ramsay | e9fe5286ae38f254eff280bc11c4d8a5a63de78e072e4cfb8888fc69045a4457

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/10/2026, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.7MB
Sample261013-bneycsxtgw
SHA256 e9fe5286ae38f254eff280bc11c4d8a5a63de78e072e4cfb8888fc69045a4457
MD5 302216932f82697e58360ee44f372bd1
SHA1 3407e6fe7575d580be22dabb16c839e602192724
SHA512 db0e4f54bbb06a89a5304437924fac8b53719a46cc401f15c26e4306b7fd988a99f2015f989bc94c4a81bd10b531722b4bba92cb04a55b074df708cd066472b2
SSDEEP 49152:1hLoBdqTDtSQWGt2QodDdZG0Lepqz2Tf9MTwIASRlApqqkts4kq2:zoqTB3c7tq0LeaYJpAlsnkts4kZ
TLSH
T157852321B1949072F07345344FBADB669F3ABD034BA1D1D75BC915AE1E226E0EB3930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/4644-271-0x00000000007A0000-0x000000000091A000-memory.dmp	family_ramsay_payload
behavioral1/files/0x00070000000245e6-277.dat	family_ramsay_payload
behavioral1/memory/4644-282-0x00000000007A0000-0x000000000091A000-memory.dmp	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/4644-271-0x00000000007A0000-0x000000000091A000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/4644-282-0x00000000007A0000-0x000000000091A000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/4644-271-0x00000000007A0000-0x000000000091A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/4644-282-0x00000000007A0000-0x000000000091A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/4644-271-0x00000000007A0000-0x000000000091A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/4644-282-0x00000000007A0000-0x000000000091A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245e1-13.dat	UPX
behavioral1/memory/4644-15-0x00000000007A0000-0x000000000091A000-memory.dmp	UPX
behavioral1/memory/4644-271-0x00000000007A0000-0x000000000091A000-memory.dmp	UPX
behavioral1/memory/4644-282-0x00000000007A0000-0x000000000091A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	elcynktqdo.exe

Executes dropped EXE 6 IoCs

pid	Process
4772	elcynktqdo.exe
4644	hqwbcqiqhj.exe
1980	2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
4156	mrtstub.exe
752	MRT.exe
3112	bindsvc.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wideshut.exe	hqwbcqiqhj.exe
File created	C:\Windows\SysWOW64\racfg.exe	hqwbcqiqhj.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	hqwbcqiqhj.exe
File created	C:\Windows\SysWOW64\MRT.exe	mrtstub.exe
File created	C:\Windows\System32\bindsvc.exe	hqwbcqiqhj.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	hqwbcqiqhj.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	hqwbcqiqhj.exe
File created	C:\Windows\system32\msfte.dll	hqwbcqiqhj.exe
File opened for modification	C:\Windows\SysWOW64\MRT.exe	mrtstub.exe
File created	C:\Windows\system32\oci.dll	hqwbcqiqhj.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000245e1-13.dat	upx
behavioral1/memory/4644-15-0x00000000007A0000-0x000000000091A000-memory.dmp	upx
behavioral1/memory/4644-271-0x00000000007A0000-0x000000000091A000-memory.dmp	upx
behavioral1/memory/4644-282-0x00000000007A0000-0x000000000091A000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\mrt.log	MRT.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
840	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrtstub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MRT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elcynktqdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hqwbcqiqhj.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa6d4fa8b05add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0bd5da8b05add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c587c7a7b05add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017ed8ba7b05add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb8324a8b05add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000304667a8b05add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000709e61a9b05add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000503b9aa7b05add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4644	hqwbcqiqhj.exe
4644	hqwbcqiqhj.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: 33	3240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3240	SearchIndexer.exe
Token: SeBackupPrivilege	752	MRT.exe
Token: SeRestorePrivilege	752	MRT.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4772	2336	2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2336 wrote to memory of 4644	2336	2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3240 wrote to memory of 3048	3240	SearchIndexer.exe	91
PID 3240 wrote to memory of 3764	3240	SearchIndexer.exe	92
PID 4772 wrote to memory of 1980	4772	elcynktqdo.exe	93
PID 1980 wrote to memory of 4156	1980	2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	94
PID 4156 wrote to memory of 752	4156	mrtstub.exe	95
PID 4644 wrote to memory of 4496	4644	hqwbcqiqhj.exe	104
PID 4496 wrote to memory of 840	4496	cmd.exe	106
PID 4644 wrote to memory of 928	4644	hqwbcqiqhj.exe	107
PID 4644 wrote to memory of 3112	4644	hqwbcqiqhj.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\elcynktqdo.exe
  "C:\Users\Admin\AppData\Local\Temp\elcynktqdo.exe" "C:\Users\Admin\AppData\Local\Temp\icimfvwepc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-11_302216932f82697e58360ee44f372bd1_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - \??\c:\3cd8544f2d80143bdd5ecb41bd\mrtstub.exe
      c:\3cd8544f2d80143bdd5ecb41bd\mrtstub.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\Windows\SysWOW64\MRT.exe
        
        "C:\Windows\system32\MRT.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:752
- C:\Users\Admin\AppData\Local\Temp\hqwbcqiqhj.exe
  C:\Users\Admin\AppData\Local\Temp\hqwbcqiqhj.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\64Rir8ZX.bat"
    3⤵
    - Executes a command shell one-liner
    PID:928
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3112

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3048
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrtstub.exe

