2944e4d6d99be9a106339d6a17a4763fa2dec29685ecc07acd4b089c1c90d607

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe
Size 3.2MB
Sample260815-t11dyagg64
SHA256 2944e4d6d99be9a106339d6a17a4763fa2dec29685ecc07acd4b089c1c90d607
MD5 7668a14c40a093fe6c3dd0e2cf04527b
SHA1 b9338c436c81145926ffdc7e7cae25990ea5febc
SHA512 37274d81f80dcaf1161944d38114d7350891ea2b0f5c950250eb74199e2986653f8a48937063fdb7dc722608206cb38a0d060e3783ecebcd19bea4c8f11541cf
SSDEEP 49152:U+ES+ES+ES+EtLgVLKRWTQ6Zs5DhgP9+ES+ES+ES+EtLgVLKRWTQ6Zs5DhgPCDdJ:SKRuy5aVKRuy5aCp79
TLSH
T19CE59E02F6824071E9B2357049AFE37A597D7B214B3589DFE3485B3E5E32AC0993835B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1080	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
3500	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
1400	svchost_BBBBBBCABABAAAAACACABCACAAAAAACBAAABCBBCCCACABAACCCBBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAACBCBAABAABCABABBBCCBCCCCACAAAACACABCBCCCAAACCABABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe"	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBACBCAABCCBCBBBCCCCCCAABBABCABABABCABBAABCABAAABBABCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBBCABABAAAAACACABCACAAAAAACBAAABCBBCCCACABAACCCBBAA.exe"	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2772	sc.exe
2576	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1864	cmd.exe
2788	cmd.exe
5484	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBBCABABAAAAACACABCACAAAAAACBAAABCBBCCCACABAACCCBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe
3176	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe
3176	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe
3176	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe
1080	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
1080	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
1080	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
1080	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
1400	svchost_BBBBBBCABABAAAAACACABCACAAAAAACBAAABCBBCCCACABAACCCBBAA.exe
1400	svchost_BBBBBBCABABAAAAACACABCACAAAAAACBAAABCBBCCCACABAACCCBBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	1080	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
Token: SeDebugPrivilege	1400	svchost_BBBBBBCABABAAAAACACABCACAAAAAACBAAABCBBCCCACABAACCCBBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 2788	3176	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe	92
PID 2788 wrote to memory of 1612	2788	cmd.exe	94
PID 1080 wrote to memory of 6068	1080	svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe	95
PID 3176 wrote to memory of 5484	3176	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe	96
PID 5484 wrote to memory of 2772	5484	cmd.exe	98
PID 3176 wrote to memory of 1864	3176	2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe	99
PID 1864 wrote to memory of 2576	1864	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_7668a14c40a093fe6c3dd0e2cf04527b_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBCCCABACCBCACACAACCAACCCBABACCACCABBAACCCAAAAAAAAACBCABBCBCCAACABBACCAABBCCCCCACCBBACBCBAACCBACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBCCCABACCBCACACAACCAACCCBABACCACCABBAACCCAAAAAAAAACBCABBCBCCAACABBACCAABBCCCCCACCBBACBCBAACCBACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABACACACABCCACABAABCACCAACBBBBABBBAACACCABBBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe" start= auto displayName= "UserDataSvc_ABBABACACACABCCACABAABCACCAACBBBBABBBAACACCABBBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABACACACABCCACABAABCACCAACBBBBABBBAACACCABBBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe" start= auto displayName= "UserDataSvc_ABBABACACACABCCACABAABCACCAACBBBBABBBAACACCABBBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABACACACABCCACABAABCACCAACBBBBABBBAACACCABBBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABACACACABCCACABAABCACCAACBBBBABBBAACACCABBBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
1⤵
- Executes dropped EXE
PID:3500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCABABAAAAACACABCACAAAAAACBAAABCBBCCCACABAACCCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCABABAAAAACACABCACAAAAAACBAAABCBBCCCACABAACCCBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be009b44f24a97fc1096852809d76f452cbf7921f5ef899172126f551e328daf
MD5 b38daef179f5e69ab0c3281e750056a5
SHA1 461b6c834c93e1739812359a073ae41fee10865f
SHA512 9a0006c35d41d1955158eab420ced3ce5e38100915cceae8e9a1ff13e92a1078170c8a0a04ff03157b443936ce705f3351ac6c28b7dfbe70e5e401faa125d7eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcac8518f86f2d5ddb0aab2477800466e4b15d1de66587955892048e71928cfc
MD5 1d403581639f67fee8f785556cc35c9e
SHA1 28de5c471f25cbf73fb0f1cffcfb9e1e6cfa2cf0
SHA512 d0680922a4cbd19b2bb9c567daeecd618c8bf01fccb23c97ba6ea3603ad60073434cadf08e4a8cd3942ae681340c6ac70fa8bbd61fe566b3bb784e46033cc255
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 71a246c7034482ecf44629957f6c2b50802ac16b421e8e159115ad39aeff4f78
MD5 01ca762e375de4be1fb826c3e2276fab
SHA1 bf20915482371d99c26628c134d22132860596c6
SHA512 73f8cdc7ebfedf53958ce78030108f8841d2551dbf2ee432f566be3036c486c52a01a2d90fdf047c94cdf0ddf80fa7299bee8680c794bcbf7589bb7d6a24e916
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9e2b385b27563efd8ed444b35a55046a29c8f756f9bf605c920b9ea6cf8f985
MD5 4b3e3a1fc48652bdb6a3d21f9ba959b2
SHA1 bd5190eedddf847876f457445e6173b21ce61696
SHA512 c9ad89368752c6916ef8d5af83aebaae2825b742cc6017d6a098f15e42b059a2470b7db1a0be162a550f33719956b3d4e158e13f8a184d7ef241ba5bd00fe323
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d8e3dec95d09a7ba21278b7a2040df053b585b2df2e73dab32a2eee0289ddaa8
MD5 62b184462fcdd95760cd41f93f04fa74
SHA1 56b73a296f30ef1c07f2958da073403b1b417ea0
SHA512 0f648b24b35bda0ccf4de8ef7a4daf58a40af801135ec0929f322e8349e1c918c5349ad7ea0813d74d9192c987283be249f536546f8e8cb322d27a2650423ecb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a99a69e93f492834d09d919c6c0a2811ababf5b385178190c57a9fe331e1205
MD5 d6051157fd740855c140157355a2cd73
SHA1 c0bb2a74ddaa12502a08881d341bfd39718b509e
SHA512 f661eacb6dd71070eceda33bd350d46393e1eb2987c6235aa6aad10fe3174936f94d3d77d6e83263c2cf20dd2fe4024864463af5fe343e6d97aeb835f7677c1b
MD5 SHA1 SHA512

