4381f2450fd1b6851c925c9e2dbb5b6c5ff4575b054033facc81c24bc4f543ea

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 10.0MB
Sample260815-lrkywstdja
SHA256 4381f2450fd1b6851c925c9e2dbb5b6c5ff4575b054033facc81c24bc4f543ea
MD5 1970721117e155e6f656de39af3c7bd7
SHA1 62fe802f2a593370f70fc4931d89fe5a926191d2
SHA512 52a62a2a095bd9a7eed9652cf982475234d232ff7db72cd06da417e7a382d179e3afd7eaa9a6e5bf2ae4a265ebee00b3b8764c1f3f94fbd1db18c97c67332e92
SSDEEP 98304:RKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5ayKjKWQc2:RqRqRqRqRqRqRqRq0KWQc0gEYnvLg
TLSH
T177B6BF13E7D60071EAB23530466FB3796D7E77214734899E93540A7E5E32EC0AA2836F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1776	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
2728	svchost_CBAACACAACCBBCCABABCBABACCCBBBBACAACCBABCBCABBCCABAACCB.exe
3108	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAABACBBCBCBCCCBBAACCBCCBABBACBBABACABCBABABBBCACCBAABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe"	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAABBCCCCBABBAACBCCBACBABAAABABBBAAACBCBBABACBBCBBAABBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACACAACCBBCCABABCBABACCCBBBBACAACCBABCBCABBCCABAACCB.exe"	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3076	sc.exe
916	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1380	cmd.exe
5428	cmd.exe
216	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACACAACCBBCCABABCBABACCCBBBBACAACCBABCBCABBCCABAACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4844	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4844	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4844	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4844	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
1776	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
1776	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
1776	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
1776	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	1776	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5436	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1380	4844	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	101
PID 1380 wrote to memory of 3392	1380	cmd.exe	103
PID 1776 wrote to memory of 2780	1776	svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe	105
PID 2780 wrote to memory of 4200	2780	notepad.exe	106
PID 4844 wrote to memory of 5428	4844	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	110
PID 5428 wrote to memory of 3076	5428	cmd.exe	112
PID 4844 wrote to memory of 216	4844	2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	113
PID 216 wrote to memory of 916	216	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_1970721117e155e6f656de39af3c7bd7_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCCCBCABCBBCACACABAAABAABBBBCAAABCACAACCBAABBCBBCACCACBCABBAACCCBCBAAAACAACABAABACBCACABBABCCCCBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCCCBCABCBBCACACABAAABAABBBBCAAABCACAACCBAABBCBBCACCACBCABBAACCCBCBAAAACAACABAABACBCACABBABCCCCBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBBCCBABACBAABACBCBAAABACCCABBACCABABBBCCCCAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe" start= auto displayName= "UserDataSvc_CCCCBBCCBABACBAABACBCBAAABACCCABBACCABABBBCCCCAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBBCCBABACBAABACBCBAAABACCCABBACCABABBBCCCCAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe" start= auto displayName= "UserDataSvc_CCCCBBCCBABACBAABACBCBAAABACCCABBACCABABBBCCCCAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBBCCBABACBAABACBCBAAABACCCABBACCABABBBCCCCAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCBBCCBABACBAABACBCBAAABACCCABBACCABABBBCCCCAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4200

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACACAACCBBCCABABCBABACCCBBBBACAACCBABCBCABBCCABAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACACAACCBBCCABABCBABACCCBBBBACAACCBABCBCABBCCABAACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
1⤵
- Executes dropped EXE
PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 030aa727974707a3b26c48bee9dd67a212f22eabdd1afbd1ec2c83799b9d723d
MD5 c66ea772c498826d6eca1894e345bbfd
SHA1 3ad0496944f0fbc507f24f35c8535cc44d934e81
SHA512 43e655994e1d7abbe5bfa7c2a835d2d19c6ba059f7bd2ea42276c94ae195496c8cbbbf00058b33d7660d63277fccbf49eaf2eaed54eb131de89cda3bde2c8c42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 732eb379f78246c713558b39cb7416ae67eb87d8cd9d5a4084837f8e1ebadcfe
MD5 eb7c41adce27672cf544152dae3f004f
SHA1 838b32c22968b5304668082bc79d5cc741b7e265
SHA512 2bff183fe58755c323766ad39ec50b23c3c999256871520ac455040d4f5ac0e380c345c5af1e87386f5fa5160e1c4dc37fcd56bfe3d473d776564b71f2a0b8f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9227184ad478befbe648e2805a8c8dedd2c29e768523808fab23e22d7c5dc0fc
MD5 98cade88d69c1dc8e7714bdd9bf6b503
SHA1 20da2260d7fc0587edae0f8ca4d06d4acd95f0da
SHA512 6a63c38d3fe671d9c3b5d706462a7e8da21441e6ca3291a54f262c3cd0abb946956f0ac129e50776dca26c8cdca0b09a3959694c984c125c0bfae76d7d57ab4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 45e23942ff111f6de0df4343b797d530f5e064c7e92507c687d47a3a14f54d19
MD5 30eeed9de4f295758be74d41daa16768
SHA1 a11d3daba9b1f8b164d8d08096c1067245cc596d
SHA512 96ef4e0859d124dc6d2525709dcf15f79a61eb282c137a3d18b60b3c0796ef21b194f34e9465a88ec874be2b1fe45d85e8236829667b76b234d9f78a18f20d28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5ab2202f465bfe3e0740d3e1ad1c0942098ac1773093b51d52a82eb3aaf52121
MD5 00a9dfd284c92e407bd725d016aba0d5
SHA1 37489f8211ae5d2bac7ccd5685aabb9a6bd7b2f7
SHA512 65d4681efcb5558057efb6b1fb9e4fc577c9d82e683891857dc63a443b6fce814fc9de208e76e125d5bfc9d1f8c0a203f7c2482ecc77aad9a968317c9dbf4fb5
MD5 SHA1 SHA512

Submit Download

svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCAAACCABCBAAAACCABABCCABCCABBCBBBBCACBCCBABCACBCBA.exe
Size 10.0MB
SHA256 4381f2450fd1b6851c925c9e2dbb5b6c5ff4575b054033facc81c24bc4f543ea
MD5 1970721117e155e6f656de39af3c7bd7
SHA1 62fe802f2a593370f70fc4931d89fe5a926191d2
SHA512 52a62a2a095bd9a7eed9652cf982475234d232ff7db72cd06da417e7a382d179e3afd7eaa9a6e5bf2ae4a265ebee00b3b8764c1f3f94fbd1db18c97c67332e92
SSDEEP 98304:RKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5aAKRuy5ayKjKWQc2:RqRqRqRqRqRqRqRq0KWQc0gEYnvLg
TLSH
T177B6BF13E7D60071EAB23530466FB3796D7E77214734899E93540A7E5E32EC0AA2836F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1776-27-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/1776-37-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/2728-78-0x00000000005F0000-0x0000000000611000-memory.dmp

Download

memory/2780-59-0x00000000058C0000-0x00000000058C1000-memory.dmp

Download

memory/4844-0-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/4844-8-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download