500f4a104b8b2b6964bbe10ec6e1cce329b2a7bece146b531e8be508a51e309a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 31.1MB
Sample260810-eff28svthz
SHA256 500f4a104b8b2b6964bbe10ec6e1cce329b2a7bece146b531e8be508a51e309a
MD5 e126e4c4d263bb66ac04741e7c09e452
SHA1 6698fa56e14ff902f61a64dd5d7c82fab3eef562
SHA512 b07d8d58cd1a9c3eb355d789ba9d65be9d5a12dd08355e9458974792a08e081e2eb8e55246d06c1d590e100a11f510cc18201caa5b3feda4e7a7b7f9b7390c46
SSDEEP 98304:GsNsgsNsgsNsgsNsgsNsgsNsgsNs3OU/jIEeQfoR/IuOFVjUu5M:qFIF0wu2
TLSH
T146675C06F98740B2E83701B04CDBD2FF8A70BE258A128EABF64DD71F6933B909535655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3940	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
3460	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
1640	svchost_BBCBCBAACCBBCACCBCCABAACABCBCCAABACCABAAABBCBBCACCCCCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBBBBCCABCBCBBCBBBABBBCAABAACCBCBACBCBBBABCBCABACBABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe"	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCAACABBCBABBBACACCBCCAABAACACBCBCCCACAAABCAAACCABCBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCBAACCBBCACCBCCABAACABCBCCAABACCABAAABBCBBCACCCCCCC.exe"	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1636	sc.exe
2600	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4004	cmd.exe
2028	cmd.exe
4792	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBCBAACCBBCACCBCCABAACABCBCCAABACCABAAABBCBBCACCCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
756	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
756	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
756	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
756	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3940	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
3940	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
3940	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
3940	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	3940	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4132	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 4004	756	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	95
PID 4004 wrote to memory of 3116	4004	cmd.exe	97
PID 3940 wrote to memory of 4292	3940	svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe	100
PID 4292 wrote to memory of 1532	4292	notepad.exe	101
PID 756 wrote to memory of 2028	756	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	103
PID 2028 wrote to memory of 1636	2028	cmd.exe	105
PID 756 wrote to memory of 4792	756	2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	106
PID 4792 wrote to memory of 2600	4792	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e126e4c4d263bb66ac04741e7c09e452_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCCBBBBABACAAAAABCABCABAAABBCABBCABBCCCCBBABAAAAABBBACBAAABBBAACBBCACBBCCBBBCCACCCBCABACACBBBCCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCCBBBBABACAAAAABCABCABAAABBCABBCABBCCCCBBABAAAAABBBACBAAABBBAACBBCACBBCCBBBCCACCCBCABACACBBBCCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAABCCBBACABCCBBACBCBCCCBBAACABCCABAABBBAACCCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe" start= auto displayName= "UserDataSvc_ABBAABCCBBACABCCBBACBCBCCCBBAACABCCABAABBBAACCCBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAABCCBBACABCCBBACBCBCCCBBAACABCCABAABBBAACCCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe" start= auto displayName= "UserDataSvc_ABBAABCCBBACABCCBBACBCBCCCBBAACABCCABAABBBAACCCBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAABCCBBACABCCBBACBCBCCCBBAACABCCABAABBBAACCCBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAABCCBBACABCCBBACBCBCCCBBAACABCCABAABBBAACCCBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1532

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
1⤵
- Executes dropped EXE
PID:3460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBAACCBBCACCBCCABAACABCBCCAABACCABAAABBCBBCACCCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBAACCBBCACCBCCABAACABCBCCAABACCABAAABBCBBCACCCCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 92dedf88396b90d5b46f330c3d88d452066bb32338b693ca363966ded5d097b9
MD5 9ae980fe47d4ffac22b5a8e77e42416c
SHA1 dbd62cf639124eb26c7c926708d54273439a14cc
SHA512 1e22f57b381ce9947590b91840c1bed387704d2bbca3f0e945ed59784f5ef7db9dec62e9a00470d3677e0f228505b62b009d2b9492e618bf185f94a46133f53a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e21b9ab729df279f8286f869238dd958db1d66f6ec1a18a82151039ec7e6ce02
MD5 619eb0f9b3a42b0bf0fc5bbd06d862aa
SHA1 dfaedbd861e0e1c481fde09c43e1f701eadd3f3d
SHA512 6e8cb0de5dbce8cbfc0ac5994ba0343ed338ab87c2bec63fb0b31c728b291cb82008628780656429a13659a65852b07a3ea6ec9835cf36af41d2d0202a4896b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b982652e902866357ca31db84eea96e5d5155f78ea3ed9fe1fa5f15cc5e72562
MD5 cb40f8f088a783183bdfb2a3473a4f81
SHA1 dca79ebf6098754e41d380f90438dc75629670d0
SHA512 360701d23fa49f47096559a7ede221123fe9ccbe61d7d4456054852bbe2c3d8104c0fff8132f98c5de575b61211fd1a5e66187d893dc9e698c9141ba483bb753
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5e6729624d90b29642088670e9cb17c2015d1a9368e08081f73ec430f5d4d7d
MD5 01cd60a3e316b5345e2ec75b02f5f308
SHA1 21a2210e18da57552fa356b47452ce886b02e1c8
SHA512 ace9ef30ee9bc473ef1c1dd62f5d6dfcc9d9abde4f4c0b596520e170139d331b76ba9a119f04b672d8a6c620990382730205168a89b92f508f7aaa0159500a14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a1145e4048d1f13a12e0beb18695637fc039656e4d45d7446ef333298cf9577
MD5 aa30285eede7b541c21408db4b2a5792
SHA1 b2dfdc5bd22b89881ee3a9c57de79c55078be1cd
SHA512 c7b95fc61ebecf79bb2d8a97067212a559ee65b5a8617c8f29bba0bf3dc914d739d43ee5b1186ea2c74e82887cd35b3760340a6b892c92e8e937ef675217e6fe
MD5 SHA1 SHA512

Submit Download

svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCCAACABABBCAACCCBBACBBCABCABCBABCACBCABACBCACCABBAA.exe
Size 31.1MB
SHA256 500f4a104b8b2b6964bbe10ec6e1cce329b2a7bece146b531e8be508a51e309a
MD5 e126e4c4d263bb66ac04741e7c09e452
SHA1 6698fa56e14ff902f61a64dd5d7c82fab3eef562
SHA512 b07d8d58cd1a9c3eb355d789ba9d65be9d5a12dd08355e9458974792a08e081e2eb8e55246d06c1d590e100a11f510cc18201caa5b3feda4e7a7b7f9b7390c46
SSDEEP 98304:GsNsgsNsgsNsgsNsgsNsgsNsgsNs3OU/jIEeQfoR/IuOFVjUu5M:qFIF0wu2
TLSH
T146675C06F98740B2E83701B04CDBD2FF8A70BE258A128EABF64DD71F6933B909535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-7-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/756-0-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/1640-80-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/3460-75-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/3940-26-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/3940-39-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/4292-60-0x0000000005200000-0x0000000005201000-memory.dmp

Download