1b5bf5265db411f36863f12f869098165393dad3ae3e6c9879de2378b207dab5

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
Size 9.5MB
Sample260815-ewcpradg86
SHA256 1b5bf5265db411f36863f12f869098165393dad3ae3e6c9879de2378b207dab5
MD5 28d8960547ab84ef09289deb411afc53
SHA1 4c5617c8b7a132adc4f361af5358087a193d3421
SHA512 a10f50c87db3f694634b022e6a94799dd63374855a567c06e296a1d39e71b19d8bbbead8e7e0a2397a06e5fbdc31b3388a85090a4105deb381e2ee12f1aa9238
SSDEEP 49152:U+ES+ES+ES+EOP+ES+ES+ES+EOM+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES1:lp7F
TLSH
T1C1A63A09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4DCB5B6933BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1440	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
4060	svchost_CCBAABCBABCBBABCCAABBCCAACACAAACBABCBABCBBCACCACBBCCCCB.exe
2424	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBABAAAAABCCCCBBBBCBABCBACCCACBACCBBABCCBABCCBAAABCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe"	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBBCBBBABCCAABCBAABBBACAACBCBBBAACBABABCCCCCBCBCACBBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAABCBABCBBABCCAABBCCAACACAAACBABCBABCBBCACCACBBCCCCB.exe"	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3840	sc.exe
2572	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2352	cmd.exe
3512	cmd.exe
3300	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAABCBABCBBABCCAABBCCAACACAAACBABCBABCBBCACCACBBCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4416	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
4416	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
4416	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
4416	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
1440	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
1440	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
1440	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
1440	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
4060	svchost_CCBAABCBABCBBABCCAABBCCAACACAAACBABCBABCBBCACCACBBCCCCB.exe
4060	svchost_CCBAABCBABCBBABCCAABBCCAACACAAACBABCBABCBBCACCACBBCCCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
Token: SeDebugPrivilege	1440	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
Token: SeDebugPrivilege	4060	svchost_CCBAABCBABCBBABCCAABBCCAACACAAACBABCBABCBBCACCACBBCCCCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4372	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 2352	4416	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe	96
PID 2352 wrote to memory of 2716	2352	cmd.exe	98
PID 1440 wrote to memory of 436	1440	svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe	100
PID 436 wrote to memory of 2360	436	notepad.exe	101
PID 4416 wrote to memory of 3512	4416	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe	105
PID 3512 wrote to memory of 3840	3512	cmd.exe	107
PID 4416 wrote to memory of 3300	4416	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe	108
PID 3300 wrote to memory of 2572	3300	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBACCCCBBBACBBCBBBCAABBBBCABCCABAACBABBBBABCBBBACABCBBACABCCABCCCCBBBBABBAAACACCCCACABCBCBBAABBBBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBACCCCBBBACBBCBBBCAABBBBCABCCABAACBABBBBABCBBBACABCBBACABCCABCCCCBBBBABBAAACACCCCACABCBCBBAABBBBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACCCACBCACABCAAAABBAABBBCCACACAACABABCCACCBCAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe" start= auto displayName= "UserDataSvc_BBACCCACBCACABCAAAABBAABBBCCACACAACABABCCACCBCAABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACCCACBCACABCAAAABBAABBBCCACACAACABABCCACCBCAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe" start= auto displayName= "UserDataSvc_BBACCCACBCACABCAAAABBAABBBCCACACAACABABCCACCBCAABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACCCACBCACABCAAAABBAABBBCCACACAACABABCCACCBCAABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACCCACBCACABCAAAABBAABBBCCACACAACABABCCACCBCAABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCBABCBBABCCAABBCCAACACAAACBABCBABCBBCACCACBBCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCBABCBBABCCAABBCCAACACAAACBABCBABCBBCACCACBBCCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
1⤵
- Executes dropped EXE
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 78efe19575a5eafbf3c13ad0aaea721e819118fe377c36e90961149f3edd78f6
MD5 71b517f6ca56de0b956aaaf8a220a5e2
SHA1 e62cbfdf9b17a2bd48249484a69fd4b0edb0972c
SHA512 28b281da6ac789620d4da23b8f5d78b07904eeb3d912d6e51d53acb5bd2afe0bf5a5c9632f406c33a2e22bfa6eb8d6ac393633556c389440c16b42e80542c83d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3223eb81479e46e4b786e39a393a9750638f78d17c26668427ccae2295246665
MD5 37bab01fa7211fb22716f618c1168a1f
SHA1 e4e330144a357b0206cbe4c6b7618ebead4c4133
SHA512 7b7c3041acae23f0fe030f78b9417564e08ef876c1fc415adc8733d2963af1a96a4fc4175d3f31bf4f204467d959e00707b739921e30ed9fe0c74671aeeb5ad4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a07c9a6bf178f35a16ba122203a38a339a677aca6ec3ddb613e34fc7f8dcb24e
MD5 759fcca6ae57c2fe0b1c705f1fabf698
SHA1 2d43aa7b0ec4ca6e08ea9281fde0ec96a33faa88
SHA512 7111d6c217d893ad6d8df74fbabc2cf2595adbc7e3266f504613fbfdd02dfb034672e2a77ba2dfecd56606bcdd713677961371ef67b6b65820659a483404e28d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ac24c0159991c83d49eab77e9d52f18d63e3be8210a77918921044d615d8dd6f
MD5 fd8cbf94f8f196b9c93eb3262ce0fc22
SHA1 61e56722e7d0401a9d0dfcd87b6393ddaef3a46f
SHA512 30a053613c4b026dc9cd8a26e5da2cb05dd3e22eaa2dd2050e9fef68a7e841ef22b0e4f5248eeef7f4c5ae5715510c0b56d5edbb550f8ac108132a051169c290
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 54f5a9e1dbaa57fd2d59867050f7c4b73574c6fc5d3c216494b32e94cdc3555f
MD5 4bea61862a3e629c4e125ec41116de8e
SHA1 2ffbec515a99455a47bd89a94cf66e7127b2a238
SHA512 660ab62985aa9a53f2f3dabcd00ca7347a910f290fbf07e012f79865d2f5f385ad3610ba7a859e32f8c183a6921a89af6fdcdb6d90353bb35e80cd2cffd98061
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b607506b0112227e4dc68a1a4b4e020e113f4b4cefa345089d2cb22831ff7b76
MD5 76c798165258774a8d579f4b27bb4194
SHA1 3bb5f990eb8cb5a6e008a386a0fb995f98097e15
SHA512 8a8bff0675b99892bd6fa282f6c2c8f9f4a5705c9fd6d7e5ff94b59a7c9cc0ca0bbed5287e4fda2329de3f91caf84b33afc8f5f7f782f1930d2b7bd807d639c9
MD5 SHA1 SHA512

