ee2805487fd06ea048d277730be4dd1cfa1bd869c5b9ab6409aa98ada41a9116

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 24.5MB
Sample260810-cpt94stsfy
SHA256 ee2805487fd06ea048d277730be4dd1cfa1bd869c5b9ab6409aa98ada41a9116
MD5 918ab9f51893d4610738e84443c0ded5
SHA1 2bf969870f2a176944c1c783db9f4d4eb97a6090
SHA512 6687e93a040a1769c2a2125bede1fb586ddf932af9d0e3e1f273cca0a061a3ace38edbf8cca9a47e3aa698ab4e8cff20faab8172860823248549ddce382f8046
SSDEEP 98304:lKRuy5adKRuy5adKRuy5adKRuy5adKRuy5adKRuy5adKRuy5aROU/jIEeQfoR/I0:lqiqiqiqiqiqiqAFIF0wuc
TLSH
T14B479F16F68808F1E97361388596D629EE7275250B31CACBB36C432F2F33AD19D39752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1244	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
1872	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
2676	svchost_BABAAAACABABCACACBAACBACCCABAABCBBBABAACACABACCCBBAACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCCCCAAAABBABBBACCBABAABCACABACACABAAACCAABABBBBCABBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe"	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCBCBBBBBCCCCBCBABCBBCBCCBACAACCAABACCACBACAAAAACCCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABAAAACABABCACACBAACBACCCABAABCBBBABAACACABACCCBBAACCC.exe"	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2400	sc.exe
1076	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4428	cmd.exe
1484	cmd.exe
4264	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABAAAACABABCACACBAACBACCCABAABCBBBABAACACABACCCBBAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3816	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3816	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3816	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3816	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1244	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
1244	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
1244	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
1244	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	1244	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2296	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 4428	3816	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 4428 wrote to memory of 4244	4428	cmd.exe	103
PID 3816 wrote to memory of 1484	3816	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	106
PID 1484 wrote to memory of 2400	1484	cmd.exe	108
PID 3816 wrote to memory of 4264	3816	2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	109
PID 4264 wrote to memory of 1076	4264	cmd.exe	111
PID 1244 wrote to memory of 3656	1244	svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe	113
PID 3656 wrote to memory of 640	3656	notepad.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_918ab9f51893d4610738e84443c0ded5_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABCCACAACBBBBCABCABBCAACCCBCCBBBAACBCACACBBBABCACBCBCAACACCCBBCCACAAAACBAACAABACCCBCCBAAACCAABCBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABCCACAACBBBBCABCABBCAACCCBCCBBBAACBCACACBBBABCACBCBCAACACCCBBCCACAAAACBAACAABACCCBCCBAAACCAABCBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBABACBCABCAABCCABACBBBCCCAAACBCBAABABCBCCACBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe" start= auto displayName= "UserDataSvc_CCABBABACBCABCAABCCABACBBBCCCAAACBCBAABABCBCCACBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABBABACBCABCAABCCABACBBBCCCAAACBCBAABABCBCCACBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe" start= auto displayName= "UserDataSvc_CCABBABACBCABCAABCCABACBBBCCCAAACBCBAABABCBCCACBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBABACBCABCAABCCABACBBBCCCAAACBCBAABABCBCCACBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABBABACBCABCAABCCABACBBBCCCAAACBCBAABABCBCCACBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAAACABABCACACBAACBACCCABAABCBBBABAACACABACCCBBAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAAACABABCACACBAACBACCCABAABCBBBABAACACABACCCBBAACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 98a12053f7db89ade970850f97297c2f9416365b804f7c7df7b639ad69b8cf2e
MD5 8d2be1e6e9420198b11e9408d143e32d
SHA1 db1c7642f2e2227c593a0ced46e679644313da12
SHA512 f0e4b59828812b337868850d4f5a97efb8cc2ecbffab1cc4751750a3d545087045c4108e145e3bbebed5194ce601da6f99c48678e85684d828148e64b1e7a42e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 909c86add4bf881d971899afb0095e9ca8de5a5220588f226d3a08ac40c8ef1a
MD5 7cd2e007f963d24994dc9b9ca101e58f
SHA1 2dd544deaed4d43019e872e74b8d87144c6e4787
SHA512 e799cc1e466ba511611af5f284592e1fc5d4adda75e2934a9e67cc93ca0abc9e9d1a97216c0796914ceef01d9fa06a35ebb30973ad8a37cdae80154997dcd2d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3b386acc3c0c5bebb1115a8f9b0dd8ec52d9f131d8c506c99c4d8c3ac3471e73
MD5 fa34b4d59af3e92672a6b67fb4d0fff5
SHA1 76d07cc26c7144e3725e6ffd25777fa9163cea52
SHA512 d3f4d310ae53db0d4e14961227b3f4700d47797421069bf0f0192ccd0eea4635ef7eace3121e32b6d7e85375d4c5c8aeaa30a3fa174e6ea551e60ac30caa6010
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ef0ff4b1782c7e4cfcd836686548c3c2e4c3c6fa99ba6ee54361d163cf3bc3b6
MD5 b2a5439d788ab5befdd6371b470141d5
SHA1 8271827d262d86d70f17c2e996a63c3f382855ad
SHA512 9421b4dd71eecc3b4c49d175564aad4a08d66b21923e44ffb1a92f3c0c78ac130c75aa0fd60bbddd932bea7fb1536e2a776485ad62fb7d3319e101d7c39693e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 132a6b38a8ebc0cefb8bdc100dc165a53ab385797b05760aad9cb90852d01223
MD5 c53a1cf2d20eac07aee3cd8a96c77173
SHA1 f078f6603c8c5dc4eea9af983f81a3de11329481
SHA512 f3f664815618b98423a2542dfe5f67bb0318330a53180339b713f6bf323db1c5ae43365eb1b593028d1ac852d93effa50c38f19c50c8171b84cb12445f9095dd
MD5 SHA1 SHA512

Submit Download

svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABACBABAAAACAAAABBAACBBAAAACABBAACABABCBCBBCACBBAA.exe
Size 24.5MB
SHA256 ee2805487fd06ea048d277730be4dd1cfa1bd869c5b9ab6409aa98ada41a9116
MD5 918ab9f51893d4610738e84443c0ded5
SHA1 2bf969870f2a176944c1c783db9f4d4eb97a6090
SHA512 6687e93a040a1769c2a2125bede1fb586ddf932af9d0e3e1f273cca0a061a3ace38edbf8cca9a47e3aa698ab4e8cff20faab8172860823248549ddce382f8046
SSDEEP 98304:lKRuy5adKRuy5adKRuy5adKRuy5adKRuy5adKRuy5adKRuy5aROU/jIEeQfoR/I0:lqiqiqiqiqiqiqAFIF0wuc
TLSH
T14B479F16F68808F1E97361388596D629EE7275250B31CACBB36C432F2F33AD19D39752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-25-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/1244-44-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/1872-70-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/3656-67-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/3816-6-0x0000000000270000-0x0000000000291000-memory.dmp

Download