5f3f2f10511d5af1d9807352193922e2b9d883dfcf0ff2d6a9bf5e6e83819e56

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 7.4MB
Sample260814-eax4katxht
SHA256 5f3f2f10511d5af1d9807352193922e2b9d883dfcf0ff2d6a9bf5e6e83819e56
MD5 96ffab7566230f1bba78aa2b8c6cc3c4
SHA1 12d96080de720b01028c51b336371ca0a09efd77
SHA512 41d32b4e95112cf2b4ee2001084d32104abd33feecb5aeb9ecba38262a812c26fd8995075f6f5cdd2823fbf8bc8455e9bbbc7e52d539152e1ab8f88700e08ae3
SSDEEP 49152:U+ES+ELEj+Et+EkqaK+ES+ELEj+Et+EkqaK+ES+ELEj+Et+EkqaK+ES+ELEj+EtI:VKjKWQckVgtev5mnlNLk
TLSH
T166768E06F98640E1D97611704CDBC2BA8A31FD218F218EEFF689A72F6D337909934B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2788	svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBABBBCAABCBABACCBBBBBABBBABCCBBBBBCAABCCCBABABABACBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe"	2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5628	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2816	cmd.exe
4536	cmd.exe
4088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5340	2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
5340	2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
5340	2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
5340	2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2788	svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe
2788	svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5340	2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	2788	svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5340 wrote to memory of 2816	5340	2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 2816 wrote to memory of 860	2816	cmd.exe	94
PID 5340 wrote to memory of 4536	5340	2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	95
PID 4536 wrote to memory of 5628	4536	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_96ffab7566230f1bba78aa2b8c6cc3c4_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCCBCBBAABCBBCABAAACABABBCCBBBABACAACACCCBACABABCBABABBBBCACCACAAABBCACCACCACCABCCBABCABACCCAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCCBCBBAABCBBCABAAACABABBCCBBBABACAACACCCBACABABCBABABBBBCACCACAAABBCACCACCACCABCCBABCABACCCAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABCCAABBABABCCABCBCBCBCBBBBCACCABABBABCAAABCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe" start= auto displayName= "UserDataSvc_CCAABCCAABBABABCCABCBCBCBCBBBBCACCABABBABCAAABCABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABCCAABBABABCCABCBCBCBCBBBBCACCABABBABCAAABCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe" start= auto displayName= "UserDataSvc_CCAABCCAABBABABCCABCBCBCBCBBBBCACCABABBABCAAABCABAA"
    3⤵
    - Launches sc.exe
    PID:5628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABCCAABBABABCCABCBCBCBCBBBBCACCABABBABCAAABCABAA"
  2⤵
  - Executes a command shell one-liner
  PID:4088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 97eb17fe5ae4b26e9b5287ee4fa36aeed827b37fd2ec2f1318d9401393701323
MD5 1b05337faf7169319dae0395028899de
SHA1 01b9251932143f5bbbff355942f70549fd3684ef
SHA512 5daabf098af51ea6cc74813166baca6243997e041a944015b9e6466324ff3f2cc2ab70198b05806d705c6c36b150a171a8c468fe80fccbf436d88ee141a83767
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6584f87aa3f602b4297416078513efc2d4d86b9128ce26034c2930a9fc33b7b0
MD5 f8106cafe775e5e30ab75b08ccc85ecc
SHA1 5ab5960b8763847219ef987c0964f7cafcfadb62
SHA512 d175bdd1358d2b2e39f763ecac63622cd70e1909192630dce788690e305e5572cbc843c6c8532245c407c2dcce260cad0be78b310602cf41a50d3949d5a558e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fe976f06a5068324533b7d50dfa89c79ee144addca597af26d4f263cf86395a
MD5 879499e62a596d675a82c55ab74487fc
SHA1 49b213e0613d1de5d6741df3b7e299b731cc9efd
SHA512 e23f563193e1f782f8f07f235be86b846b2a75360905cf75662b6c5cca123081d3eee0f5d25bb51fb0bdc230e52a1cc240efe5bfd463f940580cf3a849149bae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf70e8e5d201bfb9c93bf56a91738d504dbfca7c0720c02dbc8501d758f7b2b4
MD5 6c9c1df2353a78fe364eb252f05aaa8f
SHA1 95f669b1df459cf807418ce6abd70950a40aaccf
SHA512 a9adf3bf617f85c5b0b7972ab0cd21a719ead4a15436546fa5cb09eb6a4e081818a8fda822d1982c8cc6c4662cf547f0b82ca45038a2c95bdf5819d4f1f8538d
MD5 SHA1 SHA512

Submit Download

svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCBCBBBCCBAAACABBAAAABCBBACBCACCBBCBCCAACABACBACA.exe
Size 7.4MB
SHA256 5f3f2f10511d5af1d9807352193922e2b9d883dfcf0ff2d6a9bf5e6e83819e56
MD5 96ffab7566230f1bba78aa2b8c6cc3c4
SHA1 12d96080de720b01028c51b336371ca0a09efd77
SHA512 41d32b4e95112cf2b4ee2001084d32104abd33feecb5aeb9ecba38262a812c26fd8995075f6f5cdd2823fbf8bc8455e9bbbc7e52d539152e1ab8f88700e08ae3
SSDEEP 49152:U+ES+ELEj+Et+EkqaK+ES+ELEj+Et+EkqaK+ES+ELEj+Et+EkqaK+ES+ELEj+EtI:VKjKWQckVgtev5mnlNLk
TLSH
T166768E06F98640E1D97611704CDBC2BA8A31FD218F218EEFF689A72F6D337909934B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2788-25-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/2788-38-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/5340-0-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/5340-8-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download