46da79d59e9fbc5a999d98ee9dc825c27ef9252e1729a30b4cc5bb2d642cc0e9

Analysis

max time kernel
150s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 15.0MB
Sample260813-mpceeaxeqa
SHA256 46da79d59e9fbc5a999d98ee9dc825c27ef9252e1729a30b4cc5bb2d642cc0e9
MD5 0ef1025c190408176f6a097af14abc5a
SHA1 f26a90a96cc6ceb3a02c1fb26150faec910ef48b
SHA512 0dcdd841ea92ccc7159aed1716cc01719486209db3430bc4644d66c90a367033c8189ea77c160d0c7efeea36880198bc5597556073425b0fd1f9514c3e557ede
SSDEEP 98304:FKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5ab:FqCqCqCqCqCqCqCqCqxKWQc0gEYnvLs
TLSH
T190F6AF02F6820071EA773570499FE37A597D7B21473589EFD7884A3E5E32E80A93835B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2240	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
2124	svchost_ACCBCCCCCACCCACBBBAAAAABBABBCCBCCBBCBABBAAABBBCAABCACBB.exe
4444	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACAAACABCBAABCACBAABBBAABBBABBACBCCABACBCAACBBBABBCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe"	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCABABBCBCABCBACBBBBAAAABBBCBCABBAABACACCABBBBAACCBBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCCCCCACCCACBBBAAAAABBABBCCBCCBBCBABBAAABBBCAABCACBB.exe"	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4932	sc.exe
1776	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5496	cmd.exe
5716	cmd.exe
4488	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCCCCCACCCACBBBAAAAABBABBCCBCCBBCBABBAAABBBCAABCACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4580	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4580	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4580	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4580	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2240	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
2240	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
2240	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
2240	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
2124	svchost_ACCBCCCCCACCCACBBBAAAAABBABBCCBCCBBCBABBAAABBBCAABCACBB.exe
2124	svchost_ACCBCCCCCACCCACBBBAAAAABBABBCCBCCBBCBABBAAABBBCAABCACBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	2240	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
Token: SeDebugPrivilege	2124	svchost_ACCBCCCCCACCCACBBBAAAAABBABBCCBCCBBCBABBAAABBBCAABCACBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 5496	4580	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 5496 wrote to memory of 5692	5496	cmd.exe	94
PID 2240 wrote to memory of 2704	2240	svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe	95
PID 4580 wrote to memory of 5716	4580	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	98
PID 5716 wrote to memory of 1776	5716	cmd.exe	100
PID 4580 wrote to memory of 4488	4580	2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	101
PID 4488 wrote to memory of 4932	4488	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_0ef1025c190408176f6a097af14abc5a_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCAAACCABCBCBAACACABBCCCABCBCBBCCCCBBBCBBCCABBCACCCBAABBAABCCAABBCACBCCAACACBCCBBBBAABCBBCCBBBCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABCAAACCABCBCBAACACABBCCCABCBCBBCCCCBBBCBBCCABBCACCCBAABBAABCCAABBCACBCCAACACBCCBBBBAABCBBCCBBBCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCAABBABABCCCCAAABCCCACCBAABCBBACBCBAACABCCBCAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe" start= auto displayName= "UserDataSvc_ABCAABBABABCCCCAAABCCCACCBAABCBBACBCBAACABCCBCAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCAABBABABCCCCAAABCCCACCBAABCBBACBCBAACABCCBCAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe" start= auto displayName= "UserDataSvc_ABCAABBABABCCCCAAABCCCACCBAABCBBACBCBAACABCCBCAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCAABBABABCCCCAAABCCCACCBAABCBBACBCBAACABCCBCAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCAABBABABCCCCAAABCCCACCBAABCBBACBCBAACABCCBCAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCCCACCCACBBBAAAAABBABBCCBCCBBCBABBAAABBBCAABCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCCCCACCCACBBBAAAAABBABBCCBCCBBCBABBAAABBBCAABCACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
1⤵
- Executes dropped EXE
PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8ec9fad7ef9023c911fe0a0d5480814b0c0e22f03c7c4b4c6fd69c6a16cde7ad
MD5 604e9df1859968b96d97eb301fefe69a
SHA1 21b5f7df42095c9a9fb03db9f0838d9461b61c83
SHA512 f839f474df482e1308f8d59199f8422a42e60f487e0208a0937a7a5d28e7f253055865d549593ee20ad7c4a2c79fbe44786de586fc17d9d3025024cf6aa499e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17560f02dac51cc356d31f67c5726f64189b69b0aecabf908b6ed4064ff1e9a7
MD5 cc58f8d56f55fdb8f1073b8c55ed6a52
SHA1 68695a752ae7be6d7a1c7e9036802eca8ce74b4e
SHA512 1febec5a27025d660d59d86b6a7ac55261a608776984c9412d2f2331a2b0291b65d5a813c55e95e3cf2e339b4b3c2d0676610ef706657e241655f80cd03c28e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1431cc4faa9a80e5216263ce8f6ea84f68b35c0664d9898484ffd55995f27712
MD5 7350873a6cb7f4ee9dbaf134ee7fa1ee
SHA1 105783658f6dd6f0b6ce61396f1c272ee2c0100b
SHA512 b8490226509bb68e3e338c05fe47e264ba941ac5b34dabb52ce71de62bc041898e153d65a56f2e7f94e47dcf0d0181c833d6274cac9376e433fb195c769795e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6327333a8d91bf73d7fe34955f314d55cf10590ef1347f2b8c7640b6007f705
MD5 34bdfa436603cb0b6672b11d91419722
SHA1 0c0cd0232f08604187828f3406c0213a2d9b9b49
SHA512 d05936946f54fe2cc2123da6bc57280040641da797109e87424d84e798650d365f7e143bf35083d3aae2b08d3ac5929a034c7504ff6029b5d9bfafb43f1016ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 93faa927ee2976387f706b1bffb3f523d15aae913f178699052651c867227eb1
MD5 fb806d275f702139951763a23151a623
SHA1 c0f519a7c3296946649533d218eb4b93b7082a33
SHA512 fd2ce8ab65135bbe6d0e3fe4d66399ec9898a5b58bedc2214e248c0c68d127aa1d68016d8fbf3f6f508427d41896de3634b3cc34ba0e186fb23f52612f1f48db
MD5 SHA1 SHA512

