ramsay | 9ebc694b17e001cda52d47463b7e0718e289572e02a80799167efadfae720b31

Analysis

max time kernel
148s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 726KB
Sample261012-vgdaqsvs7q
SHA256 9ebc694b17e001cda52d47463b7e0718e289572e02a80799167efadfae720b31
MD5 881eb28d742a3c39236cd09d8a090294
SHA1 42e9eaf127d87c57068b20668ddfcb6074c0e5c2
SHA512 6b6d787550b6436bcce80f439d9b2a8219ac6c49cde492a0fc0e9dc9c3438e014ef45d6fb2fd0d467bfbfcbef8f40ea6a3990cc35d356bcbef4d0dbe32337bd3
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxB2U:1hLalj3DSudvGM3MXTVhtSQWGtxAU
TLSH
T1AFF41222B5948032F06351348A79D7A28B2FBD625FA490DF77C806AE2E716D1DF7431B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/3416-203-0x0000000000830000-0x00000000009AA000-memory.dmp	family_ramsay_payload
behavioral1/memory/3416-212-0x0000000000830000-0x00000000009AA000-memory.dmp	family_ramsay_payload
behavioral1/files/0x0007000000024419-210.dat	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/3416-203-0x0000000000830000-0x00000000009AA000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/3416-212-0x0000000000830000-0x00000000009AA000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/3416-203-0x0000000000830000-0x00000000009AA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/3416-212-0x0000000000830000-0x00000000009AA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/3416-203-0x0000000000830000-0x00000000009AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/3416-212-0x0000000000830000-0x00000000009AA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024414-13.dat	UPX
behavioral1/memory/3416-15-0x0000000000830000-0x00000000009AA000-memory.dmp	UPX
behavioral1/memory/3416-203-0x0000000000830000-0x00000000009AA000-memory.dmp	UPX
behavioral1/memory/3416-212-0x0000000000830000-0x00000000009AA000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	diziokhrib.exe

Executes dropped EXE 4 IoCs

pid	Process
4656	diziokhrib.exe
3416	ywgjfhhpyc.exe
4772	2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1892	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\racfg.exe	ywgjfhhpyc.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	ywgjfhhpyc.exe
File created	C:\Windows\system32\msfte.dll	ywgjfhhpyc.exe
File created	C:\Windows\system32\oci.dll	ywgjfhhpyc.exe
File created	C:\Windows\System32\bindsvc.exe	ywgjfhhpyc.exe
File created	C:\Windows\SysWOW64\wideshut.exe	ywgjfhhpyc.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	ywgjfhhpyc.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	ywgjfhhpyc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024414-13.dat	upx
behavioral1/memory/3416-15-0x0000000000830000-0x00000000009AA000-memory.dmp	upx
behavioral1/memory/3416-203-0x0000000000830000-0x00000000009AA000-memory.dmp	upx
behavioral1/memory/3416-212-0x0000000000830000-0x00000000009AA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4960	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3952	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bindsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bindsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diziokhrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywgjfhhpyc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c32eecc06a5add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3b8f5c06a5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000307dfac06a5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2dffcc06a5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015ca27c16a5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3416	ywgjfhhpyc.exe
3416	ywgjfhhpyc.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	4336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4336	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4656	4308	2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4308 wrote to memory of 3416	4308	2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4336 wrote to memory of 4348	4336	SearchIndexer.exe	91
PID 4336 wrote to memory of 2712	4336	SearchIndexer.exe	92
PID 4656 wrote to memory of 4772	4656	diziokhrib.exe	93
PID 3416 wrote to memory of 4240	3416	ywgjfhhpyc.exe	102
PID 4240 wrote to memory of 4960	4240	cmd.exe	104
PID 3416 wrote to memory of 3952	3416	ywgjfhhpyc.exe	105
PID 3416 wrote to memory of 1892	3416	ywgjfhhpyc.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\Temp\diziokhrib.exe
  "C:\Users\Admin\AppData\Local\Temp\diziokhrib.exe" "C:\Users\Admin\AppData\Local\Temp\nnmawqqbvw.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Local\Temp\2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-11_881eb28d742a3c39236cd09d8a090294_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:4772
- C:\Users\Admin\AppData\Local\Temp\ywgjfhhpyc.exe
  C:\Users\Admin\AppData\Local\Temp\ywgjfhhpyc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\T1nLPpnv.bat"
    3⤵
    - Executes a command shell one-liner
    PID:3952
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1892

