ramsay | aad3aed2baf872f552c7160a611f1bafb0e88caee65f708a28b4a40d1642ae2c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.3MB
Sample261012-vacevseb64
SHA256 aad3aed2baf872f552c7160a611f1bafb0e88caee65f708a28b4a40d1642ae2c
MD5 89a62a1af3fa21ead9a1e06e59f181dd
SHA1 0de6b0b929074b121a9f1d7ac395ae4a67838e9a
SHA512 f6eab62ce28e14e40a8a11c974b3c2c7d9a15533e72d2248b16fd8c054bee1147b4d91793ce66ad7347b65163567009a75ee22cd6252762a716443fb5ceff0f0
SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtxLQVczvJ8XT2P6L0bk0WwNJK:1hLoBdqTDtSQWGtVQaR8ek0RLJK
TLSH
T11355231176D58032E0A662308AACDBA28E7EBD515BB4D1CB77C805AA1D71BE5DF3430F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/4784-179-0x0000000000370000-0x00000000004EA000-memory.dmp	family_ramsay_payload
behavioral1/files/0x000700000002466a-187.dat	family_ramsay_payload
behavioral1/memory/4784-191-0x0000000000370000-0x00000000004EA000-memory.dmp	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/4784-179-0x0000000000370000-0x00000000004EA000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/4784-191-0x0000000000370000-0x00000000004EA000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/4784-179-0x0000000000370000-0x00000000004EA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/4784-191-0x0000000000370000-0x00000000004EA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/4784-179-0x0000000000370000-0x00000000004EA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4784-191-0x0000000000370000-0x00000000004EA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024665-13.dat	UPX
behavioral1/memory/4784-15-0x0000000000370000-0x00000000004EA000-memory.dmp	UPX
behavioral1/memory/4784-179-0x0000000000370000-0x00000000004EA000-memory.dmp	UPX
behavioral1/memory/4784-191-0x0000000000370000-0x00000000004EA000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	knhliktsdv.exe

Executes dropped EXE 5 IoCs

pid	Process
6052	knhliktsdv.exe
4784	lgevwmzlna.exe
4752	2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3196	update.exe
2016	bindsvc.exe

Loads dropped DLL 2 IoCs

pid	Process
3196	update.exe
3196	update.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\oci.dll	lgevwmzlna.exe
File created	C:\Windows\System32\bindsvc.exe	lgevwmzlna.exe
File created	C:\Windows\SysWOW64\wideshut.exe	lgevwmzlna.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	lgevwmzlna.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	lgevwmzlna.exe
File created	C:\Windows\SysWOW64\racfg.exe	lgevwmzlna.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	lgevwmzlna.exe
File created	C:\Windows\system32\msfte.dll	lgevwmzlna.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024665-13.dat	upx
behavioral1/memory/4784-15-0x0000000000370000-0x00000000004EA000-memory.dmp	upx
behavioral1/memory/4784-179-0x0000000000370000-0x00000000004EA000-memory.dmp	upx
behavioral1/memory/4784-191-0x0000000000370000-0x00000000004EA000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\setupapi.log	update.exe
File opened for modification	\??\c:\windows\KB896422.log	update.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4148	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1916	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bindsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bindsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	knhliktsdv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgevwmzlna.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088f32949695add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003acfe448695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cc7f847695add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3760948695add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000355bb048695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b88e6549695add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000152d4449695add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edb12348695add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4784	lgevwmzlna.exe
4784	lgevwmzlna.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	3052	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3052	SearchIndexer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 6052	892	2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 892 wrote to memory of 4784	892	2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3052 wrote to memory of 2092	3052	SearchIndexer.exe	92
PID 3052 wrote to memory of 3080	3052	SearchIndexer.exe	93
PID 6052 wrote to memory of 4752	6052	knhliktsdv.exe	94
PID 4752 wrote to memory of 3196	4752	2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	95
PID 4784 wrote to memory of 5104	4784	lgevwmzlna.exe	103
PID 5104 wrote to memory of 4148	5104	cmd.exe	105
PID 4784 wrote to memory of 1916	4784	lgevwmzlna.exe	107
PID 4784 wrote to memory of 2016	4784	lgevwmzlna.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\knhliktsdv.exe
  "C:\Users\Admin\AppData\Local\Temp\knhliktsdv.exe" "C:\Users\Admin\AppData\Local\Temp\anroabjlut.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Users\Admin\AppData\Local\Temp\2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - \??\c:\21d765c346716a25f66e\update\update.exe
      c:\21d765c346716a25f66e\update\update.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:3196
- C:\Users\Admin\AppData\Local\Temp\lgevwmzlna.exe
  C:\Users\Admin\AppData\Local\Temp\lgevwmzlna.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Z17jbPXf.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1916
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2092
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update.exe

