36566394b8f557b0cf8b2a69bd46e82463b06f10a11e195a18b1ffa08d1aac3d

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Size 22.8MB
Sample260813-e9b1dazyby
SHA256 36566394b8f557b0cf8b2a69bd46e82463b06f10a11e195a18b1ffa08d1aac3d
MD5 70f286febd644e35cd678cbe9f9766d0
SHA1 26e8c59c287b5c37cbd7b477fcf6db7b53910319
SHA512 e77287c286b7893dff63192b5589438519bbbd9bcdb68782ec2c31b6548b5a58fd779a678faa8afaebfe6c2f5f332cd8cf497e635a8048dde30c396218be568e
SSDEEP 98304:DYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aM:DqDqDqDqDqDqDqDq0KWQc0gEYnvLt
TLSH
T12A378E02FA8340B2D96B117009DFD3BF4A74BA114B258EDBE74C876E6D33BD0662535A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4812	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
3712	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
1932	svchost_CBCAACBACBCACCCAABCABBBBBBBCCBACCBCBAACBACBABCBABBBBAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACABCCABBAABCBACBABCCBCBCBBCBCABAABBABBCBACCABBBBCCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAACBACBCACCCAABCABBBBBBBCCBACCBCBAACBACBABCBABBBBAAB.exe"	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABCBAAAACBBBBCAAABCBCCBBCBBCACBAACCACAAACCCCCCBABBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe"	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2884	sc.exe
900	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2648	cmd.exe
960	cmd.exe
4260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAACBACBCACCCAABCABBBBBBBCCBACCBCBAACBACBABCBABBBBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5908	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
5908	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
5908	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
5908	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
4812	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
4812	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
4812	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
4812	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
1932	svchost_CBCAACBACBCACCCAABCABBBBBBBCCBACCBCBAACBACBABCBABBBBAAB.exe
1932	svchost_CBCAACBACBCACCCAABCABBBBBBBCCBACCBCBAACBACBABCBABBBBAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5908	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Token: SeDebugPrivilege	4812	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
Token: SeDebugPrivilege	1932	svchost_CBCAACBACBCACCCAABCABBBBBBBCCBACCBCBAACBACBABCBABBBBAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 2648	5908	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	92
PID 2648 wrote to memory of 3820	2648	cmd.exe	94
PID 4812 wrote to memory of 3704	4812	svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe	95
PID 5908 wrote to memory of 960	5908	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	96
PID 960 wrote to memory of 2884	960	cmd.exe	98
PID 5908 wrote to memory of 4260	5908	2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	99
PID 4260 wrote to memory of 900	4260	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_70f286febd644e35cd678cbe9f9766d0_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCACCACCCCACAAACCABAACABCABAAABCCCABBBCBCABBBABAAAACACBCBBBBCCCAACACBCACAAAAABBCBBBBACCAACBAAACAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCACCACCCCACAAACCABAACABCABAAABCCCABBBCBCABBBABAAAACACBCBBBBCCCAACACBCACAAAAABBCBBBBACCAACBAAACAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCABAAAACCABCBCABBABBCBBBBBBCBCCCCACACBCAABCBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe" start= auto displayName= "UserDataSvc_ABBBCABAAAACCABCBCABBABBCBBBBBBCBCCCCACACBCAABCBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBCABAAAACCABCBCABBABBCBBBBBBCBCCCCACACBCAABCBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe" start= auto displayName= "UserDataSvc_ABBBCABAAAACCABCBCABBABBCBBBBBBCBCCCCACACBCAABCBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCABAAAACCABCBCABBABBCBBBBBBCBCCCCACACBCAABCBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBCABAAAACCABCBCABBABBCBBBBBBCBCCCCACACBCAABCBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
1⤵
- Executes dropped EXE
PID:3712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACBACBCACCCAABCABBBBBBBCCBACCBCBAACBACBABCBABBBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAACBACBCACCCAABCABBBBBBBCCBACCBCBAACBACBABCBABBBBAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f22b41418cf33f97e207f2644843ff289c17fa28158a8f269ba0dbc4d8e84662
MD5 8907a4a452068dc2636517c53b6f3bc4
SHA1 d88bd7a0d19aa5ab51813424d469d66d84ce00bd
SHA512 b5f929e8cfb4252c70e436fe98b92ec97ebbaf03b591a59dd7a40a74470eb34f7836c1cc816e99b7fb1debee6ca31ee8c7b28b10036b2d8939fc94c2a89c76bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a144bbaa9feec0a3d0a918c99396b49c3da8ac71e800862c137c1423a5b23f6
MD5 45e3a0cb217f5df46842ada2bf70983e
SHA1 44dc512acf617e1f4b7eb060444215702c43c03a
SHA512 7cd62976776425d0e944405e8c67f3b3f440baa5d0cada5e5fbeb084d462bd251bd1d50d4772d6ad6eeab6f52b13dcdbbc25a06f1d92b8d72ff02c3a7986047e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 10e8928955661ede064a4975e58f5a9d38cf5792880b960151b7b01ce314aa40
MD5 6861d299ba8835b35adfd4f26a1023b8
SHA1 1c651ccd6b77a9c6c9f918bc8e0a1a9976f03c64
SHA512 b13919d939a1ca45c1ba1c659639565a4515f851942552d7c5199c88cbb04b41d236aa4e99a9916eb1d010f8eb1e10482d37ea29c29a9f89284b45c40b76186e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 01442fbb82c99a3276f32f05a517f663aed31c4712e6ccf3e7cb0020190dd320
MD5 8585d985d9caaa72ff757c008106f32c
SHA1 a1b1ecb1cfeb7b79fff5e2b1c076cac006c0ee45
SHA512 6563f9a11f6110382d326bc50ec2ea17e8a2f328c7d38f3425e14c869bc11d4a8b2d95387aa07e134caaa1f29523fa083be7bab0045cd4a1712608cc77ab81ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b45f6fcf48f716abcb648830c40f52f0b237a44916960379958a2cd3f4309f9
MD5 f04f80d12f017883a330f79db8020bb1
SHA1 4c94e3f02a00ddd4925078020278a3e5544e64bb
SHA512 832e39b5cebf812485fa1ab4181adf107e4663ccf129bc74f4e35125ef428756c339f8874faf093fd11df12bfc1ea2f703f87ca1f4959f780c13d0fa7e8dbb16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d0313ad1f4687ae1d3e39bf88f82d2dbb2ead804743308140afff6f2a4493c7c
MD5 a079b3b12cb8128f3480a26cd4d65318
SHA1 b2b93153dfd33f7dece602c29db73ab055e4265a
SHA512 b562fee210efafa2fd36aa64010d74b7d372551dfe7d75b3dc9f1f9ed120313947aef16ca41b149231b6203f0a1e6f897e76585642ef213689dc5b9116f0e04d
MD5 SHA1 SHA512