Submit Download

svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBABABAAABCCBCCBCCBACBACACACCCBCCCBABBAABCCBBCACCBAB.exe
Size 15.0MB
SHA256 46da79d59e9fbc5a999d98ee9dc825c27ef9252e1729a30b4cc5bb2d642cc0e9
MD5 0ef1025c190408176f6a097af14abc5a
SHA1 f26a90a96cc6ceb3a02c1fb26150faec910ef48b
SHA512 0dcdd841ea92ccc7159aed1716cc01719486209db3430bc4644d66c90a367033c8189ea77c160d0c7efeea36880198bc5597556073425b0fd1f9514c3e557ede
SSDEEP 98304:FKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5afKRuy5ab:FqCqCqCqCqCqCqCqCqxKWQc0gEYnvLs
TLSH
T190F6AF02F6820071EA773570499FE37A597D7B21473589EFD7884A3E5E32E80A93835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 060777e17b791359803e4ccbff84a292a9721fb81dabb6805ea836b528082b96
MD5 a643258802064eaf792a2f7532c936a9
SHA1 88a25a0f70ff4fa65d1eb923ee07cc995afd959c
SHA512 0bf2e4d615843e542d4a7c8ba309dda21096b60f5461d0b7c5b93f7d62ba09701e587cc42db3f5824d2d265e27e0983220ba5755e92a6d234dda5c68259ee479
TLSH
T171110862E4E5C813DC7264DEB22ECE921D99379B581D6B381209511DA7C98778D1D0F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2240-24-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2240-34-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/4580-0-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4580-8-0x0000000000170000-0x0000000000191000-memory.dmp

Download