519715bb5706d09a067bf6c0e31a82b5ad43eb1d01ece4cfc6de9f76f9921374

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 11.2MB
Sample260810-d84hkadh42
SHA256 519715bb5706d09a067bf6c0e31a82b5ad43eb1d01ece4cfc6de9f76f9921374
MD5 fc425fffd72d52b3194df7f9f748f152
SHA1 df4767da9f2aba70ac3340f27d86e1b73c8a4317
SHA512 e2c2fa4a016ae85c934db6a9c468b8a20ce3debfe16f38582b4eb29d902d5c0e6218b33780c750859d94808fb7984ed14d4e5ee1e2455ca3195fe42593f10f48
SSDEEP 49152:U+ES+EfA+ES+ETqatglJ+ES+E2+ES+ES+Effg+ES+EfA+ES+ETqatglJ+ES+E2+e:buuuuuuuGOU/jIEeQfoR/IuOFVjUu5r
TLSH
T16EC67D06F98640B1E87701704CDBD2BF8630BE258B228DEBF64DD71F6A32B909935756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6116	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
3232	svchost_BCABBABABCCACCBCAAACBCBAABBBCACABCBAABAACCBAAACBACBBAAC.exe
3592	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBAABCAACCACBCBCCBAAACBBBACCABACCBAAAABCAACBAAACCCBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe"	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABACCBBACBBBABCCCBABBCAACACAACCCBCCBBBBAACCBCAAACABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBABABCCACCBCAAACBCBAABBBCACABCBAABAACCBAAACBACBBAAC.exe"	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3544	sc.exe
2104	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3768	cmd.exe
5316	cmd.exe
2540	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBABABCCACCBCAAACBCBAABBBCACABCBAABAACCBAAACBACBBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2168	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2168	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2168	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2168	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
6116	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
6116	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
6116	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
6116	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
3232	svchost_BCABBABABCCACCBCAAACBCBAABBBCACABCBAABAACCBAAACBACBBAAC.exe
3232	svchost_BCABBABABCCACCBCAAACBCBAABBBCACABCBAABAACCBAAACBACBBAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	6116	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
Token: SeDebugPrivilege	3232	svchost_BCABBABABCCACCBCAAACBCBAABBBCACABCBAABAACCBAAACBACBBAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3768	2168	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 3768 wrote to memory of 3440	3768	cmd.exe	94
PID 6116 wrote to memory of 1384	6116	svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe	95
PID 2168 wrote to memory of 5316	2168	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 5316 wrote to memory of 2104	5316	cmd.exe	100
PID 2168 wrote to memory of 2540	2168	2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 2540 wrote to memory of 3544	2540	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_fc425fffd72d52b3194df7f9f748f152_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAACCBAABBBABACABABCBCCCABBCBCBBAAABACBCABBACCACBCAABBCCCCCACBCCCBCBBACABACABCAAAAACABAAAABACACCBCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAACCBAABBBABACABABCBCCCABBCBCBBAAABACBCABBACCACBCAABBCCCCCACBCCCBCBBACABACABCAAAAACABAAAABACACCBCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCAABCBBBBACBABCAABCCACCCCAAABBABCCACCBAACCCBCAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe" start= auto displayName= "UserDataSvc_ABCAABCBBBBACBABCAABCCACCCCAAABBABCCACCBAACCCBCAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCAABCBBBBACBABCAABCCACCCCAAABBABCCACCBAACCCBCAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe" start= auto displayName= "UserDataSvc_ABCAABCBBBBACBABCAABCCACCCCAAABBABCCACCBAACCCBCAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCAABCBBBBACBABCAABCCACCCCAAABBABCCACCBAACCCBCAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCAABCBBBBACBABCAABCCACCCCAAABBABCCACCBAACCCBCAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABABCCACCBCAAACBCBAABBBCACABCBAABAACCBAAACBACBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBABABCCACCBCAAACBCBAABBBCACABCBAABAACCBAAACBACBBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
1⤵
- Executes dropped EXE
PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d99a778f55a81e769ee8ed3652a7db443afc939701bdbc4411a05d237da652e9
MD5 22a35ba54a2c3089e019aea066b82458
SHA1 64c116fa71ee8cd3c2aac1d4222b02f30aae0717
SHA512 540519c5da86039c56b96265a2d3ee59fc47a8689a974d971439a5988ef6f274a6a6e74fb9b551064985afb900da8d2285019e025024ccdee7e64eb312c0d5cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f2c819d008a094958f28c862fe13bc47e685ed4f4b2c8d59727396e660cfd795
MD5 dcb8c33c42211d47bf90507968753fbc
SHA1 01d3ce71a2364320f224e3aa130b1b0f597b4778
SHA512 70072e9729ed32bdee9f1ac7cc32bc0dc2908a7207a924a816af934251bce2a2b5f8ec109340a61b148c22a530dd4459bf8fad90fac13fea16f2bcf61355e457
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ac3740bb41e37f21adc95f4af75cb930fc8f8d2ef26229b7adf1f60ddd28f5a
MD5 8704e7305c51f3b49ce792b0fecfde8f
SHA1 3b52946a8bb1bb8bd0ff03080fd06feccc92b1e3
SHA512 00a4a5f0b38a538cea3a7589bf578873606b49c6ac5843a717a1324acc628d3095a655f56a5d7e0d2bcf191b294273767341dd92253754e67b16d76cda64ec5c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 06443da676f71aeb1543aae78ce32ea36d343fc0404ce750e514d88420c7fdfe
MD5 ff515be0559d0cd6fdaae6ea9abed35b
SHA1 44580025811590e57c41017bcb5b5a57b5cf11c6
SHA512 8b6802ac25d9f8d8a1c002cd0dd9ec2bf761795757f64c5ae643abc73b091e2a2d4537f75372d0cbeaf5a62e92089f77e311164323e1a9f4f064b7f5318a66c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dfc5961407ecfe2bf73148ce32008d2690c1c2870803a175bb0c97d4b3c3aae3
MD5 d8b2a529ccb46639600df70d4f46bb21
SHA1 2441bc509fae3c10e4669ff947a16bc190248508
SHA512 8347ccdf5254eb5c793a8bb391cb13ee60d2123f680c946d7b5f23339dfd09c08738ce8ee01b85d9bc2d439d9b5c03ced79ecf07e9fcf6e4876594225a2d2fc4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a4b0b4daf8642dc7177deb7ec158c7fd657d6c22fe1a8bd1492692ec2f703cfd
MD5 80d64265f39457c0829c9e8e539123c1
SHA1 15fe13c49a3211e9dcbc9d362840d17d82c11a29
SHA512 b79137aa5da29127859abc71c83bdb94ea41aafa74b27a731770b06ac93488489e855098bf54ae94d614c054dc761fca7d6816df92e341197805036b711eda16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6ece02baf340dd727ef9475b990ccaaf90b09d2581cfe756d3e32352c78e4f0b
MD5 09d222dc8552439e4e54b9e20597e0e4
SHA1 a250d701c6dd332f60dca5bffd16e11f5354ed0f
SHA512 a685c7ae8bebb81072f4d3229e737a14616111acef082f2123bc7939a3811cac93e1787c678bdae980c23d96710b059efe1ae603c8b45656c9bc9d515f5e41dd
MD5 SHA1 SHA512