Path C:\3cd8544f2d80143bdd5ecb41bd\mrtstub.exe
Size 85KB
SHA256 f33ff5e1d245ccf40db58f38eb31cbd624d815eeba74d0ba57464e50fd7d6c0e
MD5 d873031e0860b3976f6344bdad629bc2
SHA1 b278a05be489d5e627612bc000c6987791a2189a
SHA512 3fb13d8086ec5fcd188adf2921f508765559bd9ad10a8ffbb732344db2339c5ddc2c1e30d5570b5f5bb441bc9268217418d1d49b25a493171d6d0ba0951a862f
SSDEEP 1536:nyHZ5wPaW5bY8KPMdEw3m+G4MJlXanr59NvtqJuEut2eOpYR/o/:CZ5wPaGbYj2EdJNO9NvtkuEut2nmo/
TLSH
T1DD835A2231D8D036E88115FD01DED735663E68B2076A97CB1BE846D9C9257E2EF343CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64Rir8ZX.bat

Path C:\Users\Admin\AppData\Local\Temp\64Rir8ZX.bat
Size 196B
SHA256 02353c979d93d130e5f541a86c584ac8c25cb2754d4a9972f169a38fda0d2657
MD5 35e2369d07f0752130b1f736ed8dc5c5
SHA1 500f897233e3b7424cadccee10ab53226282ade4
SHA512 5a65d2c36201dc97d87de3f0186ceacc4a5bd62391547d1065a26a552867db7298f84c1dc7f5985578d3c30056c18009d97c929965989bcababe98d1613f34e0
TLSH
T1D3D01211C6DBCA5E0449992B0AB3628FC060C82C3F5A67117E30C45D32C280DB9C3311
MD5 SHA1 SHA512 TLSH

Submit Download

elcynktqdo.exe

Path C:\Users\Admin\AppData\Local\Temp\elcynktqdo.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hqwbcqiqhj.exe

Path C:\Users\Admin\AppData\Local\Temp\hqwbcqiqhj.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icimfvwepc.exe

Path C:\Users\Admin\AppData\Local\Temp\icimfvwepc.exe
Size 1.1MB
SHA256 739bd9e63c5f8c819675428492443ad670507e574f38befef1eb5dbfca1172b2
MD5 5511a2aab2668b6a1e29fcd3b60ee708
SHA1 bda28712e88d55f57fad5eaba0997c9878f2c45f
SHA512 e12925aad3da744a665220f68fb0ddee8f9efb2a0fc0e634a96afefdbabe65e378cc4ad77049214e2f54b1e84fe574402d283ea368516fd345a64ee1b0c9821d
SSDEEP 24576:JQodDR/8iGvcLesy8QRIz2TfHI8McWwIASRlApqDmkZHadQjDoq7w:JQodDdZG0Lepqz2Tf9MTwIASRlApqqk2
TLSH
T10C3533F18219A0A6F17209786FD7FA4F6EB0750F0B93F7604BE6759D8616320B25E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 b14e548e8cc31cc033879f3fa482b7693bdcbce48d8f04d7e228c9c2af51a36d
MD5 cd6ff679c782b64bd5a789f3dec808ea
SHA1 a7b3258c01fd90dd65ac398a1a653135210758a9
SHA512 ba36baccd80bc489e911493a67c372cc7e70a30debe1dedbe79b19c0d0ed35812c065bf166c3b86ea34ffbcb7aeaf30d661d1f33c5c03bc0758da86000e386ba
TLSH
T1BB216A9A8BD23427913B47202BB8C4FBC597ED0E2F81438885033266CF638E9177458E
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MRT.exe

Path \??\c:\3cd8544f2d80143bdd5ecb41bd\MRT.exe
Size 2.6MB
SHA256 749f22e00263f08ac17e0c1300b9477e3565bdb42a3d4d59143ef2cf7db7f08a
MD5 957fde83dcd0040dd5150db16ce73157
SHA1 136b702b2aabf1d55a1b400d81f4a9219e239faa
SHA512 c1337ca009be93483a45f9951a5846f4c6ced65da530ac7ad43ef0260f36cce80e98e48660e48986b826ccf059b49cc84ea06f2b1c02b4dfcbc60ce8c4ad79de
SSDEEP 24576:Om60rroz0wPijzlbEFl3FYTXHIzCrd9VkHhhueir9nayL1YG3w4v5URQBbS6+kwV:OMrySbm8SbipRh9A4LS6+6z01Boxk
TLSH
T193C592F85271D852DE9238B09D2AB5F783597832D33848F3B1426DE6B42C2E52670D7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3240-21-0x000002663F2B0000-0x000002663F2C0000-memory.dmp

Download

memory/3240-131-0x0000026649480000-0x0000026649488000-memory.dmp

Download

memory/3240-81-0x0000026648F70000-0x0000026648F78000-memory.dmp

Download

memory/3240-53-0x00000266478A0000-0x00000266478A8000-memory.dmp

Download

memory/3240-37-0x000002663F4E0000-0x000002663F4F0000-memory.dmp

Download

memory/3240-132-0x0000026649480000-0x0000026649488000-memory.dmp

Download

memory/3764-126-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-117-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-89-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-91-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-92-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-95-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-98-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-97-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-96-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-94-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-100-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-104-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-103-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-102-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-106-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-114-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-113-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-116-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-127-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-130-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-129-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-128-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-88-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-125-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-124-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-123-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-122-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-121-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-120-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-119-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-118-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-86-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-115-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-112-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-111-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-110-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-109-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-108-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-107-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-105-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-101-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-99-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-93-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-87-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-90-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-142-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-141-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-140-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-139-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-138-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-137-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-136-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-135-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-134-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-133-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-83-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-84-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/3764-85-0x000002164F4B0000-0x000002164F4C0000-memory.dmp

Download

memory/4644-282-0x00000000007A0000-0x000000000091A000-memory.dmp

Download

memory/4644-271-0x00000000007A0000-0x000000000091A000-memory.dmp

Download

memory/4644-15-0x00000000007A0000-0x000000000091A000-memory.dmp

Download