44ed2181edd6d6eaeb705ed99867a9fc1d56032273cd348630081101fff6574a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 18.2MB
Sample260814-e63c6avvgy
SHA256 44ed2181edd6d6eaeb705ed99867a9fc1d56032273cd348630081101fff6574a
MD5 4955f40ce5e2d8e6ddef1fb756427ed8
SHA1 0b529b3fa36f6ecadb9cfe85fa61c5205688568b
SHA512 3f20d07de875b76155242f4fc149d6432f44a468df6b6da4cd021edd9f93f4ddfb958214d2e207ef1b8a52e439a9a311c7e487266a097ec4779f3461abe7a8ec
SSDEEP 98304:wKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aZKjKWQcZ:wq/q/q/q/q/q/q/qxKWQc0gEYnvLz
TLSH
T124178E05FA834071D97721B049DFE3BF49787B2187218DEBE74C8B2B6932B91653835A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
200	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
1432	svchost_CAACBACABCAABBAABABCCCCABBBAACBABACCACCBCBABCCAABCBCABC.exe
4104	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCCBABCCBABACBBCCAACBCACBBBBCCABABBCCBBCAABACAABBCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe"	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCBBBCABBAAABBAACACABABABABCBBBBBBCABAAABBAABBCBBCBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBACABCAABBAABABCCCCABBBAACBABACCACCBCBABCCAABCBCABC.exe"	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2728	sc.exe
5448	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1704	cmd.exe
5904	cmd.exe
4180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBACABCAABBAABABCCCCABBBAACBABACCACCBCBABCCAABCBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4640	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4640	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4640	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
200	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
200	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
200	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
200	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
1432	svchost_CAACBACABCAABBAABABCCCCABBBAACBABACCACCBCBABCCAABCBCABC.exe
1432	svchost_CAACBACABCAABBAABABCCCCABBBAACBABACCACCBCBABCCAABCBCABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	200	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
Token: SeDebugPrivilege	1432	svchost_CAACBACABCAABBAABABCCCCABBBAACBABACCACCBCBABCCAABCBCABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1704	4640	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	91
PID 1704 wrote to memory of 2484	1704	cmd.exe	93
PID 200 wrote to memory of 4604	200	svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe	94
PID 4640 wrote to memory of 5904	4640	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	97
PID 5904 wrote to memory of 2728	5904	cmd.exe	99
PID 4640 wrote to memory of 4180	4640	2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	100
PID 4180 wrote to memory of 5448	4180	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4955f40ce5e2d8e6ddef1fb756427ed8_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABBBACBCACACCCCCCCBABACBCCBABABCACCBAACCBABAABCCCABABCBCBACCBABBBACBBBCBBABCBACBAABABCCABCABBAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBABBBACBCACACCCCCCCBABACBCCBABABCACCBAACCBABAABCCCABABCBCBACCBABBBACBBBCBBABCBACBAABABCCABCABBAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABAACAABACAACCCCAAACBCACACACAAABAABCBBCAABCACABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe" start= auto displayName= "UserDataSvc_BABAACAABACAACCCCAAACBCACACACAAABAABCBBCAABCACABACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABAACAABACAACCCCAAACBCACACACAAABAABCBBCAABCACABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe" start= auto displayName= "UserDataSvc_BABAACAABACAACCCCAAACBCACACACAAABAABCBBCAABCACABACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABAACAABACAACCCCAAACBCACACACAAABAABCBBCAABCACABACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABAACAABACAACCCCAAACBCACACACAAABAABCBBCAABCACABACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:200
