a8363513479f98435ac3c7796f0c377edad78fb12bbc6fc9b2241c21df1c340e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 12.0MB
Sample260816-kkpg3acc93
SHA256 a8363513479f98435ac3c7796f0c377edad78fb12bbc6fc9b2241c21df1c340e
MD5 09ad6e21ffa1829607c13319479c8def
SHA1 d01aba258bb592346afac51169910ca3e2e7e5af
SHA512 eaaf2bd81f3c4946b359b1fca5626b04de99725f31541846ef52485b2c138e4410e811e97489ea641e6a0ccdec42dbf70671cb0a0b1c65d2624e52a62aabb4ad
SSDEEP 49152:U+ES+EpZ+ES+ES+EpZ+ES+ES+Ep5N+ES+EpZ+ES+ES+EpZ+ES+ES+Ep5N+ES+Epw:pOU/jIEeQfoR/IuOFVjUu5I
TLSH
T17AC68D05FA8750B5E57741B04D9BC2BE8630BE2187118EFBF7CC962F5E32B906924B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2896	svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe
952	svchost_CBCAABABCACBABCCAACAAACABAAACBBCBBACACBAAABAACCBACCCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBCBCCBBBCBAABAACCABCACBBBCABABBAACCAACBBCAACAACCAABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe"	2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABABBABCAACCCACBCCCAAAAACBACBCABBABCCACACBBCCBABBACBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAABABCACBABCCAACAAACABAAACBBCBBACACBAAABAACCBACCCACA.exe"	svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAABABCACBABCCAACAAACABAAACBBCBBACACBAAABAACCBACCCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3236	2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3236	2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3236	2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3236	2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2896	svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe
2896	svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe
2896	svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe
2896	svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	2896	svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 6096	3236	2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	91
PID 6096 wrote to memory of 5512	6096	cmd.exe	93
PID 2896 wrote to memory of 5924	2896	svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_09ad6e21ffa1829607c13319479c8def_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCAAABACACABAACBACBABACAACCBACCCBABCBBAAAACACBBBCBBCCACAABAACACBBCCAABABCBBBABCCBCBBABBAABCCBAACCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCAAABACACABAACBACBABACAACCBACCCBABCBBAAAACACBBBCBBCCACAABAACACBBCCAABABCBBBABCCBCBBABBAABCCBAACCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABABCACBABCCAACAAACABAAACBBCBBACACBAAABAACCBACCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABABCACBABCCAACAAACABAAACBBCBBACACBAAABAACCBACCCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e5b0763c6a97fc66ec6c1cca57ac7a5d843cf895ab22c8c42b820dc26ab818d1
MD5 fd69c4b9314e59022d2ff5bc15da0c02
SHA1 eeb8a7ebbc7a7a029d56683869cc705d76d65095
SHA512 bd1fd36171b527941b9b5aa67bc24d811ebf546f309e92e17b83eaf8b7d238258fad0686ec87d8f4a9711940f8a81d0cc6e04ce71a6dc233d03480565beec67b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb9def458cadb6b3790105713a3716a343cbb25b0615bdf229f87d5c7cca6cf6
MD5 808e3c63fea3f8c62a2b345c216fbd56
SHA1 6f51f1be30c219ca25f01571a7584fd01f8e1887
SHA512 7e06daad82544451a00c0c113b26fd2d9ec680edb1353a5fb971b6c4b543a2b15bf0520d13d28807d5f323b76891adc84958ba16a19d1dfd805a7f74deac3e5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 237bb659d2abd331ceadc91a0953dc6647d9ca84bcf8c6ad8f781c8495c2a437
MD5 abefb5eebc66fdcce200508aa94c6d43
SHA1 d615803e0daa4607f15e73bed10c94280881d613
SHA512 35b2c60eee4b0081cb320fee0550a5c46a67a7d14bb99b28506f6471822600399ff8d1146791bf9b7a5b3a3045518676d36fec47bc91e5f91902686888425a8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1dd658526484df1cabca3344436cf4de9e24c91e7a976e668d6c06691e6d2020
MD5 aca5cd1dcd99180e70be453ea29193f4
SHA1 92c3d45d9dad36e4d82faa1aae1cff58729cf63c
SHA512 3908be31193168e179026b65993b8bbe4c1589ea9b46f3c0cf7555606ed1ab2d650100b51fafc004a27e8514944c2d15431bc9f153044978ff6b2928b87bb919
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ccbbf07127712f7459f1ee1e243e3021c476f7b91f98cd566e2dad01267e607f
MD5 d1cc2a156d043cd22b2c4023867d6937
SHA1 ad7e18c4635a304664f7e1114260f73d9c4bb6fc
SHA512 ce25d0423825f6bd35a5c4c10d20ea5e659d2f05cafc50018b610e4fd8048fe26bd456b7c2d1673afbc6ce43a96f1fc924811545b3290d16e2fbf98f346d24df
MD5 SHA1 SHA512

Submit Download

svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCCBCBAAABBBACCBCBBAACACBCCAACBABABBABBBBBBAACACBA.exe
Size 12.0MB
SHA256 a8363513479f98435ac3c7796f0c377edad78fb12bbc6fc9b2241c21df1c340e
MD5 09ad6e21ffa1829607c13319479c8def
SHA1 d01aba258bb592346afac51169910ca3e2e7e5af
SHA512 eaaf2bd81f3c4946b359b1fca5626b04de99725f31541846ef52485b2c138e4410e811e97489ea641e6a0ccdec42dbf70671cb0a0b1c65d2624e52a62aabb4ad
SSDEEP 49152:U+ES+EpZ+ES+ES+EpZ+ES+ES+Ep5N+ES+EpZ+ES+ES+EpZ+ES+ES+Ep5N+ES+Epw:pOU/jIEeQfoR/IuOFVjUu5I
TLSH
T17AC68D05FA8750B5E57741B04D9BC2BE8630BE2187118EFBF7CC962F5E32B906924B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-65-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/2896-35-0x0000000000190000-0x00000000001B1000-memory.dmp

Download

memory/3236-0-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/3236-8-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download