ramsay | e2b59afcca004fe742d4a1b4fac30d692a79929636a6f36df8f17e2229421a99

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/10/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 748KB
Sample261013-escwca1sav
SHA256 e2b59afcca004fe742d4a1b4fac30d692a79929636a6f36df8f17e2229421a99
MD5 12df7ecfb6e0a753c7067c47041da970
SHA1 34cd0171e74aee0473da870c9e501e1be9ad49e1
SHA512 144199c118b80f3ee19b2fcc15486b028046a382c45c240395f4cf167a41354031d34cc57736e5c346f6eb5b11ecf9e5fdd689e13021ca9c665cd7a698e14792
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxNjL:1hLalj3DSudvGM3MXTVhtSQWGtx5L
TLSH
T127F40222B1D4C072F4A2513449B9D7728B3FBD225BB590DBA78808BA1E726D4DF3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 3 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral1/memory/644-20-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	family_ramsay_payload
behavioral1/files/0x00070000000246de-92.dat	family_ramsay_payload
behavioral1/memory/644-93-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 2 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral1/memory/644-20-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	family_ramsay_hidedriver
behavioral1/memory/644-93-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/644-20-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/644-93-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs

resource	yara_rule
behavioral1/memory/644-20-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/644-93-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x00070000000246d9-13.dat	UPX
behavioral1/memory/644-20-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	UPX
behavioral1/memory/644-93-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	jggsgcamob.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Executes dropped EXE 4 IoCs

pid	Process
3836	jggsgcamob.exe
644	vnhhepfrzm.exe
4948	2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3320	bindsvc.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\msfte.dll	vnhhepfrzm.exe
File created	C:\Windows\system32\oci.dll	vnhhepfrzm.exe
File created	C:\Windows\System32\bindsvc.exe	vnhhepfrzm.exe
File created	C:\Windows\SysWOW64\wideshut.exe	vnhhepfrzm.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	vnhhepfrzm.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	vnhhepfrzm.exe
File created	C:\Windows\SysWOW64\racfg.exe	vnhhepfrzm.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	vnhhepfrzm.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000246d9-13.dat	upx
behavioral1/memory/644-20-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	upx
behavioral1/memory/644-93-0x0000000000AE0000-0x0000000000C5A000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4232	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5772	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bindsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bindsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jggsgcamob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vnhhepfrzm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000273161fdc85add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000847de8fbc85add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6ceb8fbc85add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d2e18fcc85add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057d1d7fbc85add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087a4effbc85add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000158e39fcc85add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6db47fcc85add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d08d3fbc85add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5d8a4fcc85add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5d8a4fcc85add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
644	vnhhepfrzm.exe
644	vnhhepfrzm.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	5396	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5396	SearchIndexer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5344 wrote to memory of 3836	5344	2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5344 wrote to memory of 644	5344	2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5396 wrote to memory of 4016	5396	SearchIndexer.exe	92
PID 5396 wrote to memory of 2024	5396	SearchIndexer.exe	93
PID 3836 wrote to memory of 4948	3836	jggsgcamob.exe	94
PID 644 wrote to memory of 3972	644	vnhhepfrzm.exe	100
PID 3972 wrote to memory of 4232	3972	cmd.exe	102
PID 644 wrote to memory of 5772	644	vnhhepfrzm.exe	103
PID 644 wrote to memory of 3320	644	vnhhepfrzm.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Users\Admin\AppData\Local\Temp\jggsgcamob.exe
  "C:\Users\Admin\AppData\Local\Temp\jggsgcamob.exe" "C:\Users\Admin\AppData\Local\Temp\hxbyqqidqy.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Users\Admin\AppData\Local\Temp\2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-11_12df7ecfb6e0a753c7067c47041da970_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:4948
- C:\Users\Admin\AppData\Local\Temp\vnhhepfrzm.exe
  C:\Users\Admin\AppData\Local\Temp\vnhhepfrzm.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UWo6D14c.bat"
    3⤵
    - Executes a command shell one-liner
    PID:5772
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3320

