bc2aa4fd0ee340fd583d23b23c045f08e21c9bb8bfec862a0fef90492c4fbc1b

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe
Size 25.3MB
Sample260811-bbfn5abf42
SHA256 bc2aa4fd0ee340fd583d23b23c045f08e21c9bb8bfec862a0fef90492c4fbc1b
MD5 bd29df800ee440f4628b53f9c35d1a0e
SHA1 dfa1a160f3a424ac63d273c3fcc283e5b7a8b284
SHA512 0564cc922a7b427faecf0951dc34ff2805f6c3520f9b57e2868f799d62ba8ac6531d99204a2462a8fc90167acec1bc8a55520f03016b2edbf057bc70273cda24
SSDEEP 49152:U+ES+ES+EOkb+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ESu:/p7I
TLSH
T10E472A09F94340B1D92B51B04DCFD3BF8A20BB2586128EFBFA4DCB5B6933BA16438555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5956	svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe
2040	svchost_CCBAAAAACBAAAABCBAABACABCABAAAACBBCBCBBBCBCABAACBABBBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCBCABCCBBAAABCACBBAAAABCABACCCAABBACCBCCCBCCAAACCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe"	2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAABABBABBCAAABBCBABACACCACCCBCABAACCAAACAAAAACACACBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAAAAACBAAAABCBAABACABCABAAAACBBCBCBBBCBCABAACBABBBCC.exe"	svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAAAAACBAAAABCBAABACABCABAAAACBBCBCBBBCBCABAACBABBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4152	2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe
4152	2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe
4152	2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe
4152	2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe
5956	svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe
5956	svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe
5956	svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe
5956	svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	5956	svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 1260	4152	2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe	94
PID 1260 wrote to memory of 6136	1260	cmd.exe	96
PID 5956 wrote to memory of 2768	5956	svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bd29df800ee440f4628b53f9c35d1a0e_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBACCABAACACCCBCCBCCBCCBBACBBABACCAAABBCABABACABACCBABBBBCCBBBBBACBBBBABAAACCCCBBCBABCABCACACAACBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBACCABAACACCCBCCBCCBCCBBACBBABACCAAABBCABABACABACCBABBBBCCBBBBBACBBBBABAAACCCCBBCBABCABCACACAACBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAAAACBAAAABCBAABACABCABAAAACBBCBCBBBCBCABAACBABBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAAAACBAAAABCBAABACABCABAAAACBBCBCBBBCBCABAACBABBBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e19f2871599243f1afe04b89b78e6b1a2b8365c42d461ce3185a63c5c0fcefa
MD5 e2ca6b8a8aed821523843629f772bb93
SHA1 6bc8063a2aad58d28607f7ebb15e9db215a291a5
SHA512 f74d291a8e484b7d37f602acadc10e94020eaac6277d87c15462aff717a38b7ead5ef90a5aa154274c19ac59adbaeecb7b7b1e2358426705856e7a353c9afedc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32c8d6d7e20e2831fcfd3ee30d5507f8047d6fb66c71b27dc31d4c0ba10d831b
MD5 10838b892017ac4a5c15d6d62e115814
SHA1 29a0c021437dcf94e6f5067ba311fcd40e74ea26
SHA512 71de3b4223a14dc4421b08f068e1c8e76b2652b0cef61134811fb7a0d1ead2df798389739a7eb73a8bc227b90c3b05deffabc6b96a92ae8305a271ac189f5f68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 83b82f01120d7b338ea63daa6b863a894df070c112055189bb87b33285951c2a
MD5 1e26a2e2af7712207036032710400e6c
SHA1 723c515f0cfdb3e9c0479a566bd84bb7cc6eb8de
SHA512 08d091f73191ec9b481b7682d4d0dedff58d267c75dd26ef2d404126ef0479fce4aae2b3dbfcb55806bd88f0ffbb58bf62a79f2b01420d580a34579dac46bb66
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 63e1f2a4cf7d96e31ec142278286dca81f09ebc5d137fed147eff5de7f9d602d
MD5 d5f7d01ad59fcc7150ebbb9c8658b67f
SHA1 30137a4bb03c4ccc52cdcb58925e97d6fca037ec
SHA512 e53b828824487a07956fc39e352fb63cc2fbe9eaaff7bd38f4cb1f708b2d43808d8ab1abdd974c89a51231a107d9fe13f0952e0d462bd79339e7c95ac3263e98
MD5 SHA1 SHA512

Submit Download

svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAABBCBBCBABCCABCBCBABACABBBCBBBACCCCBBBABBBBCACBBBBA.exe
Size 25.3MB
SHA256 bc2aa4fd0ee340fd583d23b23c045f08e21c9bb8bfec862a0fef90492c4fbc1b
MD5 bd29df800ee440f4628b53f9c35d1a0e
SHA1 dfa1a160f3a424ac63d273c3fcc283e5b7a8b284
SHA512 0564cc922a7b427faecf0951dc34ff2805f6c3520f9b57e2868f799d62ba8ac6531d99204a2462a8fc90167acec1bc8a55520f03016b2edbf057bc70273cda24
SSDEEP 49152:U+ES+ES+EOkb+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ESu:/p7I
TLSH
T10E472A09F94340B1D92B51B04DCFD3BF8A20BB2586128EFBFA4DCB5B6933BA16438555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4152-0-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/4152-57-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/4152-64-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/4152-30-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/4152-16-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/4152-90-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5956-63-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/5956-88-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download