1b5bf5265db411f36863f12f869098165393dad3ae3e6c9879de2378b207dab5

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
Size 9.5MB
Sample260815-ewcpradg86
SHA256 1b5bf5265db411f36863f12f869098165393dad3ae3e6c9879de2378b207dab5
MD5 28d8960547ab84ef09289deb411afc53
SHA1 4c5617c8b7a132adc4f361af5358087a193d3421
SHA512 a10f50c87db3f694634b022e6a94799dd63374855a567c06e296a1d39e71b19d8bbbead8e7e0a2397a06e5fbdc31b3388a85090a4105deb381e2ee12f1aa9238
SSDEEP 49152:U+ES+ES+ES+EOP+ES+ES+ES+EOM+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES1:lp7F
TLSH
T1C1A63A09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4DCB5B6933BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6072	svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBCACBBCABCBABACBCCCCCBCCACBBABCBCBCBACABCCCBCBCABCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe"	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4384	cmd.exe
4520	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2208	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
2208	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
2208	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
2208	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
6072	svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe
6072	svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
Token: SeDebugPrivilege	6072	svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 4384	2208	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe	92
PID 4384 wrote to memory of 2756	4384	cmd.exe	94
PID 2208 wrote to memory of 4520	2208	2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_28d8960547ab84ef09289deb411afc53_amadey_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBACBCBBCACBABBCCACCACAACBACCACCBCCAABAAACCACACACAABCABBBCCCCACAABACCCBBAAAACCACAABCCABCBAABCAAAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBACBCBBCACBABBCCACCACAACBACCACCBCCAABAAACCACACACAABCABBBCCCCACAABACCCBBAAAACCACAABCCABCBAABCAAAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBAACAABCACACCCBCCCBCACABCCCCBACCAACACBBCCCCACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe" start= auto displayName= "UserDataSvc_CAABBAACAABCACACCCBCCCBCACABCCCCBACCAACACBBCCCCACBC"
  2⤵
  - Executes a command shell one-liner
  PID:4520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82e7fe25cc0df3b712dc9e60e95027480571c9d2283114e2a3bd3822c8c4ef1f
MD5 8113c2cf28ba770b61f255bff95a7438
SHA1 beb0b4e4a7b0939ee33a928d6810b1a47a429249
SHA512 dcee57dc0ba0f6b6ad26a1d763069cb4c9a552f80b0501ed09c592db62688917b0141e9917435496f64056a4ba72576ffdcfc2416bc0c1067d94f40c4c4ce1f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b46830504682e2429ad5b50d9ed18e90ea9930758fa4eb069bbf42d458327c59
MD5 33e5130de08a7b844ee9e04ca32b6250
SHA1 df61b0716267f43eaa9b92d7a98f0a3ca93987ad
SHA512 1d0b5646a31c7df604e8eccb12f9c9d9c7661b317373c79a694df955eb6ec268f4b56cfb1c3c32636948359073df116f044a4eafdcd110df72a4b47704b9ef46
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 926f34c505d85c5a597327aeb974e2d4b174348505c5b8e57e5dd5da14c860c8
MD5 97a648cbf022b7e65bd331102fc14567
SHA1 fbe07549771696041ada90e4ef9d80eea0c977f7
SHA512 6e9370d94a7ac41b9b36c320b3f78a0a885b560ce8cbd947b3f413c671552ebba730d1af774342d9accd18aba5a2a3201ef66ead0eefa62953e59aa373e8afe4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4584f61b3c83daf1f0046370f414d8656bff3966a4cb1596e0dc2df86059bb2e
MD5 4e111f7786bcbfafcf6d704339e32ad9
SHA1 214653993540f21a03d208ea4382d7d862cab50f
SHA512 97edca000b6a1cc965ac92979741e8e2cc7abb7c878f83d5d6de19c62ca91862fa3990cd5a43206cfcca007f0a80512cca768f1caa8968653cccfa48c29c111c
MD5 SHA1 SHA512

Submit Download

svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACAAABABAABACBCAAAACACBCBAABBAABCBABACCCCAAABBABAB.exe
Size 9.5MB
SHA256 1b5bf5265db411f36863f12f869098165393dad3ae3e6c9879de2378b207dab5
MD5 28d8960547ab84ef09289deb411afc53
SHA1 4c5617c8b7a132adc4f361af5358087a193d3421
SHA512 a10f50c87db3f694634b022e6a94799dd63374855a567c06e296a1d39e71b19d8bbbead8e7e0a2397a06e5fbdc31b3388a85090a4105deb381e2ee12f1aa9238
SSDEEP 49152:U+ES+ES+ES+EOP+ES+ES+ES+EOM+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES1:lp7F
TLSH
T1C1A63A09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4DCB5B6933BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2208-0-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/2208-8-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/6072-25-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/6072-38-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download