d4ffa65a040f6c610ef1020940d4304c36a97905b923e0118562ffc81226a5ab

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
Size 7.7MB
Sample260810-c4mhtadf72
SHA256 d4ffa65a040f6c610ef1020940d4304c36a97905b923e0118562ffc81226a5ab
MD5 52452063b82f6b0021565ed68a2a0f45
SHA1 8a54ef60d6f2f67c828f7e13aea9ef03f9032b71
SHA512 0f1893d9bc069ce3bcfc8afe26097b4a566affb8cf3f7c19c926a80620054ebd9294b38ec98e5dcddf896ca12d0690bce9a6d97a7d034a839c109a1b55d642eb
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7/KRuy5a2p7Dp7Dp7Dp7Dp7Dp7/KRuy5a8:vBBBBB/q/BBBBB/qn
TLSH
T14A868D11B7C18035F5B329724ABFE339597DB9214F6885CFE3880A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4108	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
4156	svchost_BAAABCCABCBBBACBBAABCACCCCCACCBBAAABBAAACCCCBABBBAABBBB.exe
2648	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAAACAAABCAACCAABAAABBABBCCBABAABBBACCCCCBABBBABBCCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe"	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCAABACCBACBABCBCBACAACABCABBCCBCABACABBBAACACCBABAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAABCCABCBBBACBBAABCACCCCCACCBBAAABBAAACCCCBABBBAABBBB.exe"	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5832	sc.exe
5396	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4264	cmd.exe
3764	cmd.exe
4976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAABCCABCBBBACBBAABCACCCCCACCBBAAABBAAACCCCBABBBAABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2040	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
2040	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
2040	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
2040	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
4108	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
4108	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
4108	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
4108	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
4156	svchost_BAAABCCABCBBBACBBAABCACCCCCACCBBAAABBAAACCCCBABBBAABBBB.exe
4156	svchost_BAAABCCABCBBBACBBAABCACCCCCACCBBAAABBAAACCCCBABBBAABBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
Token: SeDebugPrivilege	4108	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
Token: SeDebugPrivilege	4156	svchost_BAAABCCABCBBBACBBAABCACCCCCACCBBAAABBAAACCCCBABBBAABBBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4264	2040	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe	92
PID 4264 wrote to memory of 4184	4264	cmd.exe	94
PID 4108 wrote to memory of 4084	4108	svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe	95
PID 2040 wrote to memory of 3764	2040	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe	98
PID 3764 wrote to memory of 5832	3764	cmd.exe	100
PID 2040 wrote to memory of 4976	2040	2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe	101
PID 4976 wrote to memory of 5396	4976	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_52452063b82f6b0021565ed68a2a0f45_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAABCCACBCAAABACCCACBCBACACAABBBBCBCBBCACCCCCBBBAAABCBAABBBBACBABCAABBABBBACABAABCAABBBAABCBABBBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAABCCACBCAAABACCCACBCBACACAABBBBCBCBBCACCCCCBBBAAABCBAABBBBACBABCAABBABBBACABAABCAABBBAABCBABBBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBAACBCCACCBCCCCCACBBCCABCCCCAACBBBABCABBBCCBCCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe" start= auto displayName= "UserDataSvc_CCBAACBCCACCBCCCCCACBBCCABCCCCAACBBBABCABBBCCBCCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBAACBCCACCBCCCCCACBBCCABCCCCAACBBBABCABBBCCBCCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe" start= auto displayName= "UserDataSvc_CCBAACBCCACCBCCCCCACBBCCABCCCCAACBBBABCABBBCCBCCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBAACBCCACCBCCCCCACBBCCABCCCCAACBBBABCABBBCCBCCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBAACBCCACCBCCCCCACBBCCABCCCCAACBBBABCABBBCCBCCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABCCABCBBBACBBAABCACCCCCACCBBAAABBAAACCCCBABBBAABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABCCABCBBBACBBAABCACCCCCACCBBAAABBAAACCCCBABBBAABBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
