a6fbd6d29cfccddd2aa5358c41c7e819b7e8fef440e68dd414e877b18b9ecfbd

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe
Size 4.3MB
Sample260812-ag75wsfl91
SHA256 a6fbd6d29cfccddd2aa5358c41c7e819b7e8fef440e68dd414e877b18b9ecfbd
MD5 1bf41bc4c60c4ac793c766a53c1de4c8
SHA1 d2482a70efa5359034e6d2d4e695cb75be6f1888
SHA512 85733dcef4f738f0959f6ac361541bac4c487ff75f3104fd7ca35add5976daab5449403a9b1697c57ec58a7f4735c140f029763f595e338d262944e7ca726367
SSDEEP 98304:NO4q75Av7fbUhabgFO4q75Av7fbUhabgBp7+:NO4q7+zUhasFO4q7+zUhasH+
TLSH
T176262A2C6DE841A6E4729675C9A2A6DDEA3278127B005FCF11D1534E0D3BBD2AC70F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
256	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
5156	svchost_ABCCBCCBCAAAACABACACCBBAAACBAACABABABBBCAACBAABCAACCBBC.exe
4880	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBACCBCCBABCBBAABBBCBBBCABCBCAAACABBABACCBABACABCACAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe"	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAACACBCBCABCCBBAACBACABAAABBCBBCBCACCCCCCACCCBACACBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCBCCBCAAAACABACACCBBAAACBAACABABABBBCAACBAABCAACCBBC.exe"	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2760	sc.exe
3336	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1736	cmd.exe
5400	cmd.exe
3496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCBCCBCAAAACABACACCBBAAACBAACABABABBBCAACBAABCAACCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1388	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe
1388	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe
1388	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe
1388	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe
256	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
256	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
256	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
256	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
5156	svchost_ABCCBCCBCAAAACABACACCBBAAACBAACABABABBBCAACBAABCAACCBBC.exe
5156	svchost_ABCCBCCBCAAAACABACACCBBAAACBAACABABABBBCAACBAABCAACCBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	256	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
Token: SeDebugPrivilege	5156	svchost_ABCCBCCBCAAAACABACACCBBAAACBAACABABABBBCAACBAABCAACCBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 5400	1388	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe	94
PID 5400 wrote to memory of 6456	5400	cmd.exe	96
PID 256 wrote to memory of 2688	256	svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe	97
PID 1388 wrote to memory of 3496	1388	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe	100
PID 3496 wrote to memory of 2760	3496	cmd.exe	102
PID 1388 wrote to memory of 1736	1388	2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe	103
PID 1736 wrote to memory of 3336	1736	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_1bf41bc4c60c4ac793c766a53c1de4c8_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCCBBBCBACBABBCABBCAABBBAAABACBCCAAABCBACBAAAABABCBAABCCBCABBAAABBABCBBCACCACBAACBAACCCCBAAACABBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCCBBBCBACBABBCABBCAABBBAAABACBCCAAABCBACBAAAABABCBAABCCBCABBAAABBABCBBCACCACBAACBAACCCCBAAACABBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBACACACACCBBBBCCABBAABABAABCCBACBCAABBCAABAACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe" start= auto displayName= "UserDataSvc_CCCBACACACACCBBBBCCABBAABABAABCCBACBCAABBCAABAACABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBACACACACCBBBBCCABBAABABAABCCBACBCAABBCAABAACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe" start= auto displayName= "UserDataSvc_CCCBACACACACCBBBBCCABBAABABAABCCBACBCAABBCAABAACABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBACACACACCBBBBCCABBAABABAABCCBACBCAABBCAABAACABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBACACACACCBBBBCCABBAABABAABCCBACBCAABBCAABAACABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBCAAAACABACACCBBAAACBAACABABABBBCAACBAABCAACCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBCCBCAAAACABACACCBBAAACBAACABABABBBCAACBAABCAACCBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
1⤵
- Executes dropped EXE
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f9fe4e99e26e15fa5c57786cca0ab6747438586fdbd238068c014daed29d82d
MD5 cd9dd2f69aae1ec46ad3e0762b8d766c
SHA1 dd0fd6d2fc55551a72fa9d255d7b39369d446ff4
SHA512 c856f55abccefe6cc2a5948df8346262a6c03bfb80ad2b8d768000a1644d6d0d1669ef75ef3c839ba0110c9a0c0f75af520a9c462ca4f04444f627d183c395f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a5bfa558ed7455f66acee970fb00b8f5abb38280db3446fdf0bc44bb782b392a
MD5 5996959deb6d14fbe5967645bb840e05
SHA1 c351a47aa540b8b149f20e0335ff45573cadf3de
SHA512 fc1cba1fa6f640c344770c6c7899781acf85f7750ed2ceaa37e7ef2b1406f18e1ccae3dd5e2f1b944cfcba9da420246dbeea4637dbdf56ff7fe9db0a8fb406f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9db9fc4706458b372a04fe186fc61a2b101aef44f74b1e68779fe81190671774
MD5 b0929e4841c8d224aadd9e2046cc2627
SHA1 f305f046edfcd501a2514311a4cb511cfc2ffea7
SHA512 5c97c493517b730215a91a37f288f43ea13eda939409490629fd808eacf905214197db04f7ea57cba7703cda64623a9b2f3eeeb5470b1524ff4be109540ad515
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 71ec279cfc2b8c48b1b76897b5a2ae9203d8f4a7b0ca8b2aae49ba05f81ec15f
MD5 cd31d815cf1445a4c43183813e7f1fc4
SHA1 d6c0afcbf1262d29424bb88d1c0446395455fe65
SHA512 f944ba114bc530ae86b24240ae80acf8945d16c3825ba89697316aa6048049c2b4c87e5f6f446e643b33c6c6c51fc046b21196c9fbcb244b216cb3b760a51eb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dfd31096b4d781e87b8982008144f5d549832a81840e88fa2eb0d340d9b1b014
MD5 f33d88cee7fdee81adf14f6c563bf2f6
SHA1 7164d206149f3690b5dc22974278e7f3e8b19768
SHA512 4f558b6975c78012ac3858dd5c1e42e1b55b5e48df0ad20b9a03ab214b508ee0d6075b1133d584e76f612631972ccf4489fa8ad503bdfde095d4784b484befd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eb8eff4a5aa816d31429e5a67113ffe417e8ff9c85305bfabbbdbe7dc59207ad
MD5 809acaed6d0a971841c0b8bdf1d25e78
SHA1 16249491c5ee240c386dc8de68b3334a5d268fae
SHA512 a7dcd34d9c568db50a32f2187790bfaf7f0756e918cab4bf2b7b07b51486befa74ba9c983a3542718a65ff5e043e3d6765abd797324587fa1096fc0453070065
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f85cf5a32d93db307654106e35851cf44f58c389b2c8b36ba2d28444dac5b0fe
MD5 b2b4326bbbbd7dfe46b4d20d611080ec
SHA1 af574857f2224860fa00bb92151c83ceb088ac85
SHA512 12e3d62234d46548d47caa711b7e027f52105658354672675cb3a6beebef3eb3e6e4cacac4d1162dcf67e1bf4ffb651aacbbee3a6f5b1dca498e7a4fc2afacb7
MD5 SHA1 SHA512