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCAABBAABABCCCCABBBAACBABACCACCBCBABCCAABCBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCAABBAABABCCCCABBBAACBABACCACCBCBABCCAABCBCABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
1⤵
- Executes dropped EXE
PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61cbc3e73721cd076938713738ede102cad27cbd8600b1539d37a6647cbc4917
MD5 0d983a50cd2c614422be52480bd3b1c0
SHA1 0be3cfb73abb0150750159674a40cede9343d4fc
SHA512 0c771d965797f7fd4fff2eb88c21270f48870519b22f5ff8121e388c45b905c367dce20b280fc78e8d650648fffc95a44ad38465c0ab4c4b7cff8aeb987e04a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 534c94f48ccf8586e1577fc28acb6900becaa29c3a86131b6cc4c56bc786f861
MD5 3a56d2d70e1d722476b06d821ee52b51
SHA1 6a6b5c74376d886265ddc0b84c5f8f3a3644ad23
SHA512 e6177e4856db1208cddb4db0d67d24ce9ce27a414d5570ffe3cd72ad1ae0ee3a24c856fdfd89c07a96007343c40c0a05291ffb89a4c7f69e18c37aa26da0a1a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1478818eab33efae6c0310c7158f158a68e99b6361187e5be71089b09888a364
MD5 b11700618c32dd3d73c8e85434e5f9ef
SHA1 9cfb64f4eda9123693f0edc3566754d95ef89b06
SHA512 19839723a9cb8fdde51948f467d43af91aa1e26d592f9d0a270e36d636c2c3a8caad1fa7a5eff5352853b837efb28eba81df4ddb3cb2bffc5b710951719dbd41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3ee8f37f98b7b64a26d02910add40e952d6e7402defc981bb41d1fab1aa46dc8
MD5 f424f99218b4ca3cc8911b18af49df42
SHA1 cb695660e9a863a07bbcfb02637d88332b0514fa
SHA512 2a81c527382d6e35c7e537bbbae11d0a6652965de4720de9a9576adb29bc87bac9bba539fe4ae345a156a2c3e9a400291e482aa13345ab8fc05f89f6ca9f4073
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c4f98a8fae44aa779b7119e55fc584e8279349b37ca3cf9a5df5dae8886c536
MD5 abc74d36c96789719b21a86e68bd0d5e
SHA1 b6dc0799bdebbbe7ba75543f4aedf26280d41f4f
SHA512 e35a301311cf28a3dc5226773394761653c26d696e93123552156f34efda89e6ad4690e89adaa487bdcce876a4dbf9b8462f18bf3967e3348299e3b29db79f98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bf493eefb22ba82d7505d6062272e4ea09b35743bde91f02f1e17308a48f6b02
MD5 ddb92deb44826157c1cf84886e411aa5
SHA1 31933a340505c13d8057e9c7314ea15ce1654b96
SHA512 e664941e3242f4ce9e8f1717b4dc8e3627050aa1fa0a2d7836d9c60e552f12b24eebc98c0b291283dea662c0b6292a315000880c3dd25b9f3c991194c70f0a82
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8edaeda206181891d0ab3b22f889fa1d7ed40b051b596410ead77a571690ee8b
MD5 ef1e3d367468f7853e658e088d1ab6ee
SHA1 9dd4beb9dd622636a11a388f6305b47516c1b2c0
SHA512 79a8e5d31d89015862f1433ff4937ff7663004417033d0b3f9d51d0b8afd83cb0c14ac806dd8aea635dc6ee438da09ef16ed98a8243f5d7f573f4e2879c39fe3
MD5 SHA1 SHA512

Submit Download

svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCCAACCAACAAACAABAABAACBCBACABBBBCCBACACABAACAAAC.exe
Size 18.2MB
SHA256 44ed2181edd6d6eaeb705ed99867a9fc1d56032273cd348630081101fff6574a
MD5 4955f40ce5e2d8e6ddef1fb756427ed8
SHA1 0b529b3fa36f6ecadb9cfe85fa61c5205688568b
SHA512 3f20d07de875b76155242f4fc149d6432f44a468df6b6da4cd021edd9f93f4ddfb958214d2e207ef1b8a52e439a9a311c7e487266a097ec4779f3461abe7a8ec
SSDEEP 98304:wKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aaKRuy5aZKjKWQcZ:wq/q/q/q/q/q/q/qxKWQc0gEYnvLz
TLSH
T124178E05FA834071D97721B049DFE3BF49787B2187218DEBE74C8B2B6932B91653835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 de2a1026768b75121f194fd1f415ec27c061d8387412b18533268610e852918b
MD5 db99abb8ac49799f1b97c5dac70625b4
SHA1 c71e6a12dfa79aaf8489d871c9ad9d80618b0fea
SHA512 5797d399a55174f92289db45b83624dc3b946bb499fe2e9b05df685eb995cfc6f4902664e7d690d1da9aa8836940584d055c6ef2aa48edc47ca23b1674b24235
TLSH
T1E8113D30A8E5C473FB32789A611EDBC208F0739FEC58AA0023094128FED9D318D510E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/200-34-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/1432-64-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/1432-82-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/4640-8-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4640-0-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download