36b3677f4ec599924d178e36dc8f0b767323d0020a1fb8ac13ab4325419a24a2

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe
Size 1.6MB
Sample260815-wgmd3seq2z
SHA256 36b3677f4ec599924d178e36dc8f0b767323d0020a1fb8ac13ab4325419a24a2
MD5 960ff37599d632d65c3935e9cca85bd8
SHA1 d502c82b7f895718322ee53bc75a830f3eb138c7
SHA512 f774187ef0f64272d0089fbd4a39e683087bb1646fb9631a4fe45fbc0660c6f8f6937db525ad019842dd630ba4a14076c82e0e9575e5047855a7d5f7326aed5b
SSDEEP 24576:m9+EM0NTiw21Lb9+EM0NTiw21L+rCn5hafDd70iTWCo:U+EPiw21F+EPiw21CC5SDd79WCo
TLSH
T176754A0977ED4524F5B3663489BAC265AE76BC605B31C7CF5280963D1E33AE0EC34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5480	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
5316	svchost_AAACACCBCCAAACBCBBABBCCCBBBBBACCCAAAABBBABAABBBACCCBAAC.exe
2864	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBCCBCAAAACBBABACCABCAAACCCCCBBBACABBBACBBCCCBCACAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACACCBCCAAACBCBBABBCCCBBBBBACCCAAAABBBABAABBBACCCBAAC.exe"	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCBCCBBBBABBACABAACAABACACCCBBABAAACBACBBACBBACAAABBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe"	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5284	sc.exe
1228	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3920	cmd.exe
2176	cmd.exe
4212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACACCBCCAAACBCBBABBCCCBBBBBACCCAAAABBBABAABBBACCCBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
692	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe
692	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe
692	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe
692	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe
5480	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
5480	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
5480	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
5480	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
5316	svchost_AAACACCBCCAAACBCBBABBCCCBBBBBACCCAAAABBBABAABBBACCCBAAC.exe
5316	svchost_AAACACCBCCAAACBCBBABBCCCBBBBBACCCAAAABBBABAABBBACCCBAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	5480	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
Token: SeDebugPrivilege	5316	svchost_AAACACCBCCAAACBCBBABBCCCBBBBBACCCAAAABBBABAABBBACCCBAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 3920	692	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe	92
PID 3920 wrote to memory of 5636	3920	cmd.exe	94
PID 5480 wrote to memory of 2808	5480	svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe	95
PID 692 wrote to memory of 2176	692	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe	98
PID 2176 wrote to memory of 5284	2176	cmd.exe	100
PID 692 wrote to memory of 4212	692	2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe	101
PID 4212 wrote to memory of 1228	4212	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_960ff37599d632d65c3935e9cca85bd8_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBCBAABBBCBAACBABCACAAAACCCBCCCBABABAACCAACCCCCCABACBCCACBAACBBCACCBCBCBABCABBAAACCCBBBBABACABCCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBCBAABBBCBAACBABCACAAAACCCBCCCBABABAACCAACCCCCCABACBCCACBAACBBCACCBCBCBABCABBAAACCCBBBBABACABCCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBCCCAABCACCCCCCAAACACBBBBCBBBCBBBAACCAACBAABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe" start= auto displayName= "UserDataSvc_CAABBCCCAABCACCCCCCAAACACBBBBCBBBCBBBAACCAACBAABACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABBCCCAABCACCCCCCAAACACBBBBCBBBCBBBAACCAACBAABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe" start= auto displayName= "UserDataSvc_CAABBCCCAABCACCCCCCAAACACBBBBCBBBCBBBAACCAACBAABACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABBCCCAABCACCCCCCAAACACBBBBCBBBCBBBAACCAACBAABACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABBCCCAABCACCCCCCAAACACBBBBCBBBCBBBAACCAACBAABACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBCCAAACBCBBABBCCCBBBBBACCCAAAABBBABAABBBACCCBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBCCAAACBCBBABBCCCBBBBBACCCAAAABBBABAABBBACCCBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
1⤵
- Executes dropped EXE
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f19bdda8557e4c83409f5d7d9fac8a1861280de1fa84e1be932a5bcc7e0aadc1
MD5 65a8d3dc662d0c00cf8439dcb08d736c
SHA1 60cb3596f7b7c5f34ed8e43532b3d98f647232ca
SHA512 5afd1d8845533a7cbd98b8d7def6f10a2f93d1705bb3037ccf4dc608164ac1970bcdb4716065d248791b6a1ccee3512cfe4dc680983e1eb5d2151faa97780e73
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8149e72db7f7c9e0610fd2bae89c40308409f735f3a9d197c3277cb7d36f89ef
MD5 fc4c7b4daf037eb02c93f73b5d4d7bd7
SHA1 fca5fb270e7a05e1728cd5e1393eec843ebab3fa
SHA512 0f6df0d366bef987c30f8c8e25fbb3e759b7c53b4c4685f7faa059b0854120ac86a15e94fab6a844b4bb2fd5978aac0bee2d2c2413ac697f87a4201fa42e7832
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b43a830f3f9396dd67e3d7beb165ba1d93e530131f545bb29cb917526b4c2962
MD5 c3808b642db914cc77edbfb6efd37b01
SHA1 f6424b79a93e8335e5e998eb3fab319e51c09535
SHA512 ae9e706f3d8462fc7a00ca0b15ec1f5839aafa312422141f088dcc516781654dd88191a0c6ae6064ae9254ad28e8710567f4967c9fdeca98b2f8d76cdd2d553c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 baa154b6247a5db71020a79a1f4d7ea0d099c977a96b225c65be6c21c7356455
MD5 1c3ecffbabb18916c8cdf2e273f39146
SHA1 60299d94114933efa3494c104875bf9b21318d21
SHA512 42a418f11198a6ade919eaf7e676b99d01a18bc2f6ad8adc6e7f5d127924b66f8796e89acaf3abfcb75058de4553e0d7d1f0037fd18d5f8c5734e46a78d253f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4cc62905b1402a27507e75ab785be51e3f7c681d527d2b639bb911377ea8bcf3
MD5 7d89c5d2e828fffb3296a377ec67241e
SHA1 2685accc05cac739f6ff8759d1c2ce364a8b0d41
SHA512 401102d79dc62ffa6a0aad88f4644b75552860c59a5f97d8d03125d706a4b8db3001702c137e47f300c65e3299cd7557e1ef192c8afb9fcdd7acfac3b3215efc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ea667e2e496be9e61408d427edd4b4eb49b30fdae28847b5f6c70a77722d1fd
MD5 7b07732dd1b8c4c97e72974b50cdbc25
SHA1 18835a9b96265439be6ba21035d297d801381eb5
SHA512 9d625f41fddc010ef2f474c66c83fd19f33507a03f058ed1a9712cf9197f22b9a2417e56fac684f8d0bfe27122805f857b13488cc0c96148973ce4b51a473f3a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 587c87c345c498738ed61f49c373b1e45a849ce0794c6bdc45bda9407d5aa72a
MD5 9eb3a277aa7d5d8c060143926a7d5df3
SHA1 bb6fb688a9e2901e397261b1bf9899f54299a655
SHA512 e615af9da4e10f1786c97792f317f939d7a23d92cfd1f15b6399288a1e416dc621e5f6d45ba82b456089d326d7ae52b93e39dd6a05c1ca95b452762643324c49
MD5 SHA1 SHA512

