130c8fd4eca1358e14e92702be087487fb213a35a4c7a7625bb7586eba349dd7

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe
Size 1.0MB
Sample260813-be7a9aydrf
SHA256 130c8fd4eca1358e14e92702be087487fb213a35a4c7a7625bb7586eba349dd7
MD5 609010ab5022f3616bd00ed034ff31f1
SHA1 7c455349f9e3e759d94560ceb41dbfa40df7e1cb
SHA512 611a9ef92b888a7aa8084b283374ef1dabb72bf7b4bae3bf7fde69aab06efc73c815117583d21867499e71f26e82c471a9d3eb2111c9ccf8a98ff8905ab30620
SSDEEP 24576:m9+EM0q9+EM0q9gL59+EM0q9+EM0q9gLHafDd70iTWCQ:U+ES+ESgX+ES+ESgoDd79WCQ
TLSH
T184357D01F6828035F86714B14DEFD37E8939BE218B158DDBE78C8B1B6931BE1A534716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
624	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
5884	svchost_CAAAABBACBBCCCBCCBACBBCAAABCBCAACBACCBCAABACCBCACCCACBC.exe
4060	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBAABCACAABBBBBABBABBCABACBACCBACCCCAABBCCCABAACAABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe"	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAACBABBAACAABCAABCACCCBABBAABBCBCACCAABBBCCCCAABBAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAAABBACBBCCCBCCBACBBCAAABCBCAACBACCBCAABACCBCACCCACBC.exe"	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5448	sc.exe
4944	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3568	cmd.exe
5676	cmd.exe
1284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAABBACBBCCCBCCBACBBCAAABCBCAACBACCBCAABACCBCACCCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4092	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe
4092	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe
4092	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe
4092	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe
624	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
624	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
624	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
624	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
5884	svchost_CAAAABBACBBCCCBCCBACBBCAAABCBCAACBACCBCAABACCBCACCCACBC.exe
5884	svchost_CAAAABBACBBCCCBCCBACBBCAAABCBCAACBACCBCAABACCBCACCCACBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe
Token: SeDebugPrivilege	624	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
Token: SeDebugPrivilege	5884	svchost_CAAAABBACBBCCCBCCBACBBCAAABCBCAACBACCBCAABACCBCACCCACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3568	4092	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe	92
PID 3568 wrote to memory of 5128	3568	cmd.exe	94
PID 624 wrote to memory of 6076	624	svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe	95
PID 4092 wrote to memory of 5676	4092	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe	98
PID 5676 wrote to memory of 5448	5676	cmd.exe	100
PID 4092 wrote to memory of 1284	4092	2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe	101
PID 1284 wrote to memory of 4944	1284	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_609010ab5022f3616bd00ed034ff31f1_amadey_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCBABBACBAACACAAACBCBBBCACABACBBABBABBBBCCAACCAABBBACABBABCACBCBBACBCCABABABAABBBCBBCACCCACCCBBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCBABBACBAACACAAACBCBBBCACABACBBABBABBBBCCAACCAABBBACABBABCACBCBBACBCCABABABAABBBCBBCACCCACCCBBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAAAAABACCAABABCBACCBCABBCCBABAAAABBACABCABCCBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe" start= auto displayName= "UserDataSvc_CBAAAAABACCAABABCBACCBCABBCCBABAAAABBACABCABCCBABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAAAAABACCAABABCBACCBCABBCCBABAAAABBACABCABCCBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe" start= auto displayName= "UserDataSvc_CBAAAAABACCAABABCBACCBCABBCCBABAAAABBACABCABCCBABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAAAAABACCAABABCBACCBCABBCCBABAAAABBACABCABCCBABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAAAAABACCAABABCBACCBCABBCCBABAAAABBACABCABCCBABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABBACBBCCCBCCBACBBCAAABCBCAACBACCBCAABACCBCACCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABBACBBCCCBCCBACBBCAAABCBCAACBACCBCAABACCBCACCCACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
1⤵
- Executes dropped EXE
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23406a22a18720a87f0bbb1462a91693188ec9c28b1bd209dda83a679bd62206
MD5 e74f6b17b6a956a062756c70dd2f2f2b
SHA1 0b7c8a52f46dcf4548efedf4097d1aa48dfa0436
SHA512 4cb06e6826ba799760f89611172c298cddff32970af7656fd238959301916236c3e24d4e3d5b76269fff225123a90bf94a2fa90ea7b5cd2c05377b9b85a5a303
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31ad928cd6f82847d8d96d5270c26b3345d5f8d9ea321f628e763bfb49d726f5
MD5 240175982d92fb94e3780a8d57135ef1
SHA1 b84665278e456175343389c4e8c77e999330d42b
SHA512 9d126f36b948287a2e61c3768d709fbb84b9a5b8103ee2130f4a639f40c5f1150f1a123932f9242d5bf70d73c9f46ea139acdf75e0a191708a64fbf23c819e36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f2667168e006dd176dfaaf393bedcd1aba1804950f8bd78458c197cc62b8493
MD5 527ca98588d453cfb31c42864f733a84
SHA1 d18379de04f4e3e6b6bef17c2c6504b3b1ee122a
SHA512 7d18d138e5feceb2f8c56561e898a0359be2dc116b9999461637e3bb457d75b98a7e35c15735ac3afa151a38e2bab2bf63cfce18c52bf59ee4087f08e6b34f38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 722f7ede09c5ba9a3f492eb1a7afe42bbc0bf1a295262d0b426df9bfa48db958
MD5 991605258aa568b8b2dcba3938d25f72
SHA1 2192fe79bcc2509fa11394b594e825450fa4bf06
SHA512 4089b8e06b05f4ba26103957109a170ad951309c842ef02d4170895e7190d08c434ea9beb16946d19231bcd62bb697f86f0e3a71d40763078278031d49bf6006
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 42d378f95671c71593e354452fe51a9b7bbbc42e46d0f388d769f43358c64dd2
MD5 44d1f0ab2cd470894ef6c8875a72e9b4
SHA1 f0946fde2f1efffedbc094150a8c8641bbce955d
SHA512 f082f9fec370c485d1233c5b16959e92544f3de0fca2048d8fc8d2dacf96c0a8b66e5b8d1aa4ab210229bb67a6db0cce78c2d89e01a58325084279fae910cd8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 036815b7e4f0d992b4c4cb867f3d1315240dd41ea4ae503684010cd4bf42275a
MD5 1e0be88805d0f0b08b4be6b09db9797a
SHA1 c10702d696a2f7c4fa9bbca79c0cf657ce6bc1e2
SHA512 0d7592fa32f82cd01aa95811a5661ca350d82fc6926a0d82c9c91216773136a7e0a66a3afb6b901e337ed5ccf775bb5d373918df883d005561e48349eb84d802
MD5 SHA1 SHA512