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4016
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UWo6D14c.bat

Path C:\Users\Admin\AppData\Local\Temp\UWo6D14c.bat
Size 196B
SHA256 a662bccba9268de5893d8667d051b950363cd32105975b18876d05fbb272f960
MD5 314315d2424f84e7f3a456ddd2f3998f
SHA1 c31a74fe228fd1fe28caa8a331c63fbbbf7931bd
SHA512 6eb23a42d37d5e639a5e38bc09365e64ffe1340177a9f0c4aa634ce94547179d8e60c660bc25d8f6a7b4ce69357069b2093708a51435fed858a8cd931269e67e
TLSH
T166D0122182EBCA5F5458911B06B152CDC171882C3F4A2721B6608C4C71C280DF7D3342
MD5 SHA1 SHA512 TLSH

Submit Download

hxbyqqidqy.exe

Path C:\Users\Admin\AppData\Local\Temp\hxbyqqidqy.exe
Size 42KB
SHA256 d5780738f5b684d559c33b6364b93867ca1ef8b10d8d52f08a18479289ff3b9d
MD5 b8d707acc0801608801241953d9a145f
SHA1 a3a9a9c5cae5c1be4adf846d214ac3e0de3a0b85
SHA512 0a8c1ea30c98edcaf87555054c4018c8fd1a166a6167e4c403555d2273e47bcea1d05f6bf4a8a0f64f93c448411e693c831f8a673e912b58ccea472a9a78544d
SSDEEP 768:eIql7wVKSJV/6hfrfH7L+aoOfflmes5G08PkE:eZl7OKSyhDfbvoQmm0
TLSH
T109134AABA9D5D2F2C8D543BC01F75B3B9A7759341336D1E3DB805872A833AE0593828D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jggsgcamob.exe

Path C:\Users\Admin\AppData\Local\Temp\jggsgcamob.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vnhhepfrzm.exe

Path C:\Users\Admin\AppData\Local\Temp\vnhhepfrzm.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 7164c1a7b9de0d9492f478b72895afd32045b6c8756c9cf6315311876fb1e1e7
MD5 65602b24ac008026c5aab33a87f9a5d7
SHA1 855e96cfc8732ea09d18f0e5d3ae154599b11611
SHA512 d5076f7dc25298383a5b556006993a4a202c71c28fe31d46e99bb4ae6144f9d1bc15d8b7c451ba77a4aa65de5314592dfffe234ca0101383d042aedfbc2a41a4
TLSH
T18F21469E8BE2726791BB47242FB8C4F7C597EA0D7FD0070180037661836B5ED13146AE
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\SysWOW64\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-20-0x0000000000AE0000-0x0000000000C5A000-memory.dmp

Download

memory/644-93-0x0000000000AE0000-0x0000000000C5A000-memory.dmp

Download

memory/2024-108-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-147-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-85-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-84-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-83-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-82-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-81-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-80-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-79-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-78-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-77-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-76-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-75-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-74-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-72-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-71-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-120-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-119-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-118-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-117-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-116-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-115-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-114-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-113-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-112-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-111-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-110-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-109-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-70-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-107-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-73-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-106-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-140-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-105-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-145-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-146-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-144-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-143-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-142-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-141-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-148-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-139-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-138-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-137-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-136-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-135-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-134-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-133-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-132-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-131-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-130-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-129-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-128-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-127-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-126-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-125-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-124-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-123-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-122-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/2024-121-0x000001CD76E60000-0x000001CD76E70000-memory.dmp

Download

memory/5396-21-0x0000022303D60000-0x0000022303D70000-memory.dmp

Download

memory/5396-37-0x0000022303E60000-0x0000022303E70000-memory.dmp

Download

memory/5396-53-0x000002230C350000-0x000002230C358000-memory.dmp

Download

memory/5396-67-0x000002230DAD0000-0x000002230DAD8000-memory.dmp

Download