Submit Download

svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBACABACACBCCBABBACACCABACBCACABAAAAACCCABABBBACBCBB.exe
Size 4.3MB
SHA256 a6fbd6d29cfccddd2aa5358c41c7e819b7e8fef440e68dd414e877b18b9ecfbd
MD5 1bf41bc4c60c4ac793c766a53c1de4c8
SHA1 d2482a70efa5359034e6d2d4e695cb75be6f1888
SHA512 85733dcef4f738f0959f6ac361541bac4c487ff75f3104fd7ca35add5976daab5449403a9b1697c57ec58a7f4735c140f029763f595e338d262944e7ca726367
SSDEEP 98304:NO4q75Av7fbUhabgFO4q75Av7fbUhabgBp7+:NO4q7+zUhasFO4q7+zUhasH+
TLSH
T176262A2C6DE841A6E4729675C9A2A6DDEA3278127B005FCF11D1534E0D3BBD2AC70F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 cb9f5afd9121fa47315a064794d2bb392257c124d68b78ae8ae848634463bce1
MD5 80c049141ad76edfc2d196175c12a6d7
SHA1 f78ae6ed95187d929935c6de26ce13498b84d273
SHA512 ea013abad838c842e7808f730143c67b9d5f0ba9212bec19256fc9ef0bff7d509d22e4c1f1c2f3b2629604b9fb943ec6053d8a2ee630821c3bbe971df200e6dc
TLSH
T19C112271A4E6C813F9227CDB9539AB860DE4339F6C7C5A041349031C7B45C31DE254BA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-33-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/1388-0-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/1388-7-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/4880-84-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/5156-64-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/5156-82-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download