36566394b8f557b0cf8b2a69bd46e82463b06f10a11e195a18b1ffa08d1aac3d

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Size 22.8MB
Sample260813-e9b1dazyby
SHA256 36566394b8f557b0cf8b2a69bd46e82463b06f10a11e195a18b1ffa08d1aac3d
MD5 70f286febd644e35cd678cbe9f9766d0
SHA1 26e8c59c287b5c37cbd7b477fcf6db7b53910319
SHA512 e77287c286b7893dff63192b5589438519bbbd9bcdb68782ec2c31b6548b5a58fd779a678faa8afaebfe6c2f5f332cd8cf497e635a8048dde30c396218be568e
SSDEEP 98304:DYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aM:DqDqDqDqDqDqDqDq0KWQc0gEYnvLt
TLSH
T12A378E02FA8340B2D96B117009DFD3BF4A74BA114B258EDBE74C876E6D33BD0662535A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2792	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
988	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
4032	svchost_AAACAAACCBCBCABAABABBCCBCBCABABBCACABACBABBACBAACBBCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCBBBBBCBCAABBCAACBAAABCCCACBABBABCCCABBCBACAAABABAACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACAAACCBCBCABAABABBCCBCBCABABBCACABACBABBACBAACBBCBCA.exe"	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBBBCCCACCCABBBBAABABBACBCBCBABACABACCACCBCBCACCACCACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe"	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1656	sc.exe
3856	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
956	cmd.exe
3372	cmd.exe
4700	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACAAACCBCBCABAABABBCCBCBCABABBCACABACBABBACBAACBBCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3480	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
3480	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
3480	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
3480	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
2792	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
2792	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
2792	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
2792	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Token: SeDebugPrivilege	2792	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 956	3480	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	106
PID 956 wrote to memory of 1400	956	cmd.exe	108
PID 3480 wrote to memory of 3372	3480	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	113
PID 3372 wrote to memory of 1656	3372	cmd.exe	115
PID 3480 wrote to memory of 4700	3480	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	116
PID 4700 wrote to memory of 3856	4700	cmd.exe	118
PID 2792 wrote to memory of 1560	2792	svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe	121
PID 1560 wrote to memory of 1604	1560	notepad.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCAABCABCACAABBBBAAAACCABAAABACCBCAAABACCABCABBBBBCCBCACCAABABBBACAAACACAACCCAABAAACCBBBCBBBAAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACCAABCABCACAABBBBAAAACCABAAABACCBCAAABACCABCABBBBBCCBCACCAABABBBACAAACACAACCCAABAAACCBBBCBBBAAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBABABABCCCCAABBACACAABAABCBCCBAABBAABBAACBAABBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe" start= auto displayName= "UserDataSvc_BCBABABABCCCCAABBACACAABAABCBCCBAABBAABBAACBAABBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBABABABCCCCAABBACACAABAABCBCCBAABBAABBAACBAABBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe" start= auto displayName= "UserDataSvc_BCBABABABCCCCAABBACACAABAABCBCCBAABBAABBAACBAABBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBABABABCCCCAABBACACAABAABCBCCBAABBAABBAACBAABBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBABABABCCCCAABBACACAABAABCBCCBAABBAABBAACBAABBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
1⤵
- Executes dropped EXE
PID:988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACAAACCBCBCABAABABBCCBCBCABABBCACABACBABBACBAACBBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACAAACCBCBCABAABABBCCBCBCABABBCACABACBABBACBAACBBCBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a144bbaa9feec0a3d0a918c99396b49c3da8ac71e800862c137c1423a5b23f6
MD5 45e3a0cb217f5df46842ada2bf70983e
SHA1 44dc512acf617e1f4b7eb060444215702c43c03a
SHA512 7cd62976776425d0e944405e8c67f3b3f440baa5d0cada5e5fbeb084d462bd251bd1d50d4772d6ad6eeab6f52b13dcdbbc25a06f1d92b8d72ff02c3a7986047e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 51c05371cde7ab990e255b300a3c13b535bf24821a9f0b1f06d034a377fe8b01
MD5 36204fe18d8620b33e5d1d60216c54d5
SHA1 438e7857b1198e9cc2ae0e6c073c91003abb554d
SHA512 9f5ec2f04c96cf95e42c63e15a577d534a5d938d130c0e898bb8d1ca2e7f6877f901b136e2ff98ef6119270f067856dbb36b81af957a3b50f01a945be7615fea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 01442fbb82c99a3276f32f05a517f663aed31c4712e6ccf3e7cb0020190dd320
MD5 8585d985d9caaa72ff757c008106f32c
SHA1 a1b1ecb1cfeb7b79fff5e2b1c076cac006c0ee45
SHA512 6563f9a11f6110382d326bc50ec2ea17e8a2f328c7d38f3425e14c869bc11d4a8b2d95387aa07e134caaa1f29523fa083be7bab0045cd4a1712608cc77ab81ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 38ea5ca278012043f5e094bdc5c8d45fdeb03cffa71798ee2e54b42595318c1d
MD5 dd91f17427620084429e9db0a73c128e
SHA1 35a58329078e568b09580fccadd0965088fd26cd
SHA512 4f9c01c38384956bd435d0facdb70f3eab0af53eb07ed5dcf909668c4703e875c2b7252f3f38bb87eb93b4ed1a852b7a557974c18843b6b7aafdc7e4d479a0e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 00391d8de808ac9256d041042c03aa1bc0fd9667ee6064061e173e5947e15a09
MD5 74b123f043c13e96b9123fd211050edc
SHA1 17e7901154d325b1410f8222a3e823503792ef86
SHA512 3c4d241ae08eb5938819d4580f38d5bb3316a8631a42cbdd7f51c6c31055ab2df0f60384a1280d1b2eb058cfbea734e1149b42fd2764d5eaed529bbee8b398c4
MD5 SHA1 SHA512

Submit Download

svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCBCAABCCAAABABABBBACCACBCCBBACBAAABBCCBCAABBBCC.exe
Size 22.8MB
SHA256 36566394b8f557b0cf8b2a69bd46e82463b06f10a11e195a18b1ffa08d1aac3d
MD5 70f286febd644e35cd678cbe9f9766d0
SHA1 26e8c59c287b5c37cbd7b477fcf6db7b53910319
SHA512 e77287c286b7893dff63192b5589438519bbbd9bcdb68782ec2c31b6548b5a58fd779a678faa8afaebfe6c2f5f332cd8cf497e635a8048dde30c396218be568e
SSDEEP 98304:DYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aM:DqDqDqDqDqDqDqDq0KWQc0gEYnvLt
TLSH
T12A378E02FA8340B2D96B117009DFD3BF4A74BA114B258EDBE74C876E6D33BD0662535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-95-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/1560-88-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/2792-35-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/2792-53-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/2792-76-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/2792-104-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/3480-36-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3480-87-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3480-62-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3480-10-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3480-23-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/4032-97-0x00000000008E0000-0x0000000000901000-memory.dmp

Download