9889f06324cd4a0dae314fe1d5ebe4fc11985daaa949b181cc0adcacbed9aa71

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 56.7MB
Sample260810-etpxas1clf
SHA256 9889f06324cd4a0dae314fe1d5ebe4fc11985daaa949b181cc0adcacbed9aa71
MD5 a12e739a734b530927bb766e5b1267d9
SHA1 81f1547a7203894f041f2f8fcb62375a7965b49f
SHA512 14d6798e22ffe842de60ba55fb584c8b33299b9a2a65fb68a1adbbb7e04e796a183b2b4aa9e7430c6f2c168a4daf3c7d78e10b8a88909432e9d4a1dd4ae3115b
SSDEEP 196608:dhhhhhh1FIF0wuqhhhhhh1FIF0wuCFIF0wu6:dhhhhhh9qhhhhhh906
TLSH
T196D79E50B9E54CA2E972113D49F7C376563CF9E04B338B9BA318663B1F22BC168A5707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1096	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe
1056	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe
4348	svchost_ABAAACCCAAAACACBABCABCBACBAACCAABABCBBCBCBBCCBBBABAACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABCACBABBBBBBBCAACACACBBCBCCCBACBACABBBBCABCCCBCCBCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe"	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABBCBABAACBCBCBAACCBCBAABCACABABCCCBAABCCCACACBCCBBBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAAACCCAAAACACBABCABCBACBAACCAABABCBBCBCBBCCBBBABAACAA.exe"	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4540	sc.exe
2064	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3100	cmd.exe
3712	cmd.exe
4152	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAAACCCAAAACACBABCABCBACBAACCAABABCBBCBCBBCCBBBABAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3736	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3736	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3736	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3736	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1096	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe
1096	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe
1096	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe
1096	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	1096	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3100	3736	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 3100 wrote to memory of 4232	3100	cmd.exe	94
PID 3736 wrote to memory of 3712	3736	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	95
PID 3712 wrote to memory of 4540	3712	cmd.exe	97
PID 3736 wrote to memory of 4152	3736	2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 4152 wrote to memory of 2064	4152	cmd.exe	100
PID 1096 wrote to memory of 1912	1096	svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a12e739a734b530927bb766e5b1267d9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACCBBCCCBCABCABCAABAABCACCAACBACCCBBBACABCABBCBABACABABBABBBBCBACBCAAABACCBCCAACAAABCCCBCBBBBBBACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACCBBCCCBCABCABCAABAABCACCAACBACCCBBBACABCABBCBABACABABBABBBBCBACBCAAABACCBCCAACAAABCCCBCBBBBBBACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBABCBABCACBABAAABBABBCCABBBBCBCBBACCACCACCBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe" start= auto displayName= "UserDataSvc_CCBCBABCBABCACBABAAABBABBCCABBBBCBCBBACCACCACCBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBABCBABCACBABAAABBABBCCABBBBCBCBBACCACCACCBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe" start= auto displayName= "UserDataSvc_CCBCBABCBABCACBABAAABBABBCCABBBBCBCBBACCACCACCBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBABCBABCACBABAAABBABBCCABBBBCBCBBACCACCACCBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBABCBABCACBABAAABBABBCCABBBBCBCBBACCACCACCBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABBABBCCABCBCCCACBCABABBABCACBAABCCACACAAACABACCB.exe
1⤵
- Executes dropped EXE
PID:1056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACCCAAAACACBABCABCBACBAACCAABABCBBCBCBBCCBBBABAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACCCAAAACACBABCABCBACBAACCAABABCBBCBCBBCCBBBABAACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 85d58e0ad5f1eda62986017ed34b88dc7f66d61fe3b68e4866a7e8e6a291af08
MD5 e0fc75fa82b3b643a0516a03b640898c
SHA1 6850214c6bb301bfb8e80116f80f2cfc808851de
SHA512 ebead4852d909778fa720c8d18a9b71126d2443594fa79aa8c526464f85a27517e3ccad3a357cce1cda61810bc86a07c9a5ee4eb7fdca276647341ec58f6e38f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e853df4ae8294e84d11cd9a4266424a8161c14939a57e2ad4ef7573f4ffcf16c
MD5 0ab3ecd43669bd1c07b47824a2ced01c
SHA1 4d0f7dcecb7e1136f808988e63cb151f264bc629
SHA512 105b8ea0d13f647be8105b48f32133b3eed077b19519ce7188b4da4f5e99d12f44ceaf97326fd3525f74700624452c47dc134f6d02b393a6aa6d30e7b7e57bfb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5607d82ebc00369eba4bd1e18867dc0f02dd41b819610d9c29ae4f1d72b85388
MD5 2842142f7e202daa0a530c45a8bd6470
SHA1 f8f17ce153c92ca6cc6451f65ab2a82bb9a8cb57
SHA512 ae3ad327e0d1b8b180e0396dfa403b5f422a463c0a7bfcb6bda4046434adc0ef39cb5f747c4a26dfd9349b54cf4e2aa740e332ef079b29962368abe189cd3697
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fbde75722850009351691f9485de02a9f3fc6225ccb93f653a884e394a72d378
MD5 ecdcff7ee4d29b8358d57dff5272b1fd
SHA1 9bfb93563c2c521e671a81f567d9f13312ab392d
SHA512 49dee797d2df630abcb2299981322a52dc204e763565afdc1a8b1ae16ca4088194bef4549346d12344c8ac5f921e03def53a4065f832cc8e3b946fe94364d02c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ce4be4c9da5c3c354dd8140ed8252671a71679c0b81971f15034cc44864315e9
MD5 918958181148159f744e61f34ccf2046
SHA1 d0fa43e49d4969542a55a2f7febfeff29fd425e1
SHA512 13f5fb7ae5b14a65b58d158305a0487df417dca7717cf153f970a4a4fe1ab42ef91311e022407c4226e81b360fdd985cf1fecec75a7688254dec347ff1872aaa
MD5 SHA1 SHA512

Submit Download

memory/1056-66-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/1096-22-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/1096-35-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/3736-6-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/4348-72-0x0000000000480000-0x00000000004A1000-memory.dmp

Download