ramsay | 429b2b7de3ee9323839608dfc2cffaa40d60ab8157001007c7ac7098ffe18ab7

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 740KB
Sample261012-3ehrfafb82
SHA256 429b2b7de3ee9323839608dfc2cffaa40d60ab8157001007c7ac7098ffe18ab7
MD5 41831600d1c420d9a14442173827a802
SHA1 32c5cc12108e9e776fa39b535655af75519e8f2a
SHA512 4218d3862e1b03fadf691b15d00ae57776882aed871289ef2a955b5e30b3659e7f0f25167159b78cc5ac848926810da835ab66ffbe64cc0edd494cd39dc23b85
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxISPJ:1hLalj3DSudvGM3MXTVhtSQWGtxlPJ
TLSH
T1D1F40221B1948072F06351308AB9DB728B2EBD525BB490DFA78885BE1E716E4DF3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/1736-20-0x0000000000E20000-0x0000000000F9A000-memory.dmp	family_ramsay_payload
behavioral1/memory/1736-147-0x0000000000E20000-0x0000000000F9A000-memory.dmp	family_ramsay_payload
behavioral1/files/0x0007000000024590-145.dat	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/1736-20-0x0000000000E20000-0x0000000000F9A000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/1736-147-0x0000000000E20000-0x0000000000F9A000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/1736-20-0x0000000000E20000-0x0000000000F9A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/1736-147-0x0000000000E20000-0x0000000000F9A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/1736-20-0x0000000000E20000-0x0000000000F9A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/1736-147-0x0000000000E20000-0x0000000000F9A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000002458b-13.dat	UPX
behavioral1/memory/1736-20-0x0000000000E20000-0x0000000000F9A000-memory.dmp	UPX
behavioral1/memory/1736-147-0x0000000000E20000-0x0000000000F9A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	dlaooestej.exe

Executes dropped EXE 4 IoCs

pid	Process
5044	dlaooestej.exe
1736	dzvnygmokz.exe
3764	2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3192	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\oci.dll	dzvnygmokz.exe
File created	C:\Windows\System32\bindsvc.exe	dzvnygmokz.exe
File created	C:\Windows\SysWOW64\wideshut.exe	dzvnygmokz.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	dzvnygmokz.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	dzvnygmokz.exe
File created	C:\Windows\SysWOW64\racfg.exe	dzvnygmokz.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	dzvnygmokz.exe
File created	C:\Windows\system32\msfte.dll	dzvnygmokz.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002458b-13.dat	upx
behavioral1/memory/1736-20-0x0000000000E20000-0x0000000000F9A000-memory.dmp	upx
behavioral1/memory/1736-147-0x0000000000E20000-0x0000000000F9A000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2128	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlaooestej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dzvnygmokz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b44200ea15add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d7a780ea15add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c67650ea15add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ae2fe0da15add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db89c90ea15add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	dzvnygmokz.exe
1736	dzvnygmokz.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	2872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2872	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 5044	4340	2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4340 wrote to memory of 1736	4340	2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2872 wrote to memory of 2608	2872	SearchIndexer.exe	92
PID 2872 wrote to memory of 2488	2872	SearchIndexer.exe	93
PID 5044 wrote to memory of 3764	5044	dlaooestej.exe	94
PID 1736 wrote to memory of 1752	1736	dzvnygmokz.exe	102
PID 1752 wrote to memory of 2128	1752	cmd.exe	104
PID 1736 wrote to memory of 4312	1736	dzvnygmokz.exe	105
PID 1736 wrote to memory of 3192	1736	dzvnygmokz.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\dlaooestej.exe
  "C:\Users\Admin\AppData\Local\Temp\dlaooestej.exe" "C:\Users\Admin\AppData\Local\Temp\nflksssopf.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Users\Admin\AppData\Local\Temp\2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:3764
- C:\Users\Admin\AppData\Local\Temp\dzvnygmokz.exe
  C:\Users\Admin\AppData\Local\Temp\dzvnygmokz.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\uvUGZ9j4.bat"
    3⤵
    - Executes a command shell one-liner
    PID:4312
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3192

