a57367a9263c71259cb8629e14e5e0ccd2ca53e95d7f989927af649429e6295e

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 5.2MB
Sample260816-e2eraszbrf
SHA256 a57367a9263c71259cb8629e14e5e0ccd2ca53e95d7f989927af649429e6295e
MD5 64e0b6d937d8092296997359ef0e1a11
SHA1 5e0ca6337e212e0678e6f9ec9dcf05bb8c88da81
SHA512 ba874b1284f2f522b81466d56ba2a1c8f560b958ba6705637fa8daed9f6b422652b60b2103de7268c5b4b4c283929867ee723ef52dc1baae0f0c6af0f7e7a33a
SSDEEP 49152:U+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+s:3KjKWQckVgtev5mnlNLi
TLSH
T1A746AE06F98780B5D96B10B04DDBD2BF8A30BE2187118DEBF7CD9A1F6932BA06434755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4224	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
1916	svchost_CBCBBBCACACABABACBCCBBBAACBCBBAAAABCBCABBABABCACBAAABCC.exe
940	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBACBAABACABAABCBAAABACBAAACBABBCBCAAACBCBBBBACBBCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe"	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCCCBCCCCAAABACCCBACAACAABAAABACCBCAACCABCCBCBBBCCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBBCACACABABACBCCBBBAACBCBBAAAABCBCABBABABCACBAAABCC.exe"	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5028	sc.exe
4724	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3888	cmd.exe
2040	cmd.exe
5612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBBCACACABABACBCCBBBAACBCBBAAAABCBCABBABABCACBAAABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4648	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4648	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4648	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4648	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4224	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
4224	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
4224	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
4224	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
1916	svchost_CBCBBBCACACABABACBCCBBBAACBCBBAAAABCBCABBABABCACBAAABCC.exe
1916	svchost_CBCBBBCACACABABACBCCBBBAACBCBBAAAABCBCABBABABCACBAAABCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	4224	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
Token: SeDebugPrivilege	1916	svchost_CBCBBBCACACABABACBCCBBBAACBCBBAAAABCBCABBABABCACBAAABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3888	4648	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 3888 wrote to memory of 3748	3888	cmd.exe	94
PID 4224 wrote to memory of 1584	4224	svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe	95
PID 4648 wrote to memory of 2040	4648	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	98
PID 2040 wrote to memory of 5028	2040	cmd.exe	100
PID 4648 wrote to memory of 5612	4648	2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	101
PID 5612 wrote to memory of 4724	5612	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_64e0b6d937d8092296997359ef0e1a11_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAABBBBAACBABCBBACABCCCAABCBAAAABACBBCCAACBACBABBBBCBAABCCBBCCCAACCCCABACBABBBACAABCCCACCCABACCBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAABBBBAACBABCBBACABCCCAABCBAAAABACBBCCAACBACBABBBBCBAABCCBBCCCAACCCCABACBABBBACAABCCCACCCABACCBCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACCCCCCACACABAABABCCAABCACCBBAACBBABBAACACBBBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe" start= auto displayName= "UserDataSvc_AAACCCCCCACACABAABABCCAABCACCBBAACBBABBAACACBBBACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACCCCCCACACABAABABCCAABCACCBBAACBBABBAACACBBBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe" start= auto displayName= "UserDataSvc_AAACCCCCCACACABAABABCCAABCACCBBAACBBABBAACACBBBACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACCCCCCACACABAABABCCAABCACCBBAACBBABBAACACBBBACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACCCCCCACACABAABABCCAABCACCBBAACBBABBAACACBBBACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACACABABACBCCBBBAACBCBBAAAABCBCABBABABCACBAAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACACABABACBCCBBBAACBCBBAAAABCBCABBABABCACBAAABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
1⤵
- Executes dropped EXE
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b31aed82a516c3173a5f277a68eab48bb7e07979eb2ce76968b7bf539e15039
MD5 f7ead8e561bdce60ad3ed510b68a7bcf
SHA1 523fd67c57715f5d8e62ca4a7b71a78ba0df257d
SHA512 734063358c15099b8c0ee1f123699dd9b1079cbca639a14e19651d8ad278d68fe0ed52eb3ad466f16d14a44d69551ad732b7c0e3769e2a60c6038f8a9e765fcc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b14b64fc2b6d7839e6f69662afee1a7b760a2eb22cae1802ef5641ce77f63848
MD5 0c198225c8b911136c38e352af628290
SHA1 d43516c2d8c31d7f4711532efaaf49718db3bdf2
SHA512 bbfee07971a2bcaa0db87fe5f7fabafb7f9b736c8156cb6d491ad5b1f53bb9203f8f021abf9aeda3b8e189b5c06f6f81f85ee13f50521126e79f7b9a1efc988d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1898693b31ea595f6d3f99ff05dac77dc5f870c4d4c406f93f67ef79f6130fbd
MD5 3a097e02d93cb239f1ebd38e6b0d893f
SHA1 dcce38f604526096f45fd2430539d5ef11bf93ec
SHA512 d28a29d220d0eb930031a39292cff5dbd7a04de85ae1be7f710513a1b19f5a390317e8d28d9f0532e546689c154c1592f6651dd97af5a8886553a9e162e51c73
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0c40650437025e30a08c3581841b4ac6b981108889bbbf4e1dce5d0617a497eb
MD5 a752bc3f789d3d5bcbe8a22ab22885a3
SHA1 7974f0c15aeb226e59e091588c07c3a6eebbfc54
SHA512 3b586a9b354e89f8d59cc8bcb38dd264a77bb05235aa556ac77702421671ae9f1e57cf1b4d36492a32bfab09d38a4ab69d9d5b92c349be3eba764a9236d94e83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38a741c517a674eb7a6b9f909744f9c1ea449b87aef3d29a8ddbfc2399dc6481
MD5 4634d3a996d04153dccac68591cfa4a1
SHA1 e4498e6ed352a6e989ec8d4197806e64d28c3292
SHA512 bd18f24e8dcf61cd2f8c74ea1fae11ca95c39d898bb8c61618aa5e1d2f16d760140fc12a50f47055a56ea93594c2e550d227799cf04227363c207a4f12561805
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 aff550e639950c15c08226ab86662776e3d2642bc7e22f242bfcb4315de3eb55
MD5 03f734333752ca3567c4251151d7c568
SHA1 400d285b156fd4da17db03d49f64c692cd3b14f6
SHA512 787590239fab1e800e2b80f3263097b394f8a12b5af9d896d8d895ff666721401eb7c0b38a102a30e24e196456f0a41fccc092b56c1ff5cea7414d4f9db6135d
MD5 SHA1 SHA512