Submit Download

svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBABBBCCBBCBBABCBACBAACAABAACBBBBCBCABBABCCCBCBCBCCAC.exe
Size 11.2MB
SHA256 519715bb5706d09a067bf6c0e31a82b5ad43eb1d01ece4cfc6de9f76f9921374
MD5 fc425fffd72d52b3194df7f9f748f152
SHA1 df4767da9f2aba70ac3340f27d86e1b73c8a4317
SHA512 e2c2fa4a016ae85c934db6a9c468b8a20ce3debfe16f38582b4eb29d902d5c0e6218b33780c750859d94808fb7984ed14d4e5ee1e2455ca3195fe42593f10f48
SSDEEP 49152:U+ES+EfA+ES+ETqatglJ+ES+E2+ES+ES+Effg+ES+EfA+ES+ETqatglJ+ES+E2+e:buuuuuuuGOU/jIEeQfoR/IuOFVjUu5r
TLSH
T16EC67D06F98640B1E87701704CDBD2BF8630BE258B228DEBF64DD71F6A32B909935756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 e16786a33b08841b9e695fd1b4cc44ab33e92c4410e0c4982e6215468c99220f
MD5 b54fbe830c43d4e206ab4fb7ec9cf488
SHA1 ed2a00c4a10cf854cb07afb5ed9c2079267e94a8
SHA512 5c0f1836d0189cd1c6c50e30e276a15d4d2935783c1b28bb7c0c8226e049e82d1b784efbdfb14add87ad22429df0cd148afb85d99c9324074b6a57ff730ef111
TLSH
T13C01DB81B5A9D853FD323CDB471B5AA20C983A4B7C9C9A2453894518BBD8C31DD554B1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2168-0-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/2168-7-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/3232-64-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/3232-82-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/3592-84-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/6116-33-0x0000000000890000-0x00000000008B1000-memory.dmp

Download