e7886457e2441a9ba26a5a152d41149e44e7d67bf44eb17896b07094d9a10e74

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 17.9MB
Sample260814-dd6dnstbmb
SHA256 e7886457e2441a9ba26a5a152d41149e44e7d67bf44eb17896b07094d9a10e74
MD5 e73727d26f7b41baae442636ab3f4aaa
SHA1 de5a84bb06618a89aeec52c1b909e60398045a90
SHA512 13e7b10cd848965852f39f52e9a8f8425c284a131db39aae29835577101c4b9aa0b26ec34d04b8537e1201d1b047ecf59ccd5f1931108c7878ed6c30fa1744c7
SSDEEP 98304:1LPPPLPPPLPPPLPPPLPPPLPPPLPPPLPPPLPPvOU/jIEeQfoR/IuOFVjUu56:JFIF0wu4
TLSH
T1B0174B82FB8985B2E4770231486B82B75B70BC154F16D69F7388A36D5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
296	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
3292	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
1376	svchost_AACACCACABCABBCCCBCBAACAAACAAAACCACBCCCBAABABBAACAAABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAABBABACAAABCAAABCBBBBCBBBCCACBBABBCACABCCBCAACAABCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACACCACABCABBCCCBCBAACAAACAAAACCACBCCCBAABABBAACAAABCC.exe"	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCCAACCBABCBBAAABAACBBCCCCBCCCABBCBAACCCABBAAACCCBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe"	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4556	sc.exe
4908	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2872	cmd.exe
2836	cmd.exe
2692	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACACCACABCABBCCCBCBAACAAACAAAACCACBCCCBAABABBAACAAABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1984	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1984	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1984	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1984	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
296	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
296	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
296	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
296	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	296	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2872	1984	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 2872 wrote to memory of 3576	2872	cmd.exe	94
PID 1984 wrote to memory of 2836	1984	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	95
PID 2836 wrote to memory of 4556	2836	cmd.exe	97
PID 1984 wrote to memory of 2692	1984	2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 2692 wrote to memory of 4908	2692	cmd.exe	100
PID 296 wrote to memory of 3164	296	svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e73727d26f7b41baae442636ab3f4aaa_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCBCCCCCBBBBBABCBBAAAABACABBAAABAAACCBACBBAAABBABBAAAABAAACABBCACBBBBCCABCCBABCBCBACCAACCACBCAAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCBCCCCCBBBBBABCBBAAAABACABBAAABAAACCBACBBAAABBABBAAAABAAACABBCACBBBBCCABCCBABCBCBACCAACCACBCAAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBAACABACABBCCCBBAABBCAABCCCCAACCCCBACABABBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe" start= auto displayName= "UserDataSvc_BAABBAACABACABBCCCBBAABBCAABCCCCAACCCCBACABABBCBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBAACABACABBCCCBBAABBCAABCCCCAACCCCBACABABBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe" start= auto displayName= "UserDataSvc_BAABBAACABACABBCCCBBAABBCAABCCCCAACCCCBACABABBCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBAACABACABBCCCBBAABBCAABCCCCAACCCCBACABABBCBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABBAACABACABBCCCBBAABBCAABCCCCAACCCCBACABABBCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
1⤵
- Executes dropped EXE
PID:3292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCACABCABBCCCBCBAACAAACAAAACCACBCCCBAABABBAACAAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCACABCABBCCCBCBAACAAACAAAACCACBCCCBAABABBAACAAABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb1710fe8286ed2fe70fb10d4a78e9960e497bd3f342b32aaeefa8a23ffaefaf
MD5 bd8ba814e7fbe709bcb39fe78e9ee245
SHA1 2e1eebf2776c321c00b8e4a3c43e33f202652f96
SHA512 8e2facae6ad60eccce444d026c310c9a95c57e61c4b468d37f436d9a4858694eb64789d71e540745a38ac7d96829b64e4810144a829fdd9ae9fdc5fb7daf2089
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f61b1608ec1872858747efcfc1d7ef66bfde969591fa41be60680f2a57d1c1aa
MD5 f5db7ee86e44c0ea9037265844c6cc00
SHA1 3b5903b78e2d9dcbd9a34f1024da99d5f745ac11
SHA512 11a7ab29ece6cd8433ccae0208b6e38c909c27707dee89b5346f76069948a465c953a9ee2daea5d0801093f2de7dd4ee5e85ee9a531505dbd0399730feda7591
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d2bfce53fda1e707ae14c1476b56f14f303483a65f40a7e8a1f50f99deb584c
MD5 4e5dd88095caebcaf3016eefe630f342
SHA1 4af14231c5bf70ff5862d1e5d859ebd9875591c1
SHA512 161366600018363921f4f87d0c31ceaedb3d02fff006f5d9f090f96049dc800ef642f3e214b504b4ecce219b5b161f10feb3110f7c449e50cd055d656f755f56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 add66ff9c0ae1bf64b31cc98c896a0830688e29380f288164a9314b948c0c8cb
MD5 971eabd75b748f0699077e800b37f46a
SHA1 f35344e0fc00eb87dd9d55067c2d65cadaada41e
SHA512 64aa921c7dd395940e88068613d7feef74570348ac476c33da8dd3b5766af08ced746dc538c0252dac7bd9dbf5f4a7927bee45cf905ce4fa7587b98dba382a3b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4a354f92c3a0ff25c2593e7e677d7805f5ab8df00d3bc514893e265c1d0a89de
MD5 e0957d0d629a9b2893164d7a46a0d451
SHA1 35d02c92b91a062ed1413c27dcba6936f59e2ac0
SHA512 41f842e03bbdf17255a6c37c827918aceba060ce4774d17a4b36f4d79caf4d8445c2a9560e9369f41227cf4c4117a5b0cc0070f5aeabe7e3a5b0456b709d9879
MD5 SHA1 SHA512

Submit Download

svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAABABCBBCBACCCCCCCBCBBCAAABCBABBCBCABACCBBBACACBBCCC.exe
Size 17.9MB
SHA256 e7886457e2441a9ba26a5a152d41149e44e7d67bf44eb17896b07094d9a10e74
MD5 e73727d26f7b41baae442636ab3f4aaa
SHA1 de5a84bb06618a89aeec52c1b909e60398045a90
SHA512 13e7b10cd848965852f39f52e9a8f8425c284a131db39aae29835577101c4b9aa0b26ec34d04b8537e1201d1b047ecf59ccd5f1931108c7878ed6c30fa1744c7
SSDEEP 98304:1LPPPLPPPLPPPLPPPLPPPLPPPLPPPLPPPLPPvOU/jIEeQfoR/IuOFVjUu56:JFIF0wu4
TLSH
T1B0174B82FB8985B2E4770231486B82B75B70BC154F16D69F7388A36D5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-23-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/296-36-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/1984-0-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/1984-7-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/3292-67-0x0000000000580000-0x00000000005A1000-memory.dmp

Download