c9a06118badf64f966e3bcd4411eabc1a52c288610ac809467cad6de3539eb9b

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 10.6MB
Sample260811-a7ew2axycv
SHA256 c9a06118badf64f966e3bcd4411eabc1a52c288610ac809467cad6de3539eb9b
MD5 df9d059c7e251d102f30c7d9905d7279
SHA1 5e381a9dde6f7f520fc87d9d15d14dc1b3c9eb79
SHA512 797a9ed3439d29d5196a7ee687e5891f3516ed8a370f9ddf7a527447a80bc2bf0ac8c6d9a0dad0813eb66e2fbf026a8eab72c57c075d2f868df781dbe0fc0109
SSDEEP 98304:RKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aoOU/jIE/:RqRqRqRqRqRqRqRqpFIF0wuv
TLSH
T1FDB6AE12B7C24071E6B33530496FE3796D7D77214635899EB3880A3E5F32EC09A2976B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1352	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
4908	svchost_BACACACBBABAABAACABBBCCBBAACACBCCABBCBCCBBCCBCCABCAAACC.exe
5020	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABABACBABBBABAAAABAABCACAAAAAACCACCCBBBABCAAABBCBCAACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe"	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBCBACBBABCBBAABACBABCAAABBABCBBCACBBBACCBCBBCBAAAABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACACBBABAABAACABBBCCBBAACACBCCABBCBCCBBCCBCCABCAAACC.exe"	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6004	sc.exe
3116	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5136	cmd.exe
5100	cmd.exe
3492	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACACBBABAABAACABBBCCBBAACACBCCABBCBCCBBCCBCCABCAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2640	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2640	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2640	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2640	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1352	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
1352	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
1352	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
1352	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	1352	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 5100	2640	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 5100 wrote to memory of 1972	5100	cmd.exe	94
PID 1352 wrote to memory of 4296	1352	svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe	95
PID 2640 wrote to memory of 3492	2640	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 3492 wrote to memory of 6004	3492	cmd.exe	100
PID 2640 wrote to memory of 5136	2640	2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 5136 wrote to memory of 3116	5136	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_df9d059c7e251d102f30c7d9905d7279_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBCCACCCABBCABCCBBAAAAAABABACABBABCCACAAACCBAACACBACBBBCBBCACCAAABBACBABAABBBBBCCBABBACCAAACACBCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBCCACCCABBCABCCBBAAAAAABABACABBABCCACAAACCBAACACBACBBBCBBCACCAAABBACBABAABBBBBCCBABBACCAAACACBCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBAABCBACABBBCCAABCCABBBBCACCCCBBBCBCCCCCBCBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe" start= auto displayName= "UserDataSvc_BCCBBAABCBACABBBCCAABCCABBBBCACCCCBBBCBCCCCCBCBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBAABCBACABBBCCAABCCABBBBCACCCCBBBCBCCCCCBCBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe" start= auto displayName= "UserDataSvc_BCCBBAABCBACABBBCCAABCCABBBBCACCCCBBBCBCCCCCBCBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBAABCBACABBBCCAABCCABBBBCACCCCBBBCBCCCCCBCBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBAABCBACABBBCCAABCCABBBBCACCCCBBBCBCCCCCBCBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACACBBABAABAACABBBCCBBAACACBCCABBCBCCBBCCBCCABCAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACACBBABAABAACABBBCCBBAACACBCCABBCBCCBBCCBCCABCAAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
1⤵
- Executes dropped EXE
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e63ea4121782acb91a9e4441fb460506cc4cbc7bf09b8c2818bcc2acaafabc9f
MD5 1da08fabbde3aac502db144afff665de
SHA1 0ac2fbd76fc4fadcf34a8add6313a3f84b3bedb0
SHA512 adb2ac02050f44690783f9158aa0cc8072d327500be148be425b9863bc5ef5d9d585f6be900028442a71d0dcac1089a6b77d570e71fc5bf25c14186c61f58f24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 342924eb3f2d66d35bb51d31e63f9050173f9527bc65267b87a8f82f9067536e
MD5 befb6e908f6c55c328c8dd151c1759bd
SHA1 fa50b7ccfbc7aed6d46abd78dc77fb4f057452e8
SHA512 9b8f6246f0f3cc4c23fbe69e3480a8c26cd6c6aef5801a0c1bb1758e80eb23440981256e31b60c1b8373cf87fb5ba92af1ee8ce827834d3dbf1317571ba55525
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff674703b86c06b01a2398d67f9510e3f338c27884308ba137d29753efdac8e8
MD5 8027fcb0b3c674c121320fb795e5c069
SHA1 a3b311a8269999ae65071466b3345cbc0fef6130
SHA512 7c7fc4462d05fa34cc43af7fa34f524271885251787af54c7e7c8a8db595060f3e281b186db830a603b9d9efa10e8d0bc13cf4b4fbe5e4db5870cab26d29fdd4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a443515d5ff95a06aa0efbb71380beb5e7a87ceb44fe8982bce807d95adf7b3
MD5 cd4e6a11d5a738282d04afb8c220896b
SHA1 89115b6aed3a0d7d0465ac36eea588a144f88247
SHA512 9744c97deb637509519780339f2bf1f4a4a735f879f594377c24aca77a2d711b529257598c6c5a26d4eb1b60567f34afd5aa7bf8f459f6714977615955bd492b
MD5 SHA1 SHA512

Submit Download

svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABCACCBCACCACBBAAAACCCACCABACBAABBBCAAAACAACCCA.exe
Size 10.6MB
SHA256 c9a06118badf64f966e3bcd4411eabc1a52c288610ac809467cad6de3539eb9b
MD5 df9d059c7e251d102f30c7d9905d7279
SHA1 5e381a9dde6f7f520fc87d9d15d14dc1b3c9eb79
SHA512 797a9ed3439d29d5196a7ee687e5891f3516ed8a370f9ddf7a527447a80bc2bf0ac8c6d9a0dad0813eb66e2fbf026a8eab72c57c075d2f868df781dbe0fc0109
SSDEEP 98304:RKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aoOU/jIE/:RqRqRqRqRqRqRqRqpFIF0wuv
TLSH
T1FDB6AE12B7C24071E6B33530496FE3796D7D77214635899EB3880A3E5F32EC09A2976B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1352-24-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/1352-34-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2640-0-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/2640-8-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download