d0a2328b4ed0f27b2ec6554d578fea84d4febc4878b7532fb84db56d726d0d99

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe
Size 2.0MB
Sample260815-b2mv5axtaz
SHA256 d0a2328b4ed0f27b2ec6554d578fea84d4febc4878b7532fb84db56d726d0d99
MD5 33c0d3467834f6c4f7ca563cb83c37dd
SHA1 6a59ca3f700a39006e1af960b4c5bd078b7a291d
SHA512 f6a87d2b7c4ae166ee5a92b38d2ab21305a05513917e0ede18b51c1659997f7657de52bc3395a67c78c1efe0812185a1f5f3d456b8dc12c89c67a1aa276b508f
SSDEEP 49152:U+Ek6+ES+ES+EkUe++Ek6+ES+ES+EkUevDd79WCx:hp77
TLSH
T1DA957C09F6D94074E5776071898BC67ED9B1B82147224ADFE789CB3E1E33AE1B834B05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
368	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
1276	svchost_AAACCAAACCCBAABCCACABCBCCCCCABBCBAABABBBCAAAACCCAAAAABA.exe
5852	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABCACCABABABCCAABBCAABBBAAABABBCAABBCBABCCABBACBABBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCAAACCCBAABCCACABCBCCCCCABBCBAABABBBCAAAACCCAAAAABA.exe"	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAABACCBACACBBCBCACCABACBBBAABBAABCBCCBACBCCBCBCCCBBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe"	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5564	sc.exe
5644	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1808	cmd.exe
5988	cmd.exe
2456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCAAACCCBAABCCACABCBCCCCCABBCBAABABBBCAAAACCCAAAAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1856	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe
1856	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe
1856	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe
1856	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe
368	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
368	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
368	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
368	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
1276	svchost_AAACCAAACCCBAABCCACABCBCCCCCABBCBAABABBBCAAAACCCAAAAABA.exe
1276	svchost_AAACCAAACCCBAABCCACABCBCCCCCABBCBAABABBBCAAAACCCAAAAABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	368	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
Token: SeDebugPrivilege	1276	svchost_AAACCAAACCCBAABCCACABCBCCCCCABBCBAABABBBCAAAACCCAAAAABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1808	1856	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe	92
PID 1808 wrote to memory of 1864	1808	cmd.exe	94
PID 368 wrote to memory of 5360	368	svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe	95
PID 1856 wrote to memory of 5988	1856	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe	98
PID 5988 wrote to memory of 5564	5988	cmd.exe	100
PID 1856 wrote to memory of 2456	1856	2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe	101
PID 2456 wrote to memory of 5644	2456	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_33c0d3467834f6c4f7ca563cb83c37dd_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCBACCCBBABAABBAAAACBCBCABCCCBCCACABBCBBBCAABBABCACACABAABBBBACBCCCCAAAABBCBBCABABBAABCAACACCBAACCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCBACCCBBABAABBAAAACBCBCABCCCBCCACABBCBBBCAABBABCACACABAABBBBACBCCCCAAAABBCBBCABABBAABCAACACCBAACCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCBCCCCAACCAAACCCCCBCBACBBCCCCACBCBCCABACABAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe" start= auto displayName= "UserDataSvc_ACBCBCCCCAACCAAACCCCCBCBACBBCCCCACBCBCCABACABAAABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCBCCCCAACCAAACCCCCBCBACBBCCCCACBCBCCABACABAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe" start= auto displayName= "UserDataSvc_ACBCBCCCCAACCAAACCCCCBCBACBBCCCCACBCBCCABACABAAABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCBCCCCAACCAAACCCCCBCBACBBCCCCACBCBCCABACABAAABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCBCCCCAACCAAACCCCCBCBACBBCCCCACBCBCCABACABAAABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCAAACCCBAABCCACABCBCCCCCABBCBAABABBBCAAAACCCAAAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCAAACCCBAABCCACABCBCCCCCABBCBAABABBBCAAAACCCAAAAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
1⤵
- Executes dropped EXE
PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c6e10e282cefd68cb150cb2ca162c4680443f65220dd0c1759f0836ea600a2d4
MD5 beb89c9685d92c5158aa155cfa1992ee
SHA1 77bb78a7f66a387b72bf1053e914425f1b907a51
SHA512 7de4b00efddc5f3abe7fd6cd90e460c34759f3b24fd5ea5ce98da386479b36ae9b9254fe8e79c3c0381625938350aa68524aba36a31c11f1a98505dabc2c50d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad6e5022626e89b9399a502970845a6548d11a3357d17101ec548abff253b69f
MD5 c160080920b8491ac3e1edbc6cc6b1b6
SHA1 0c6d4180c521187867fa832e8d2e6f4e25545c69
SHA512 68a0ba295be47ceaca6b988c172e51f95d4569f8c1784f015c666869d6e3bc4faa587bb7b22b38b5821766fbe1086b0e19003ab3a680840d8971ddc0049616e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5971a5290d2eed58253f4630afa9efa903ec97b0ef7aa3008eef00427c6b96bc
MD5 76e21de8df4079a6f2d71d5ee7623977
SHA1 c726942d52eb4d4c61995ef93ba2692155007b6d
SHA512 fbc2e1bd892a709a9f17ab89bd9b7d221932f63cdcb7ccde78a0f2b0c505f5d9c4f604fb54a11ff17373b73917413a7fdbec7f22d03c3f11aaa76f593ebc1dba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 81e7bd6f589bbbd4e5a2ca667ab2a8f6cf2d2756aa9e853e979987ac906f17b2
MD5 9d3cea435b41d77eb5e41167840b2fde
SHA1 8b1d3f46f7bc601719aabd2cf0cd4a7fdaf54ebb
SHA512 dc50343ce7140da554374d6f3974ae50e36d4a8c8ed9d46f03fbb6f41c703b4756f8d8834462c593aa89b33b722dc14a793eb7580a6e9da64e436b8f3843a469
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 44abaa79115a0a3b1995f42b26339435b40d66bdc7703955cb366ef4e49bbf9d
MD5 51957e7ebdf1b7cb32599502ace5c6e9
SHA1 bcbb112b00c1ea9a87787da83abd5e9d0be00dd9
SHA512 40d117dd2505559b7f8b51d691e7df33b5b1e36d1cc0d59f39bfad241260b7faeb30c62d779a6640189a86f34bb38e73079cf53509921932e61b5b7084e27adb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 65b9b26543e53de3d4ae3ea33111042836d73346bffc89f76947799f5cfc6166
MD5 f3eb10dfd5fb9a6d1d7adc39ab219398
SHA1 95878311b3c0c571d4fe526727b9b758165f8117
SHA512 7757fcb3242de557eeec89de21c669deae4864f21bd44a64fb1daa985c872a52028c9046506c52df5f4efc3e42391b9ce0ba91a87715c4dcb21da09f674ae2b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c0441fecf3e6e8f92fbe9b727fdc55771f18a0a363f1428b40b0d06266ba1ce9
MD5 92510048ab7fdb27913d7bb72d18bb7f
SHA1 24a5a1a709bbef9d31f4ba0d6ad75faed77683c7
SHA512 34890ca5a98c8dce879ad59ef942ec7f63fed8dc6ffc6fc83704c63f6906081336d89005fadf93eefe8b059ad6e05b5ead6d755c92890ea5992608ae2e6dca04
MD5 SHA1 SHA512

