46da79d59e9fbc5a999d98ee9dc825c27ef9252e1729a30b4cc5bb2d642cc0e9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 15.0MB
Sample260813-mpceeaxeqa
SHA256 46da79d59e9fbc5a999d98ee9dc825c27ef9252e1729a30b4cc5bb2d642cc0e9
MD5 0ef1025c190408176f6a097af14abc5a
SHA1 f26a90a96cc6ceb3a02c1fb26150faec910ef48b
SHA512 0dcdd841ea92ccc7159aed1716cc01719486209db3430bc4644d66c90a367033c8189ea77c160d0c7efeea36880198bc5597556073425b0fd1f9514c3e557ede
SSDEEP 98304:FKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5ab:FqCqCqCqCqCqCqCqCqxKWQc0gEYnvLs
TLSH
T190F6AF02F6820071EA773570499FE37A597D7B21473589EFD7884A3E5E32E80A93835B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3204	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
4380	svchost_ACCBCCABCAAAACACACACACCCCBCCCABACBBCBCAABABBBCABCCCCCCA.exe
3400	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCABACBABACBBCBBBCBBCBCAABABAABABACACCABACBACACBCCABCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCCABCAAAACACACACACCCCBCCCABACBBCBCAABABBBCABCCCCCCA.exe"	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCCCBABCCABBBBCBAACBAABCAAABAAACAACCABACBBABBCBBABBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe"	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2944	sc.exe
2896	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2148	cmd.exe
1560	cmd.exe
4284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCCABCAAAACACACACACCCCBCCCABACBBCBCAABABBBCABCCCCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3008	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3008	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3008	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3008	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3204	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
3204	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
3204	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
3204	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
4380	svchost_ACCBCCABCAAAACACACACACCCCBCCCABACBBCBCAABABBBCABCCCCCCA.exe
4380	svchost_ACCBCCABCAAAACACACACACCCCBCCCABACBBCBCAABABBBCABCCCCCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	3204	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
Token: SeDebugPrivilege	4380	svchost_ACCBCCABCAAAACACACACACCCCBCCCABACBBCBCAABABBBCABCCCCCCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2188	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2148	3008	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	98
PID 2148 wrote to memory of 4404	2148	cmd.exe	100
PID 3204 wrote to memory of 4644	3204	svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe	101
PID 4644 wrote to memory of 452	4644	notepad.exe	102
PID 3008 wrote to memory of 1560	3008	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	106
PID 1560 wrote to memory of 2944	1560	cmd.exe	108
PID 3008 wrote to memory of 4284	3008	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	109
PID 4284 wrote to memory of 2896	4284	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBACAABACAACCAABACBACBAACBAABABABABCBAABCCACAACAACAACCCABCCCCACCACCCCBBBCACABCABCACACAACCBBCACBBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBACAABACAACCAABACBACBAACBAABABABABCBAABCCACAACAACAACCCABCCCCACCACCCCBBBCACABCABCACACAACCBBCACBBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABCCBCACBABCCBAABCACCAACCCBAAACCBAAABCCACCCBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe" start= auto displayName= "UserDataSvc_CBBABCCBCACBABCCBAABCACCAACCCBAAACCBAAABCCACCCBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBABCCBCACBABCCBAABCACCAACCCBAAACCBAAABCCACCCBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe" start= auto displayName= "UserDataSvc_CBBABCCBCACBABCCBAABCACCAACCCBAAACCBAAABCCACCCBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABCCBCACBABCCBAABCACCAACCCBAAACCBAAABCCACCCBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBABCCBCACBABCCBAABCACCAACCCBAAACCBAAABCCACCCBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCABCAAAACACACACACCCCBCCCABACBBCBCAABABBBCABCCCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCABCAAAACACACACACCCCBCCCABACBBCBCAABABBBCABCCCCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
