-81-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-80-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-79-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-78-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-88-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-89-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-91-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-90-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-93-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-92-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-94-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-95-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-99-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-101-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-100-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-103-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-102-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-98-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-97-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-72-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-114-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-115-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-118-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-117-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-87-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-112-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-113-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-111-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-110-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-119-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-109-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-108-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-107-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-106-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-105-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-104-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-120-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-121-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-122-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-124-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-125-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-123-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-126-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-129-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-131-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-130-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-128-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-127-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-75-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-76-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-74-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-77-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/1880-73-0x000001BDC6C50000-0x000001BDC6C60000-memory.dmp

Download

memory/3456-37-0x00000222678D0000-0x00000222678E0000-memory.dmp

Download

memory/3456-21-0x00000222676B0000-0x00000222676C0000-memory.dmp

Download

memory/3456-53-0x000002226FC70000-0x000002226FC78000-memory.dmp

Download

memory/3456-70-0x0000022270EC0000-0x0000022270EC8000-memory.dmp

Download