Submit Download

svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCBCBBAABABBBCBABCBAAABCAAABCCCAAACBABCCCCBAABCCBCB.exe
Size 2.0MB
SHA256 d0a2328b4ed0f27b2ec6554d578fea84d4febc4878b7532fb84db56d726d0d99
MD5 33c0d3467834f6c4f7ca563cb83c37dd
SHA1 6a59ca3f700a39006e1af960b4c5bd078b7a291d
SHA512 f6a87d2b7c4ae166ee5a92b38d2ab21305a05513917e0ede18b51c1659997f7657de52bc3395a67c78c1efe0812185a1f5f3d456b8dc12c89c67a1aa276b508f
SSDEEP 49152:U+Ek6+ES+ES+EkUe++Ek6+ES+ES+EkUevDd79WCx:hp77
TLSH
T1DA957C09F6D94074E5776071898BC67ED9B1B82147224ADFE789CB3E1E33AE1B834B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2c5a936eac780723fda0eac78fd1aa00836d183b6f7145fc3aa44c9f263b08f3
MD5 a5bdc985ba397f223dd66958cc10c8df
SHA1 8464ddc33afb49d45300cc43417702d8d20f7ebd
SHA512 4c143a9fb1d6b3fade392f571dc8778992287cdf1c30ae325033bfe3d78b6fdea0e3bacc1fe7f267ae7d52a561e66d933cc58f1ca224232c3fb4d4a3bd408dde
TLSH
T1FF11E77168E5DC53FA336CDB962DEA834CA57B9F581C6E54230C81186749C25CD15CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/368-34-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/1276-70-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/1856-8-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1856-0-0x00000000007F0000-0x0000000000811000-memory.dmp

Download