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

T1nLPpnv.bat

Path C:\Users\Admin\AppData\Local\Temp\T1nLPpnv.bat
Size 196B
SHA256 a57e20fe393b7d7001236e5c6166db4ebda7989fdbffe558612e9b72a501553f
MD5 4d940de819b99445d574fca89bdaba2a
SHA1 c2c101627f2578b2fe5b466d91e4a1b2578854a9
SHA512 80d8a708128fb1470ae0cdbf90d5c63d3296832aa69975aabe49f155c111e2f81ba9c9f5bb839a320357310874f84651e99566aa8ac3a7a702dce868cfe8e037
TLSH
T171D0C91183DBCF5E0448E91B0AA5978D80608C183F4A27126631884932D280DB59E701
MD5 SHA1 SHA512 TLSH

Submit Download

diziokhrib.exe

Path C:\Users\Admin\AppData\Local\Temp\diziokhrib.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nnmawqqbvw.exe

Path C:\Users\Admin\AppData\Local\Temp\nnmawqqbvw.exe
Size 20KB
SHA256 111cc53832ae7ae3bf3e839acdfc4b79539b609919293a67988980f1de4ae487
MD5 ac80811c05bca33d4cc24fc061d9cc40
SHA1 53a2c4aaa4bf5be9c54e27d78431ed5689963a02
SHA512 6790b7c96e78c68aead84ad3ea123f0b011b09a05cf298e9a3ea0abc341fb299a51a27be6b6d3aed7ba847e3735d337632a4e96ac68b40746adab27b34c4760b
SSDEEP 384:vlRT3esKmxpdJkkRwZycsNdFy3kEk/sQDTYgr21NRA1WsdsW:tJOlUpr0ZmNdFEQDTS1NaV
TLSH
T17B925C63BE549C7BE1A39E320836752B8A7F74B40FA003D7728083AE24753D06EB5217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywgjfhhpyc.exe

Path C:\Users\Admin\AppData\Local\Temp\ywgjfhhpyc.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 7a63fa9fe08c1014da80f6c719fe895fa9426083173f7209ffe5b50dc895ccde
MD5 07905b66b59545e9bdbc79ebcaf50ccb
SHA1 c8976e9e2ae3136c5422698b490b4cc3c9f7b46d
SHA512 df278a20c6101f771861702ace51cbfe047a83c5f6d9f0c0bda976b2d1e1e67feaebf765863b8e40a5c050289a35888adcd52b12ade106715f36fd44b6ca15be
TLSH
T1F5217C5A9BC13C2382BA4B202FB4C4F7CA17F40D3FC0130887233260CB638E9126865D
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2712-110-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-106-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-87-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-86-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-85-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-84-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-83-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-82-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-81-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-80-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-79-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-78-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-77-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-95-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-103-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-105-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-104-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-107-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-101-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-100-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-99-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-98-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-97-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-96-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-94-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-93-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-92-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-91-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-90-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-111-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-89-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-109-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-88-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-108-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-102-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-133-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-132-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-131-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-130-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-129-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-128-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-127-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-126-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-125-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-124-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-123-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-122-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-121-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-120-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-119-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-118-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-117-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-116-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-115-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-114-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-113-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-112-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-74-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-75-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/2712-76-0x00000254AD260000-0x00000254AD270000-memory.dmp

Download

memory/3416-212-0x0000000000830000-0x00000000009AA000-memory.dmp

Download

memory/3416-203-0x0000000000830000-0x00000000009AA000-memory.dmp

Download

memory/3416-15-0x0000000000830000-0x00000000009AA000-memory.dmp

Download

memory/4336-37-0x000001F6A91C0000-0x000001F6A91D0000-memory.dmp

Download

memory/4336-21-0x000001F6A8F90000-0x000001F6A8FA0000-memory.dmp

Download

memory/4336-53-0x000001F6B1680000-0x000001F6B1688000-memory.dmp

Download

memory/4336-72-0x000001F6B4110000-0x000001F6B4118000-memory.dmp

Download