Submit Download

svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBAACAAABCBBBABBBBACBCABBABBBBBABBCCBCBBBAABACBBCC.exe
Size 1.6MB
SHA256 36b3677f4ec599924d178e36dc8f0b767323d0020a1fb8ac13ab4325419a24a2
MD5 960ff37599d632d65c3935e9cca85bd8
SHA1 d502c82b7f895718322ee53bc75a830f3eb138c7
SHA512 f774187ef0f64272d0089fbd4a39e683087bb1646fb9631a4fe45fbc0660c6f8f6937db525ad019842dd630ba4a14076c82e0e9575e5047855a7d5f7326aed5b
SSDEEP 24576:m9+EM0NTiw21Lb9+EM0NTiw21L+rCn5hafDd70iTWCo:U+EPiw21F+EPiw21CC5SDd79WCo
TLSH
T176754A0977ED4524F5B3663489BAC265AE76BC605B31C7CF5280963D1E33AE0EC34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e3355b8050600413bcd643382eabd07147ec49b7d7cac620cab7148f943dd8de
MD5 33bda5c04efad5e745a04da56f2add06
SHA1 62118cf59427858f84a9778bd4ab3ead8518e1f6
SHA512 f0c2200dc4691005ad2647957e5b998275873cffbba0ac6a7bc35884a0b5fc5517fd6c66f0f97b17f07d02cd6b96f21b1a816ae8193f1f2931f1333731b4fd9e
TLSH
T15511C153E4E5D867FC7238DB4B699BC20DAC2BAB681C6E1823014518A7DDC319D298E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/692-8-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/692-0-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/5316-74-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/5480-34-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download