Submit Download

svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBABABAABCBABBCCBCCCCBBCCCCBBABBCBCBBBCACBCACCBCCACCA.exe
Size 9.5MB
SHA256 1b5bf5265db411f36863f12f869098165393dad3ae3e6c9879de2378b207dab5
MD5 28d8960547ab84ef09289deb411afc53
SHA1 4c5617c8b7a132adc4f361af5358087a193d3421
SHA512 a10f50c87db3f694634b022e6a94799dd63374855a567c06e296a1d39e71b19d8bbbead8e7e0a2397a06e5fbdc31b3388a85090a4105deb381e2ee12f1aa9238
SSDEEP 49152:U+ES+ES+ES+EOP+ES+ES+ES+EOM+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES1:lp7F
TLSH
T1C1A63A09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4DCB5B6933BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 0ef2874ba8f29f6b0bace4855c3ea6eeef8ae8c297684a16c397992af7abab08
MD5 e5681651a24325e3b28cb94710247d73
SHA1 a67499983bfb9628506230402261370f4ab554b9
SHA512 22e03e49e14f5a9d59ff65b57456b978174b424048527df65e46292c5f41422a77b966919084ee6d32c1569edb5757dde5c70cccd2ea4e09f6c689b89415a7d6
TLSH
T12111EB60ACA6DC27F83268CB552DCAD209F43B9FDC686E54234E83187BE9D314E454E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/436-60-0x0000000005900000-0x0000000005901000-memory.dmp

Download

memory/1440-36-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/1440-26-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/4060-78-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/4416-0-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/4416-7-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download