ramsay | e9d94d243784fa8141b9ad0ae04bdd546ee7b6bcf581af135fcb5ed9e0a7126e

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/10/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_1711ef1203606a7321620b23aa77bae6_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.6MB
Sample261013-eet8gazzbz
SHA256 e9d94d243784fa8141b9ad0ae04bdd546ee7b6bcf581af135fcb5ed9e0a7126e
MD5 1711ef1203606a7321620b23aa77bae6
SHA1 fe7cc615f22cae45322df3d5657d6e7773a69f18
SHA512 846739e45c751fa8ae7716be4010893c7084c336442c9d8dae53342f57524d9430688309b8c012584f997b356211d115503650c397e7a85e6f4884bfcea0de08
SSDEEP 49152:1hLoBdqTDtSQWGt/8PjlyjPuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuIuuuuuu5:zoqTB3d8PB+Puuuuuuuuuuuuuuuuuuum
TLSH
T19675BF17AED04AB0D85266308079113ACE2A5D17CD3542CB3ADCFE149F775826BE36EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/3816-176-0x00000000001F0000-0x000000000036A000-memory.dmp	family_ramsay_payload
behavioral1/files/0x00070000000243f0-181.dat	family_ramsay_payload
behavioral1/memory/3816-185-0x00000000001F0000-0x000000000036A000-memory.dmp	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/3816-176-0x00000000001F0000-0x000000000036A000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/3816-185-0x00000000001F0000-0x000000000036A000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/3816-176-0x00000000001F0000-0x000000000036A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/3816-185-0x00000000001F0000-0x000000000036A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/3816-176-0x00000000001F0000-0x000000000036A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/3816-185-0x00000000001F0000-0x000000000036A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x00030000000219a2-13.dat	UPX
behavioral1/memory/3816-15-0x00000000001F0000-0x000000000036A000-memory.dmp	UPX
behavioral1/memory/3816-176-0x00000000001F0000-0x000000000036A000-memory.dmp	UPX
behavioral1/memory/3816-185-0x00000000001F0000-0x000000000036A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	2026-10-11_1711ef1203606a7321620b23aa77bae6_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	tsxozfzmbg.exe

Executes dropped EXE 3 IoCs

pid	Process
4784	tsxozfzmbg.exe
3816	uhkmxlxqlv.exe
4144	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\oci.dll	uhkmxlxqlv.exe
File created	C:\Windows\System32\bindsvc.exe	uhkmxlxqlv.exe
File created	C:\Windows\SysWOW64\wideshut.exe	uhkmxlxqlv.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	uhkmxlxqlv.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	uhkmxlxqlv.exe
File created	C:\Windows\SysWOW64\racfg.exe	uhkmxlxqlv.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	uhkmxlxqlv.exe
File created	C:\Windows\system32\msfte.dll	uhkmxlxqlv.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00030000000219a2-13.dat	upx
behavioral1/memory/3816-15-0x00000000001F0000-0x000000000036A000-memory.dmp	upx
behavioral1/memory/3816-176-0x00000000001F0000-0x000000000036A000-memory.dmp	upx
behavioral1/memory/3816-185-0x00000000001F0000-0x000000000036A000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1260	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1180	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bindsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bindsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uhkmxlxqlv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_1711ef1203606a7321620b23aa77bae6_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsxozfzmbg.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edb0d32ac65add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfd7da2ac65add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5040c2cc65add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be67a62ac65add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ab61c2cc65add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005044502dc65add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff91b82bc65add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000712a322cc65add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3816	uhkmxlxqlv.exe
3816	uhkmxlxqlv.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	4180	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4180	SearchIndexer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4784	4960	2026-10-11_1711ef1203606a7321620b23aa77bae6_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4960 wrote to memory of 3816	4960	2026-10-11_1711ef1203606a7321620b23aa77bae6_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4180 wrote to memory of 2824	4180	SearchIndexer.exe	91
PID 4180 wrote to memory of 4136	4180	SearchIndexer.exe	92
PID 3816 wrote to memory of 4704	3816	uhkmxlxqlv.exe	100
PID 4704 wrote to memory of 1260	4704	cmd.exe	102
PID 3816 wrote to memory of 1180	3816	uhkmxlxqlv.exe	103
PID 3816 wrote to memory of 4144	3816	uhkmxlxqlv.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-10-11_1711ef1203606a7321620b23aa77bae6_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_1711ef1203606a7321620b23aa77bae6_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\tsxozfzmbg.exe
  "C:\Users\Admin\AppData\Local\Temp\tsxozfzmbg.exe" "C:\Users\Admin\AppData\Local\Temp\xiveztsnvf.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_1711ef1203606a7321620b23aa77bae6_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4784
- C:\Users\Admin\AppData\Local\Temp\uhkmxlxqlv.exe
  C:\Users\Admin\AppData\Local\Temp\uhkmxlxqlv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KpaKB4Ci.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1180
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4144