Path C:\21d765c346716a25f66e\update\update.exe
Size 701KB
SHA256 2e2e9f1ea41d8673bcf69c8c97fc16c22932e2b7807fc87c556516261ea33d99
MD5 3b5eaaedb8a9d3f98debbdb0cfd214d5
SHA1 c9e09f6f6026f928d3d6d9056af868df83bd44ef
SHA512 26dbaefdedf9ba0094714f65d78b7c68fefc6afbd937cb0322ac698cbf3d104c4ccfbfb671314d6ea98bce2b0c090e2d4a19441d1abc2acb6b143e05818c2b75
SSDEEP 12288:sDmTB+aMygg8AeIrUQ6EKng3f+qYiS3bB:sCTYNg8Axr76Vg3flYiS31
TLSH
T1A0E45B02EBD3A03DEDB7257C663D52701BB6BC254A34C37A93917B4C1AF49159A3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Z17jbPXf.bat

Path C:\Users\Admin\AppData\Local\Temp\Z17jbPXf.bat
Size 196B
SHA256 667bee8d47af5b41004028ad5db33726e63d9dc900a669a4345f062bbcecde2d
MD5 8ee4a499335b013f7b9014b1c44e436e
SHA1 0900145df0cb4e1798cab4244ca04143918488a3
SHA512 3e384a8d294ad4b3b51c27b48c16ef20ad8c4a66ad48e05543c493b461cf44478225c8faa45f8137ec4b433fe87433f2a01fdc04684c966710ac89954badf34f
TLSH
T185D0A90183EBCA1F0448E22B06E0128FD82588697F4B23202221804CA1C341CB9AA382
MD5 SHA1 SHA512 TLSH

Submit Download

anroabjlut.exe

Path C:\Users\Admin\AppData\Local\Temp\anroabjlut.exe
Size 625KB
SHA256 d3b48a5d47dbbd2ee7216946a42e6359b5712f23704d43ba8aeb12cdf3c4db60
MD5 54fddf1c39ff029e1bd4cf7dd93cffb5
SHA1 f0c3cde39bcaf9735883501d5fa958a5c737290e
SHA512 55671034483ce82b843d2e8209e7813ccfacc4f62bdfd0c8f3fa3ac19e69eada392298a0c809810253d4a513a65a57ec82b4e056947a0078344cbf823fbeee4e
SSDEEP 12288:GTsuWwuiznc0L1KjLrBOu92PJd/hB6LzTopf74rek0WwqfQnJA:GQVczvJ8XT2P6L0bk0WwNJ
TLSH
T1ABD423899FED517BC0E5273046DCFB874CB0BE805E76E742A2944582187ABFACD2870D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

knhliktsdv.exe

Path C:\Users\Admin\AppData\Local\Temp\knhliktsdv.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgevwmzlna.exe