Submit Download

svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCACBCABAACABAABBCBAACABAAABCCCCBAABAAABCCBBAAACAC.exe
Size 1.0MB
SHA256 130c8fd4eca1358e14e92702be087487fb213a35a4c7a7625bb7586eba349dd7
MD5 609010ab5022f3616bd00ed034ff31f1
SHA1 7c455349f9e3e759d94560ceb41dbfa40df7e1cb
SHA512 611a9ef92b888a7aa8084b283374ef1dabb72bf7b4bae3bf7fde69aab06efc73c815117583d21867499e71f26e82c471a9d3eb2111c9ccf8a98ff8905ab30620
SSDEEP 24576:m9+EM0q9+EM0q9gL59+EM0q9+EM0q9gLHafDd70iTWCQ:U+ES+ESgX+ES+ESgoDd79WCQ
TLSH
T184357D01F6828035F86714B14DEFD37E8939BE218B158DDBE78C8B1B6931BE1A534716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 aacd7f1acbd39b29eefbda59b5a16ee1b21a11f7f92f95a79203f997e81484f7
MD5 17f6e7a9c6fca29ca0a374f40916b19a
SHA1 bfa89383a741245ca556e8663461b67719d8e4d5
SHA512 d5028286f7e12ecbb19fbf99f68bd3c44163a093230b8b8a78a2d2203ec7a93872089e00b2cb862848aa20e146f25c136f0068cb59ccc67f11ca8f962ed91e03
TLSH
T1B011BF60B5E59813ED3328CE666A8BD35CD0368B9C5C6E182308821EE2E5C73DE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/624-33-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/624-23-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4060-81-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4092-7-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/4092-0-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5884-70-0x0000000000390000-0x00000000003B1000-memory.dmp

Download