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2824
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KpaKB4Ci.bat

Path C:\Users\Admin\AppData\Local\Temp\KpaKB4Ci.bat
Size 196B
SHA256 a63feec745c153f1ad063684538ad43a62f75fcf0bcbacde05cfb8b6b5a628bd
MD5 09b134399a8eb06390e1a7f62de9f313
SHA1 a07aaa644fc253fc74825e49c9195dcaa325e2f1
SHA512 aa861cc06e0eeaad504ed02f10b1fc3d2ff92d7ebefca9ae112c5bc740b272efbed530e71c0a4262d9487f711055cab9746a551f9ab63323460cb87b8a22b1b1
TLSH
T1F0D01256C3DBCA5F085DD16F06A1628EC562DC7C3F9737156626886C31C240DB6C3341
MD5 SHA1 SHA512 TLSH

Submit Download

tsxozfzmbg.exe

Path C:\Users\Admin\AppData\Local\Temp\tsxozfzmbg.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uhkmxlxqlv.exe

Path C:\Users\Admin\AppData\Local\Temp\uhkmxlxqlv.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xiveztsnvf.exe

Path C:\Users\Admin\AppData\Local\Temp\xiveztsnvf.exe
Size 919KB
SHA256 13f3b6121d0e797d53764d198cd8bb947328797b12fa2676280181cb42c00ef1
MD5 326f1fe2d75c923f50c40fcc5b291001
SHA1 a0a6aa4996a7293c0ddcbb9b65c6635d00299fcb
SHA512 7a1cf83b36571448d2c1473bac86bddf82b2b5e141912bd36e594affff4205cbcd6e3160d490a0101d848b5af0eea98faeeb7c4e7e12ae2bd5027625dd69841c
SSDEEP 24576:gtt6tP2jLB0EGb7PmcQrPuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuIuuuuuuuuN:g8PjlyjPuuuuuuuuuuuuuuuuuuuuuuu8
TLSH
T1C3156B179ED04AB0D8526A348079113EDE269D1BC82542CB3ADCFE14DF775422BE36EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 856B
SHA256 448ebfe8f4fa23d419f24869f97a8072865c07bc5bac815b84c96c2915d1201e
MD5 c8a5dbc7e36416cc0eace3604aabc02f
SHA1 e744d4be3861f9730962b8a7614cbf08cd716585
SHA512 592ce6ef382e96f0462c0aba5e419a88c1f4a56c769270af66dfeb343ded63dc8f853d8ee28cdca38fb88024b2e19f7bdb77058694b31c2a0ef2df9495ca6f74
TLSH
T13411B05A8BD26037C53A4734EBF8C8F7C557A20E3F95438280237A29C3664FD03185AE
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3816-15-0x00000000001F0000-0x000000000036A000-memory.dmp

Download

memory/3816-185-0x00000000001F0000-0x000000000036A000-memory.dmp

Download

memory/3816-176-0x00000000001F0000-0x000000000036A000-memory.dmp

Download

memory/4136-113-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-110-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-80-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-79-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-78-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-76-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-75-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-74-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-73-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-68-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-67-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-83-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-84-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-85-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-88-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-87-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-86-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-89-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-94-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-93-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-96-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-98-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-97-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-95-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-92-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-90-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-91-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-82-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-114-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-112-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-111-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-81-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-109-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-108-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-107-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-106-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-105-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-104-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-103-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-102-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-101-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-100-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-99-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-115-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-116-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-126-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-125-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-124-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-123-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-122-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-121-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-120-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-119-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-118-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-117-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-77-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-69-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-70-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-71-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4136-72-0x000001BD8D6A0000-0x000001BD8D6B0000-memory.dmp

Download

memory/4180-37-0x0000020A2C2B0000-0x0000020A2C2C0000-memory.dmp

Download

memory/4180-53-0x0000020A34670000-0x0000020A34678000-memory.dmp

Download

memory/4180-21-0x0000020A2C080000-0x0000020A2C090000-memory.dmp

Download

memory/4180-65-0x0000020A358C0000-0x0000020A358C8000-memory.dmp

Download