Path C:\Users\Admin\AppData\Local\Temp\lgevwmzlna.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 0628755e38540bdfab6870d96ab44906c791ccef0f203c36e17e7adaaf150e36
MD5 4def572791b21da87b0711c564576b3b
SHA1 81c7fdafc7a3877ae5f9ed37049f17427688525a
SHA512 8a04ed1fd6f607dda2afce74e869056a11056f87398a88ae4491002545c7ab2cba2a0b009bbe77d747fbc2f64d181061727c4007946ef0f0382c029d6b211ccb
TLSH
T1A721FC5A4FC3202381794B256FB8D4F7C657F40E6F9007059657B6B1C2A74EA932854F
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UPDSPAPI.dll

Path \??\c:\21d765c346716a25f66e\update\UPDSPAPI.dll
Size 363KB
SHA256 f484cf06e20996e1887b4304b33444f3ee1c03fb912f5ec8d5327c4074a97abb
MD5 ebdb17c673b090a949f17c9e6486aaf3
SHA1 2231731f56f803662e0f1d537b22cba7625ef433
SHA512 b05b2e548c507c2bce556acd43174c2a2743d46ba816896e97a475089237020208c710e25aa204aee40be36cc3c8480da0dc6c383cadf2c619268b48f5e8fe40
SSDEEP 6144:QA/Qbq7Bh2lbo+u++VpV5hkr5d1e0PubheTVAf:Kq7iS+3ENkr5TPubhCAf
TLSH
T15D84D602A3F4D25AF7FB2B30EDB516602F32BC519C38C61E1250B75DA8B1B419D65B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.inf

Path \??\c:\21d765c346716a25f66e\update\update.inf
Size 39KB
SHA256 fcb621b6b2b1e726f9b6388ab8d1bbb286eb76dd347fd4edd4c833f28fa098f9
MD5 d31650422f12b2e4f809ff3f470c372f
SHA1 2ccad4849a61afb246e8229be195ac7bb9918d11
SHA512 c65b569c5c2a7d2ba3fc57f9d443a788b9f7de9c447dac4da39e1f576863eea2c9c213665ffa6bfee4a9a78718779ea7398417626637a4725215fe0bc8aaee39
SSDEEP 768:xqhRzCoKWsEoUyyNHEm1HNX+ZpJTj6eElISDQ0TXNd5rwy+hFMvpJnhYL+acyJGw:xqhR+oKAo4EW7eJZx3M5m1
TLSH
T16A03C8E956074B61B5713A2885E3CD8BF7205A035051001F3ACEE786DFF658A83AADFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3052-21-0x0000022A39CB0000-0x0000022A39CC0000-memory.dmp

Download

memory/3052-91-0x0000022A43930000-0x0000022A43938000-memory.dmp

Download

memory/3052-53-0x0000022A422A0000-0x0000022A422A8000-memory.dmp

Download

memory/3052-37-0x0000022A39DB0000-0x0000022A39DC0000-memory.dmp

Download

memory/3080-121-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-127-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-96-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-108-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-107-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-106-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-105-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-104-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-103-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-102-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-100-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-101-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-99-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-114-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-113-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-112-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-111-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-110-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-109-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-118-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-120-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-119-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-123-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-124-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-122-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-98-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-117-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-116-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-115-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-125-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-126-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-97-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-128-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-129-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-130-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-140-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-139-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-138-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-137-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-136-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-135-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-134-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-133-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-132-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-131-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-151-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-150-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-149-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-148-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-147-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-146-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-145-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-144-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-143-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-142-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-141-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-94-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-93-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3080-95-0x000001A86D570000-0x000001A86D580000-memory.dmp

Download

memory/3196-86-0x0000000000A00000-0x0000000000A5C000-memory.dmp

Download

memory/4784-179-0x0000000000370000-0x00000000004EA000-memory.dmp

Download

memory/4784-15-0x0000000000370000-0x00000000004EA000-memory.dmp

Download

memory/4784-191-0x0000000000370000-0x00000000004EA000-memory.dmp

Download