b917ff2b0da4d16e56cf52a5786956979a8342def15470159e01c8cc1aab52f2

Analysis

max time kernel
151s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 54.4MB
Sample260808-vwkclavyfz
SHA256 b917ff2b0da4d16e56cf52a5786956979a8342def15470159e01c8cc1aab52f2
MD5 bf485c0350aa68f9cb4b37c2459e0558
SHA1 bf09dc7574d20d87171f086dce16d885d522a78b
SHA512 8ea663e494ac296d2bd079dfc7d44effbefcf7b1b2583594e63bd2eb02af3d55789594f3738b60b182d5ac7679492a983828d10ccd09fd58569a2729ac07a4b2
SSDEEP 98304:wMMMMCVNBw4MLMMMMCVNBw4MLMMMMCVNBw4MLMMMMCVNBw4MLMMMMCVNBw4MLMMF:dhhhhhh1FIF0wuzhhhhhh1FIF0wuU
TLSH
T135C78E50B9E54CA2E972113D49F7C376563CF9E04B238B9BA32866371F22BD168E4707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5952	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
4656	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
2812	svchost_ABCBACAABCACACCCCCCACACBBABCACAACAABBBACBACBACBBABCCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACCCBBBCAAACAABBBACABACBAAACBBBBAABBACBACCBBCAABAACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe"	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCAACCCBBCBCBCAAACBBBACBACBCCBAAACCCABBCCCCCABABBBBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBACAABCACACCCCCCACACBBABCACAACAABBBACBACBACBBABCCCCB.exe"	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2924	sc.exe
928	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3068	cmd.exe
1496	cmd.exe
3872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBACAABCACACCCCCCACACBBABCACAACAABBBACBACBACBBABCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5804	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5804	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5804	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5804	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5952	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
5952	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
5952	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
5952	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
4656	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
4656	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5804	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	5952	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
Token: SeDebugPrivilege	4656	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 3068	5804	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 3068 wrote to memory of 5128	3068	cmd.exe	94
PID 5804 wrote to memory of 1496	5804	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	95
PID 1496 wrote to memory of 2924	1496	cmd.exe	97
PID 5804 wrote to memory of 3872	5804	2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 3872 wrote to memory of 928	3872	cmd.exe	100
PID 5952 wrote to memory of 5028	5952	svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf485c0350aa68f9cb4b37c2459e0558_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCBACBCCAAACBBCAABCCABABCACACCACCABCBCACCABBAAAAAABACCBCCACBBBBACBCCABACABAACCAABAACABBAACCBCBBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCBACBCCAAACBBCAABCCABABCACACCACCABCBCACCABBAAAAAABACCBCCACBBBBACBCCABACABAACCAABAACABBAACCBCBBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBAAAACBACBBCAABBBBCCBBACABCABBCCACCCBBABBCBCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe" start= auto displayName= "UserDataSvc_BCBBAAAACBACBBCAABBBBCCBBACABCABBCCACCCBBABBCBCCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBAAAACBACBBCAABBBBCCBBACABCABBCCACCCBBABBCBCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe" start= auto displayName= "UserDataSvc_BCBBAAAACBACBBCAABBBBCCBBACABCABBCCACCCBBABBCBCCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBAAAACBACBBCAABBBBCCBBACABCABBCCACCCBBABBCBCCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBAAAACBACBBCAABBBBCCBBACABCABBCCACCCBBABBCBCCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBAABABBCACBBCCBAACACBAACAACCABBBACCBBCCBCABBBCBABAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACAABCACACCCCCCACACBBABCACAACAABBBACBACBACBBABCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACAABCACACCCCCCACACBBABCACAACAABBBACBACBACBBABCCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4d88b5d01079aee0a1fcb59113362be0bd4be2c52cb125f53f821e47319aca46
