dde92837f1e993508fbac58847dcfdf75adf79902bdeb125d7bdcd2d51f74816

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 4.6MB
Sample260814-d85qmatfrf
SHA256 dde92837f1e993508fbac58847dcfdf75adf79902bdeb125d7bdcd2d51f74816
MD5 9c03aeccd8f4aa01b91b77dea394ea96
SHA1 90c48e0f110548226bb78b871beaf36191c120fc
SHA512 de98cbe9af855c86eb8e89690656ffab8a02ea0e7f54a23e188bb5f744167c02a52cc58c4699071e5e9feb57a1824caf65c4a6724e0bb51afc444273a446f2ae
SSDEEP 49152:U+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+c:5OU/jIEeQfoR/IuOFVjUu5e
TLSH
T10D267D02F9C34071E87711704CDBD3BE8A34BA6586324DEBF78C861F6B31A919935B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1184	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
3884	svchost_AACCAAACBCACBAACBCCCABCACCCCBCACCBBACCAAABBBCACBCBBCBCA.exe
3188	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBAABAABABAAABBACCCBBCBBCABAACCBCACAAABCCCAAABCCACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCAAACBCACBAACBCCCABCACCCCBCACCBBACCAAABBBCACBCBBCBCA.exe"	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBBCABBCBBCCACCAAABCCBABBAABCBCBACBAABCCABCBABBAABCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe"	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4508	sc.exe
4540	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3688	cmd.exe
4528	cmd.exe
4992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCAAACBCACBAACBCCCABCACCCCBCACCBBACCAAABBBCACBCBBCBCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2316	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2316	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2316	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2316	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1184	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
1184	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
1184	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
1184	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
3884	svchost_AACCAAACBCACBAACBCCCABCACCCCBCACCBBACCAAABBBCACBCBBCBCA.exe
3884	svchost_AACCAAACBCACBAACBCCCABCACCCCBCACCBBACCAAABBBCACBCBBCBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	1184	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
Token: SeDebugPrivilege	3884	svchost_AACCAAACBCACBAACBCCCABCACCCCBCACCBBACCAAABBBCACBCBBCBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 3688	2316	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 3688 wrote to memory of 4112	3688	cmd.exe	94
PID 1184 wrote to memory of 4892	1184	svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe	95
PID 2316 wrote to memory of 4528	2316	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 4528 wrote to memory of 4508	4528	cmd.exe	100
PID 2316 wrote to memory of 4992	2316	2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 4992 wrote to memory of 4540	4992	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_9c03aeccd8f4aa01b91b77dea394ea96_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCBACBCCBCBACCCCCCABBABCCBCAABABABABBCBCCACBBABBBABCBBAACACACCABAACBBABBACCABCCBACBCAACBCBACBCCBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCBACBCCBCBACCCCCCABBABCCBCAABABABABBCBCCACBBABBBABCBBAACACACCABAACBBABBACCABCCBACBCAACBCBACBCCBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBBBBCCACAAACCAAACACBBCAABBBCBCBBAAABAABACBAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe" start= auto displayName= "UserDataSvc_ACCCBBBBCCACAAACCAAACACBBCAABBBCBCBBAAABAABACBAACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCBBBBCCACAAACCAAACACBBCAABBBCBCBBAAABAABACBAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe" start= auto displayName= "UserDataSvc_ACCCBBBBCCACAAACCAAACACBBCAABBBCBCBBAAABAABACBAACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCBBBBCCACAAACCAAACACBBCAABBBCBCBBAAABAABACBAACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCBBBBCCACAAACCAAACACBBCAABBBCBCBBAAABAABACBAACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCACBAACBCCCABCACCCCBCACCBBACCAAABBBCACBCBBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAAACBCACBAACBCCCABCACCCCBCACCBBACCAAABBBCACBCBBCBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
1⤵
- Executes dropped EXE
PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ccc32d27e83d390658d6d00de8a04a63e4dc26808e41ce8723e11539c6507305
MD5 3c41cf0d354a69f7d2ea55f3fbaa317a
SHA1 5635b9fe0526f620faff52b4fd994f939ca58fc8
SHA512 9498f6c7e9a05564faaff32fcb151fe78d042543fa000e1e750ef5564dd6eaae51d8cf6366c0cab35168e23af1e1c00412b9451d6880ab6ebc5b54202399d897
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0abc3dba9078bc9bd6e4606192d280be989b042157537f86e7cd9ef20253fb46
MD5 111772085f92cdf2411f580a548a6e5b
SHA1 6245701c079c09f2945b3313efc144f136d63498
SHA512 e08aef04e0acb872c37ee8bebe44659ce3ae8ca1a9e3996c7db4519e94d2aff4c9103c2da10495fbe72dcdf1d42a53e20ebf909180e1d218623d70665e1496d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 df9d1d09c8d22534a1ca199b9a3c1269b86271288b3449b5da2d376958e3abb5
MD5 1c910c6369ea8b47420e56d23fac1089
SHA1 e6c287792b1e904775f6540015e205cc19843ac9
SHA512 150c5222ab21b51af1f861a5093e31b027125b13bb16b2bf4435417f892d3aa9933c239432d3b0e0bca4800843bf06b90761a6c20d057f7d5877928f194b4fa1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b5e5788da452408619cf92d1eaf4e398b81ed242e0b07db03a7c99a7ac108950
MD5 ec22d916a6d7b0c0132be275bdc08b65
SHA1 081f5b1ccc592a9e067f46911a9100be4450ad77
SHA512 92784fb922262aabf0fe9a9556b46e76a2ca6e9716c2516e2864af9af47a415a5ddc2024da0405b076dfb09a940560ea98bc3217606ba3c98216a5481308c310
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 55df1bda46d0438de12e4d152ab53c2315bb9e6dbe68d55da1eecdce12e16d45
MD5 89e3ea39a889c4cd75bcd64456683b90
SHA1 e152643f8bac2505c7db3f78d98c21801dc2c747
SHA512 b891b6611fd2d8c5635e2b6c5a21a8192d7279df9ba676b42fb1e3d1d123ff7a004ec89cb7146533eac61c091bb25bb6038a2c4cb9d7c05a618130601f17e8b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bcd7b64d85b03c20960e51b82d4af45b85798044aab23645e6d33cc07772670e
MD5 8517560ff27c2865f1c0126448dfbcb8
SHA1 12111f57585352b5c60071ca8b301b7543edab60
SHA512 e99f321274de418ea18716bdf2c81d9f11814c4d389cbf01558e6967aa1e812d05ac0cd7fd6266a6a0cd4f94740b5ce8ace5705442eb2df3be0a3fb4c24a9051
MD5 SHA1 SHA512

