9d0f4969bbbeedd7f379e0a47a79501b068dbab857e147eb8d293bc37a11c9a1

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe
Size 2.6MB
Sample260814-e8meqavwax
SHA256 9d0f4969bbbeedd7f379e0a47a79501b068dbab857e147eb8d293bc37a11c9a1
MD5 461ec96e04cd378f43dd1561d786f135
SHA1 01b84ccbf0b7e086c29197869caa1659f0b36d9c
SHA512 cc5b163b64d1820cdc824c0074b078972023361911d5c26716f48a6c7ec272a102c03f6f7050fa524d4b509d21fe19450cba45e2508359b81a1d780d673767b7
SSDEEP 49152:U+EWLj+ES+EW5+ES+ES+ES+EWL8+EWLj+ES+EW5+ES+ES+ES+EWLxDd79WCY:pp7u
TLSH
T130C57D05FA828075E96B10B04DDFD2BE8A34BE2187118DEBF78D9B1F6932BE16434715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3104	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
6056	svchost_BBCBACCCBBACABCCCCAABBBACCAACBCCBBCBACABCABBBABBCCBBCAC.exe
2900	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBABCCBBCBABABACACBACCCBBABBBAAACCAACAAABAABAABCBBABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe"	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCAAABBCACAAAAABBBABBBABCCCABABACBBCCAABACCBCCBBABAABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBACCCBBACABCCCCAABBBACCAACBCCBBCBACABCABBBABBCCBBCAC.exe"	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4624	sc.exe
4136	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2228	cmd.exe
5088	cmd.exe
3660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBACCCBBACABCCCCAABBBACCAACBCCBBCBACABCABBBABBCCBBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4228	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe
4228	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe
4228	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe
4228	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe
3104	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
3104	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
3104	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
3104	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
6056	svchost_BBCBACCCBBACABCCCCAABBBACCAACBCCBBCBACABCABBBABBCCBBCAC.exe
6056	svchost_BBCBACCCBBACABCCCCAABBBACCAACBCCBBCBACABCABBBABBCCBBCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4228	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	3104	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
Token: SeDebugPrivilege	6056	svchost_BBCBACCCBBACABCCCCAABBBACCAACBCCBBCBACABCABBBABBCCBBCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2228	4228	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe	92
PID 2228 wrote to memory of 1776	2228	cmd.exe	94
PID 3104 wrote to memory of 992	3104	svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe	95
PID 4228 wrote to memory of 5088	4228	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe	98
PID 5088 wrote to memory of 4136	5088	cmd.exe	100
PID 4228 wrote to memory of 3660	4228	2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe	101
PID 3660 wrote to memory of 4624	3660	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_461ec96e04cd378f43dd1561d786f135_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAACBBBCBAAABABCCABAACBCCBAAACAABABCCCBACBCBBABBAAACBBCBBCACABCBBAAABCABAAABABBACCCCAACCCBBBCCABAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAACBBBCBAAABABCCABAACBCCBAAACAABABCCCBACBCBBABBAAACBBCBBCACABCBBAAABCABAAABABBACCCCAACCCBBBCCABAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCBCABABABAAACBCAABCABABBBAABCCBACCABABBCAACBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe" start= auto displayName= "UserDataSvc_BCCCBCABABABAAACBCAABCABABBBAABCCBACCABABBCAACBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCBCABABABAAACBCAABCABABBBAABCCBACCABABBCAACBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe" start= auto displayName= "UserDataSvc_BCCCBCABABABAAACBCAABCABABBBAABCCBACCABABBCAACBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCBCABABABAAACBCAABCABABBBAABCCBACCABABBCAACBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCBCABABABAAACBCAABCABABBBAABCCBACCABABBCAACBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBBACABCCCCAABBBACCAACBCCBBCBACABCABBBABBCCBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBBACABCCCCAABBBACCAACBCCBBCBACABCABBBABBCCBBCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
1⤵
- Executes dropped EXE
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 022b03bddd1726cedffacdeb850298ff056b141d763ec4c1fbc720a0425b5e97
MD5 c72ee238258b8790266cd65cd3b59ab3
SHA1 13a184b8236f2cf1b3c6b6fae97389e5ff05f314
SHA512 afbe1d92ee4989e999554655633a4294455f775cbe49e16b69bd6c9f81d95fbf6ec7cad94d55288d9c9cfd97581c5668b5901ac0901fd43142ed506f158ed5e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70397cf2ff7808197695f6db282a4b970af703364d15a34981d23616f26d3031
MD5 b9cf9352c19cd79520ce995af3f55763
SHA1 8ef84613e075f74b9f80c711ecc08d7ae8d2d481
SHA512 f966644c8c904eda096429df76779d29d336ae2e6181b5ac67658912a0a5ecd5209c533220fca9d03458002a2e526be858ee74386692dc0872d4c5db3f7254db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2a39a392c702763d104fbf6cecd7a0e4c2211a5ad1b68e2ec572ae025ff21760
MD5 d4738a5c5f64ecfe586d1526c405ebb8
SHA1 0429facae1a81c2004884d76a6c7657d0bea2d19
SHA512 deb24443b0682b032119631d69e54ec710ab8487839dc5c361ec301b46af026caf337b33eda3c5b9199d21a2200a64d3f149a4f58a931c6deb37f26024344c5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22c8a0cf3746d88dadd47ccbedfae0a41c63adc9b67c1c215be3b8a4188afb15
MD5 02047c24037512f830f6c5c783af4907
SHA1 714d5b82abfb4330cb5912d20e622f408b21c79d
SHA512 1aae72ad866a62d8c5359547a00c9b29206c7f4db12fefd7a85ce4453fda272c2c5fef53233a5ed71239a4a2fbc2a4587b6bc4f3292352cb491748a262e1cc50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 11f0d255fb30baa43e017802f645b646c68edc486f782df4bd030d50ffd968d4
MD5 4184fbd6623721e5e8e1bc0d062b5c29
SHA1 f3377cfb28d820f5fcf69be848816d4c1855ed61
SHA512 09a60a02eaf9d8365f8e3cd1a8489ed020b198f6f0ee91f642e0ba85dcd15b51ed4cfb3da4e29b76cccae65a6aa5b603364416f695319208ec8b1617dacc9a0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6ba1ac8ebea82762ad387d6ce3dd1e70f61bdc100cd5266ee4588345b8cb5d48
MD5 0ac3a862d8da3ddbe2edd2f1718fe334
SHA1 6c62d0033734186cbf561b82b6cd06eff5a555c4
SHA512 6bec2e0f4c6cedcfa24acaddd13f4a02af8afc4826d52714b4f2bbb5daeb6fe0119ac56d3758c0dee2bb5ec2d3c7b2105df557988b7b0bf91b6cf29f97649292
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f9177eb2a60131d95ec208f5ea1217ea0e2a01a38d5ea4b3b941ccbf5e41be9a
MD5 7c5e58a2da8f682fdb6fd0925db49c57
SHA1 0e34796192bddbd72a5bb1f1220f5dc9313347e8
SHA512 a77f2a2527ea191e08e902c83920d515e76a3b06e635649981fe38183db3439b968064a7d71269ef72fa37da348216f1def5d6b748556ec6598b83239c8a169a
MD5 SHA1 SHA512