MD5 0b7a54ef9a56e91af004142142b9bfa3
SHA1 6b4092081e7a075f2fe2619c3c89501cb8dd0930
SHA512 f9fc4e3ddb186499a0f61d130325f961f0be2644defe5c220802d36d0d089988bd7f7a8c1349c03f44acf6e9a5346f0285f5a2549679507caf3a8d72f2f90c5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\qap`g`v~dtlq
Size 10B
SHA256 3f245c39fec9de02fb086fb2be08ab555951469555880b0f86ce078cd6663aaa
MD5 a600f1da82ebe6c26aad7393eab15c50
SHA1 99e02f610973dbee50e2e8319bc7e2b8569c06cb
SHA512 e29492252e5d67d0d71c94b605ed8e16b9f16043faf8b0950a854be1ffae5b1ba6ff820d9466df5cd0e89d90e0cabdcce458e23525f81e47017a1a8eb8febd57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c67f11533ffa1645a1f4e983b6a11dcf2895b2fae006b40bf4226f9de67dc4ff
MD5 ea22ba3fa1d145513632c082fd156d60
SHA1 2498999dece679e4dc3a73fbd3fd821c6d0cf6a3
SHA512 6c4f5fb4dd40dd2291ecb5587f58fcd3fefc806d381e2ea74cc59ce237e4f1ed9f72eb295e2f1bb14ba18459c57048317399d1bd48589a8313046bcb1ab1c923
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2cd53467dc665f3bd5e38cac1dc7b149cdafbdc827a218e63a48ac41fd56c8fb
MD5 8e0681dc65a5732c4b0bf6d44ef722f6
SHA1 5f621b390191ce112e9b2c54f95a307b25d1bafe
SHA512 95558cb5508d0bc984517b2964d7f332dcd09627954303312d96391a3f6ca64b8d1150adf86f4a13448b9be7cff4410e5b71ebc88f658d13eb4f4049a782a439
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e5c866ce443dbf2dd0c4852b15598e79e120f2524738f81c86b0ed6cb878182
MD5 696bc0e3ac0c246a870342e346d73d3f
SHA1 8c3cde00f2026afd0ee76932f1f7d8163d969594
SHA512 056d20c9fa31239053a584b16059aee47e882ca982e2632a18f45a183b064892efd5219de570ccbb1086483fb74b3efb86caa413755a05fb37fa8494d493fd05
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0b56947795ce00f440c5a10f7b95d7a0a93c319b213ec0e3b61434266970f06
MD5 fea66309d59953481ee8255853948e7e
SHA1 bde23c9d8b7089c624f242ddc378a1ad0c0bbd7b
SHA512 9f95ff014fd4f30a85bde728cc6de131e25ff71372179c4eaf660694fc3d2ff579d67121e5c2d04411728919b5fb4d4f9ca44a670916cb35ec1db2b3a9399142
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fe139f0a92792f9dfd3c2c44a9d9dbc60cf20881050194accc686f6d2f3b2bd8
MD5 10ce138f60c7087086a8962b843d98ac
SHA1 8dfc2fa5edef06c15e97f9fc0f40399316378005
SHA512 d82aac59a0672ab92115bcae58ddeccfcbf3c986dd749ff20e14dc684f0cd01cad73ac6189fd2a72c51825f64c11f485457c5de351cd20721c180c61112f0b99
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4cb938e2237972c01c219620f6778d387b14c2057b8cba0df7ba5d1da29dedfd
MD5 8e22c79986dcdcb8a661fe956cc3b5a7
SHA1 e207b81b567195d34bbe948f33cc183828f2593a
SHA512 88b0b572443965e2bc689ba435ee6d259e48cb1c7b542b67239fe12c83f0683343dba0da815a3cd7f1f58752bd6bff162ce21b272e5f3769e500c9dea46da03d
TLSH
T1A1110DA1E4E9DC93FD3224CF6A15EB9328F0374ED85C6AA66309421CB799C358D15CE3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2812-89-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/4656-86-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5804-59-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/5804-10-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/5804-83-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/5804-33-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/5804-21-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/5952-50-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5952-71-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5952-97-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5952-32-0x0000000000610000-0x0000000000631000-memory.dmp

Download