Submit Download

svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCACACBBACCCBCBACBBCBCCBABCACBCACBAACBACBBABACBAAB.exe
Size 4.6MB
SHA256 dde92837f1e993508fbac58847dcfdf75adf79902bdeb125d7bdcd2d51f74816
MD5 9c03aeccd8f4aa01b91b77dea394ea96
SHA1 90c48e0f110548226bb78b871beaf36191c120fc
SHA512 de98cbe9af855c86eb8e89690656ffab8a02ea0e7f54a23e188bb5f744167c02a52cc58c4699071e5e9feb57a1824caf65c4a6724e0bb51afc444273a446f2ae
SSDEEP 49152:U+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+Ep+ESVN+c:5OU/jIEeQfoR/IuOFVjUu5e
TLSH
T10D267D02F9C34071E87711704CDBD3BE8A34BA6586324DEBF78C861F6B31A919935B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6af2b063c97fe3ebea3a4e9dabfe8da779d3c7bee13ed3447eacafcb2def68a5
MD5 6bc575cfb485ca1fb2a22bfa64e4b51e
SHA1 e5fecc8ac374ab79dd73bc2525bd53b04889fb03
SHA512 af01f783a4127885c040853fb0a970983b35d92d7c5159c230bdf88d51ed74d9e0ced7a81875f0e049e0b2644bc142f2f920205759a3ed40263307e2ecb67b86
TLSH
T1F511AB41B4F5D823FC3228DB592EBB630CB47B8F9C94AA65128C4328ABD5C328D158D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1184-34-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/1184-24-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2316-8-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/2316-0-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/3884-79-0x0000000000130000-0x0000000000151000-memory.dmp

Download