Submit Download

svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAAACCBCBCACBBABBBBAABAAAAACACACBCCCBCBCACBACBBACBBB.exe
Size 2.6MB
SHA256 9d0f4969bbbeedd7f379e0a47a79501b068dbab857e147eb8d293bc37a11c9a1
MD5 461ec96e04cd378f43dd1561d786f135
SHA1 01b84ccbf0b7e086c29197869caa1659f0b36d9c
SHA512 cc5b163b64d1820cdc824c0074b078972023361911d5c26716f48a6c7ec272a102c03f6f7050fa524d4b509d21fe19450cba45e2508359b81a1d780d673767b7
SSDEEP 49152:U+EWLj+ES+EW5+ES+ES+ES+EWL8+EWLj+ES+EW5+ES+ES+ES+EWLxDd79WCY:pp7u
TLSH
T130C57D05FA828075E96B10B04DDFD2BE8A34BE2187118DEBF78D9B1F6932BE16434715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7186e642e99dae53b5a57ed8ba0f04e8238e0cc7a67b928dcbd6f06a3b6e3d81
MD5 cf43516a19537b01f4b55b79c5dc0dcb
SHA1 a5fdd43fa8155827d62d248b6e937c28ed9fef04
SHA512 507aa130ddae219fd3844207f4afe86b82e6ff669922d47db4e23dcc4c21c48786427e0f3c75f6c0e6d57d2e56de1ba41922cc5898edc5ffc54e20ab3536b501
TLSH
T13F11EB41E8F5DC77EE32A8CB572BCBD318B4779BAC58FA1413084128BB89D324E590D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3104-34-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/4228-8-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/4228-0-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/6056-74-0x0000000000980000-0x00000000009A1000-memory.dmp

Download