Submit Download

svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAABCACBAAACBBCCBBBACCAAACBBBBBABCCBBBABABAAABAACA.exe
Size 5.2MB
SHA256 a57367a9263c71259cb8629e14e5e0ccd2ca53e95d7f989927af649429e6295e
MD5 64e0b6d937d8092296997359ef0e1a11
SHA1 5e0ca6337e212e0678e6f9ec9dcf05bb8c88da81
SHA512 ba874b1284f2f522b81466d56ba2a1c8f560b958ba6705637fa8daed9f6b422652b60b2103de7268c5b4b4c283929867ee723ef52dc1baae0f0c6af0f7e7a33a
SSDEEP 49152:U+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+EWL9+ES+ES+s:3KjKWQckVgtev5mnlNLi
TLSH
T1A746AE06F98780B5D96B10B04DDBD2BF8A30BE2187118DEBF7CD9A1F6932BA06434755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 aa5abd1282b935cd19ac0aeaab8f63f81cc65008546636cf401d43fd131159d2
MD5 df10bcfc734fab5c66a62f465beb8223
SHA1 fb9d33abc3f27781feb0ca01e39c0109d0aea08a
SHA512 82151dd047ae468e32cfc35311b7b008ef8201ce90e189399701ed742f2922eb97ab924f4d8cfb32a42a931fadca15311fc15d365f6b48192045ccd216f9553d
TLSH
T1E8110401A8E5EC53FA3338CB9729CF921CA9339B58A86A886201121CF6C8D31DD5D4B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1916-79-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/4224-34-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/4224-24-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/4648-8-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/4648-0-0x0000000001000000-0x0000000001021000-memory.dmp

Download