Submit Download

svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACCABBCCBCAACCBAAABACACBCCBCBBABBBCAACCAACCCCAACABC.exe
Size 3.2MB
SHA256 2944e4d6d99be9a106339d6a17a4763fa2dec29685ecc07acd4b089c1c90d607
MD5 7668a14c40a093fe6c3dd0e2cf04527b
SHA1 b9338c436c81145926ffdc7e7cae25990ea5febc
SHA512 37274d81f80dcaf1161944d38114d7350891ea2b0f5c950250eb74199e2986653f8a48937063fdb7dc722608206cb38a0d060e3783ecebcd19bea4c8f11541cf
SSDEEP 49152:U+ES+ES+ES+EtLgVLKRWTQ6Zs5DhgP9+ES+ES+ES+EtLgVLKRWTQ6Zs5DhgPCDdJ:SKRuy5aVKRuy5aCp79
TLSH
T19CE59E02F6824071E9B2357049AFE37A597D7B214B3589DFE3485B3E5E32AC0993835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 14ad5a776d444cab0dc8cdb69a4c736e2681e552009ec238d275bf8269c44f36
MD5 45493a96a968c3e9a363a1800fa69d9b
SHA1 4ac42c5e5af9392b46e2526a3e7c7596aa82d25a
SHA512 38840d3ac4851a447db87be4d2d85a3d04bc777a4cc599c4ea01f989ce83f8cc1a6110be65738c2f914afd99f6f1f02af88bed42af1e8f2bcb64ab242452c1de
TLSH
T12A11EE6694E5DC23FA736CCB8E79DB824DF83BBB9C54AE24120842196785C20DE198E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1080-23-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/1080-36-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/1400-81-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/3176-0-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/3176-7-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/3500-67-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download