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2608
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dlaooestej.exe

Path C:\Users\Admin\AppData\Local\Temp\dlaooestej.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dzvnygmokz.exe

Path C:\Users\Admin\AppData\Local\Temp\dzvnygmokz.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nflksssopf.exe

Path C:\Users\Admin\AppData\Local\Temp\nflksssopf.exe
Size 34KB
SHA256 4de05ad3fe496fea4015eeebfb44c85e9e71f4ae04c0353d2a32b584e5b97306
MD5 5582bb4db7d2fd50324aa208db4f1a6b
SHA1 7fca027f4ba5d8fca91011b8a0b15ebe95fe93b8
SHA512 6fe241319878f0c770e27f6ddda3bd33c78e71fb679cf51e2228b5e27ae913f81cef944b684192e614b08f75df7962d02a0c057fa3e57f3fa828cf04877e6dd1
SSDEEP 384:5BqAPAPaht9TNV0YJj4teVJ8MZgYFWT13+G7m9TLOHb7Jy1qCRKwoMs5ng:5YAgcTndZ9UTL1cDRKD5
TLSH
T14DF24C41AB4995BEE083677002F76B37DB3A9E451132570FCBC4C87A1D312A49A363EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uvUGZ9j4.bat

Path C:\Users\Admin\AppData\Local\Temp\uvUGZ9j4.bat
Size 196B
SHA256 4b93abd9b7c99a8cc681bebd070fe0a043b4225da554f3622386e251a293d10b
MD5 0f4d2012f34681c31b78df9402436256
SHA1 30bee8d7fb38c16b2570a20f7b67a54f7adb7cc6
SHA512 931e447176a8b60c525b657b3b6750fccf40aaf950ab105b5fe1223c3ef49878d4e521c59c11fb71738bddac36f0e4aed447d03be1f674827569f90d3d5a270f
TLSH
T16CD0126183DFCE6F0488925B06B162CDC270896D3F9E27156624C48D71C780DB6CF321
MD5 SHA1 SHA512 TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 d6bd0478b39f34d987ad1a875b365af1fbd2bd65ff171bc8acccadd2c44e174b
MD5 7a22d7fc267ebf3998e249dfde0a64c6
SHA1 87817ae8514408931c37f6331c906f8a819d3d87
SHA512 9066e8a4c3dcab02f9aaf804c728d8a075813f95123e364d446f7a17a256963b73fbb79095de4b21400a705b7761e0faf02cb9fa601b45d9d468384a5fcce874
TLSH
T166210AAA9BD3382BC1BB47346FB4C4F7C99BF90E6B910309942376218B574E6421458E
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1736-20-0x0000000000E20000-0x0000000000F9A000-memory.dmp

Download

memory/1736-147-0x0000000000E20000-0x0000000000F9A000-memory.dmp

Download

memory/2488-107-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-101-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-103-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-78-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-80-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-81-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-89-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-88-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-87-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-86-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-85-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-84-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-83-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-82-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-121-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-120-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-119-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-117-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-116-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-118-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-115-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-114-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-113-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-112-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-111-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-110-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-109-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-108-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-74-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-106-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-105-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-104-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-79-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-77-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-94-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-100-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-99-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-98-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-97-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-96-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-95-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-102-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-93-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-92-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-91-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-90-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-133-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-132-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-131-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-130-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-129-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-128-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-127-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-126-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-125-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-124-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-123-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-122-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-75-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2488-76-0x000002D72EDD0000-0x000002D72EDE0000-memory.dmp

Download

memory/2872-37-0x000001FA92EF0000-0x000001FA92F00000-memory.dmp

Download

memory/2872-21-0x000001FA92CC0000-0x000001FA92CD0000-memory.dmp

Download

memory/2872-53-0x000001FA9B2B0000-0x000001FA9B2B8000-memory.dmp

Download

memory/2872-72-0x000001FA9C950000-0x000001FA9C958000-memory.dmp

Download

memory/3764-67-0x0000000001000000-0x000000000100F000-memory.dmp

Download

memory/3764-68-0x0000000001000000-0x000000000100F000-memory.dmp

Download