1⤵
- Executes dropped EXE
PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 819a2ccc2b3a6cc7f3ceedaed504d14e5fabec889449966aa243f87034720833
MD5 46c478d7d2f624a6c6c06fbb7d32954f
SHA1 7fd42303586c100ee6480cef429d52dc99a67fb9
SHA512 3440d5fc8b9ee58478642d05c4682265b469244842e392e7f8b71de3c7a3eba38b28297be3855a65d1bdf81676b39b030b98cb976583aa9dc89a8603dd160170
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c2b951a284db60c7708b03135816159858c066c59b00bdb06bc2224316a8c9ba
MD5 50ee2e026add8e5876f4d34934129fd9
SHA1 3d63ce075eee283633e44c87d63c2e9836255b6e
SHA512 e28ee6b64410172505dd039120184059da33ce9ca49769b340da4b2f5746d6a35177d41dee1019d99f94e2296196964d60b7cfa2981dfb1fd6dbd467fe6a239a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f8206dcf2e001c4c00ced190aedeaaeb028078f631c7d2c2317a4522772be569
MD5 133f6d281321276d967cd6379712d64f
SHA1 e992be0c9badc4412feb227516963353245093de
SHA512 9f20cba6807fbc97195c16c371e84215af1321e6d7cb837857b35d00afd0d988e6757628f8121c3edb8a419d5f205ef0b2ca1e130fab962035ecf3d5399cbbae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6e24d3ded00052545d7f81d4f59ce476d033c17ea297be1719ecec1e9afb3eac
MD5 51f04e18b7f99166db577e76f3ecde20
SHA1 65fd4d482426cd8747353b539b142746f2d039ab
SHA512 c71fe9e05cb657096eb947bec91e2919e6d09d94ec335c81d8caaefca583bd10018267085c530aa30d4c2be44a0eb823dda02d8564dffdc568d2efd304eb0da9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2f3af3ef8487e2345a397ad1b9fde16c807c124649477a21c7eee00077078243
MD5 350f553efa558e1be6df0e09e5fe5bb4
SHA1 d6c60c60f8b948c8fe0c847b236d60f15cc6b80c
SHA512 488fd423d9257e71778306ca87c8837f19833327f0a012e438ed762753afb20a55e54f1b89c641c6f86cfd77b168491be9ebb0ea42afb363339f8a031b025636
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b471ed380cdfb33212bf4003712d1123effe91c58a5e2d6809b2506e284cc087
MD5 88168ff3850fb7a6331dcde3c40a7fc8
SHA1 47cccb066616c335b20dcb66fad6185f4b6bd1aa
SHA512 3f73e5253e9d440cb6d9d2704b9b7feda4f1c971b725acfca7c807387ae429380ab3399c6c2bdf31e48097a89b6b29dbb0fa2dbed5c186f01fd459aa0c2db4e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f6bc410bfd55c55ffb76379c06408b3dce19c485d2d052c22374b95d11aeae75
MD5 5bdb9fa1ae3001fa939bfc61a53b1f85
SHA1 8ab6124c098410c1c158c26a46d763f284b73aac
SHA512 6551cfb2f0cfd3ab1f11b44872b026ed6358ba749163f74af8c1bc6d1e42bc10f31c5a18c2c0f25828107cc5913a3c075cac87680ad0e797007afa4d08479a43
MD5 SHA1 SHA512

Submit Download

svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACCAAAAACABCCABBCBCBCBBBBAAABCCCBBCABACCBABCBBAACB.exe
Size 15.0MB
SHA256 46da79d59e9fbc5a999d98ee9dc825c27ef9252e1729a30b4cc5bb2d642cc0e9
MD5 0ef1025c190408176f6a097af14abc5a
SHA1 f26a90a96cc6ceb3a02c1fb26150faec910ef48b
SHA512 0dcdd841ea92ccc7159aed1716cc01719486209db3430bc4644d66c90a367033c8189ea77c160d0c7efeea36880198bc5597556073425b0fd1f9514c3e557ede
SSDEEP 98304:FKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5ab:FqCqCqCqCqCqCqCqCqxKWQc0gEYnvLs
TLSH
T190F6AF02F6820071EA773570499FE37A597D7B21473589EFD7884A3E5E32E80A93835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 0257d92b496558e2ca1bf4884d5abce2b57167ad706aedfcc96c95b7960629c0
MD5 70f957c59a8f6e6eacfe55da7f195fd2
SHA1 912ad2db79e26ff75cf3bb9b675ef3905da17c9b
SHA512 c52e910262d8ef4cf65814664e7900c4061f4e9898e2b60d61b74a024794a53b8f37eb2814adc8bc0b0b79cb366a4d258c702038740fa981df643eb388cffc1b
TLSH
T1D7010821D4D59C13E97324DF322E9BA21DE43A6B6858AB681304520E5790867CE120E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3008-0-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/3008-7-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/3204-36-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/3400-92-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/4380-72-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/4380-90-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/4644-59-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Download