1⤵
- Executes dropped EXE
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 489513b9d9cc33641b2ac5698a5c1307381587664bf3a3ca2ac8c09f62339ded
MD5 b93790b01f584d358aa339dea5f3fef9
SHA1 ea2780b828c0caeaa7aff92977861b24e94f4bd7
SHA512 aab74ca325ac94fc2d9d1c98691fcda445bf25caa9d1a80139bc229e7bb4b6ebbbc8d2348f48a7c3b47b2aa8b80e7fefef26bb524d5a2b81cd731bf7ddedf097
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cdad008e4e3c5b5dad8e92ead1e77414972e1846577cab90c9ebf628f8cfd9ef
MD5 9f276e4cc7eab6e5d1bdaaeb98d2bd57
SHA1 82eb70085b883ac4a635afed0f562397492e1576
SHA512 3ae990cf5be6e3276f8cef34378efa8ffce029b17edcb20b7825772a6fd1f4818970c65c30dea8acaca0bc5f11ad520390c91d2a303a72187d25bc177a26a7fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b653da33761db720bc75c568714fb55c4b118fd4188817c52fda74570da266bf
MD5 ac47362e4303c9706d1231bbe9e9e350
SHA1 f8efd787bb6ec5ec19f848867d543b0d31cb7c6d
SHA512 9fdba3fd3eca7346dc4b55f5ae513a8cb118621d8649ac44901ca165669e6a478f27a3228047c1871d61e80da7b333e2f852c022389e54fe8a43f01ac113b48d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 398f41233ed767821f869719b8a4623109fd510a639b06e7fc023b7943e743fa
MD5 dc01bed70a6faa52c01956b33a941064
SHA1 69594c861774ca41e606e484abfb999a800af7ef
SHA512 56c8b425613b0bdb415d463ea4bc0e0d1ea74648b2af3f70ab0e50e13031e21ed9737b5b9286e3f1e6fd415bea818dd46ba3262e33c27b9967ee250d01d760d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e5a4cd13fa4982c3c236bf77e54c11079f7127aa1b8a0de57fdac44b811dc915
MD5 b1fa9f5d4d7f9a6c1f7d1d878fb65643
SHA1 e0f76162c0392f7e8959c4e2a5e2da6377e5a240
SHA512 2e85c509c103dfc8cd150e12319378f0aed86314fd6e0d8d97048eebe44f95c10fe3db17a01f8ab3dd032fb69941b22b17cfb08ebcc6b4798f21d15f15ed378b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ece898be595f292d63c7f7f058a15f2feddae4360d286b9a183cdf4b2fe5b870
MD5 73e92363c8fb202fb9d7964b29f9d86b
SHA1 bee95fd0b683f23684dec5479c40d398279de649
SHA512 05ed9f396d057654fb45a7c7c46013738242c6ed8afb33994bc18d199120fcfbc1a1002d46205c321cdd05d0e21c3319ffaf147b6562f02ee2500764c4c29e1a
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCAACBCBACBACACCACBBBAAABCBCAAABCCABAACABABBBBABAA.exe
Size 7.7MB
SHA256 d4ffa65a040f6c610ef1020940d4304c36a97905b923e0118562ffc81226a5ab
MD5 52452063b82f6b0021565ed68a2a0f45
SHA1 8a54ef60d6f2f67c828f7e13aea9ef03f9032b71
SHA512 0f1893d9bc069ce3bcfc8afe26097b4a566affb8cf3f7c19c926a80620054ebd9294b38ec98e5dcddf896ca12d0690bce9a6d97a7d034a839c109a1b55d642eb
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7/KRuy5a2p7Dp7Dp7Dp7Dp7Dp7/KRuy5a8:vBBBBB/q/BBBBB/qn
TLSH
T14A868D11B7C18035F5B329724ABFE339597DB9214F6885CFE3880A2E5E71AD0A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1bffd3ade6b99fce5f4d3f0ac0dc1067329bf711b0029918f31e8086822d9ebd
MD5 5a615cbd015caaef19cb9f01de38a376
SHA1 99cf496dbd99a2953ca2192c9b638292b63b4457
SHA512 1b83498c302c929b9ba7e0c2a8073e21dbf9392e464ef9d4956bbde3985413410cecc979239dbdd9aeffcef2fe1555d590ade8922cae0f65de0d9b4da81fc6ad
TLSH
T183117750E4F9D463E9336CDA832ADBA70CD977ABAC18AE141305151DFAC9C34DD590B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2040-7-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/2040-0-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/4108-33-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4108-23-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4156-70-0x0000000000400000-0x0000000000421000-memory.dmp

Download