Submit Download

svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAACCBBCABBCCBBACABCCAACBBBAACBAABAABCCBAABABACABCBB.exe
Size 22.8MB
SHA256 36566394b8f557b0cf8b2a69bd46e82463b06f10a11e195a18b1ffa08d1aac3d
MD5 70f286febd644e35cd678cbe9f9766d0
SHA1 26e8c59c287b5c37cbd7b477fcf6db7b53910319
SHA512 e77287c286b7893dff63192b5589438519bbbd9bcdb68782ec2c31b6548b5a58fd779a678faa8afaebfe6c2f5f332cd8cf497e635a8048dde30c396218be568e
SSDEEP 98304:DYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aCYGKRuy5aM:DqDqDqDqDqDqDqDq0KWQc0gEYnvLt
TLSH
T12A378E02FA8340B2D96B117009DFD3BF4A74BA114B258EDBE74C876E6D33BD0662535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c9a53fd76a827cf08f41af71c445808c086ff1a7aedd4b14cdfd48016b5cb33a
MD5 dd0bf66e9abab326e3b875c717511a75
SHA1 1e297ef757831223602221ff226b673499e16ab6
SHA512 79ec36cb98c85aaaad6037b47df30b79ae2ada28eaf736658f8b987317ce9364a5d949546973580eeb96e8dcff01743713ce7867af74ab97d98f17cc6e958cdc
TLSH
T16D11EB50B8E5D8B7F83228CA632ECAC208AD768F1C1C7A98230D9119B7C9D765D558F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1932-81-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/3712-66-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/4812-22-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/4812-34-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/5908-6-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download