12b583f02b21c8049aaa8c88106a4cbad4cc5a97f26aaa33e512304f2182bbcb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 10.6MB
Sample260816-lwp4eavvgw
SHA256 12b583f02b21c8049aaa8c88106a4cbad4cc5a97f26aaa33e512304f2182bbcb
MD5 cb12393bf563aeea5e4773834da7cb7f
SHA1 14d3ad04f12b5ef924a83089fbb3689f358fd687
SHA512 3f1092a20968dd234fbc7bedbcc5c8288d4eb9143605c4ee0896a60a1a559f024a520f10a27d211a107f3e9dc122edd1623b19fcaf737d7e2428f74c48a39f22
SSDEEP 98304:gKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5ayKjKWQcJ:gqgqgqgqgqgqgqgq0KWQc0gEYnvLD
TLSH
T142B6BF13E3D600B1E6B23530467FA3756D7EB7214634899E93940A7E5E32EC09E3876B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3300	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
3688	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
5052	svchost_CABAAAABBBCAABABACBBCCBBBBCBCBCACCCAAACBCAAAACAABCAAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BACABCBBCCBCCABAAACBCCBACACBBCCABAABBBACBACCBCCABBBABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe"	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBAAABCBCBCABCCBBCCBACABACACACBAACACCCBCCCBACBCCBBAACCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAAAABBBCAABABACBBCCBBBBCBCBCACCCAAACBCAAAACAABCAAAAC.exe"	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2320	sc.exe
3700	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2412	cmd.exe
2832	cmd.exe
4004	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAAAABBBCAABABACBBCCBBBBCBCBCACCCAAACBCAAAACAABCAAAAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4908	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4908	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4908	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4908	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3300	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
3300	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
3300	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
3300	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	3300	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 2412	4908	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	97
PID 2412 wrote to memory of 680	2412	cmd.exe	99
PID 4908 wrote to memory of 2832	4908	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	100
PID 2832 wrote to memory of 2320	2832	cmd.exe	102
PID 4908 wrote to memory of 4004	4908	2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	103
PID 4004 wrote to memory of 3700	4004	cmd.exe	105
PID 3300 wrote to memory of 4092	3300	svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe	107
PID 4092 wrote to memory of 2992	4092	notepad.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_cb12393bf563aeea5e4773834da7cb7f_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCBCBABBABABABAAABAAACCBACCCABBAABABCCAAAABBCBAABACBCCAABACCABCBBABACCCCCBBACABCBCBBACCCBABCBAABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCBCBABBABABABAAABAAACCBACCCABBAABABCCAAAABBCBAABACBCCAABACCABCBBABACCCCCBBACABCBCBBACCCBABCBAABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBAABBCBBABBBBCABCCBBCBABCAAAACAABBCBCAACAABABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe" start= auto displayName= "UserDataSvc_BCBBAABBCBBABBBBCABCCBBCBABCAAAACAABBCBCAACAABABCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBAABBCBBABBBBCABCCBBCBABCAAAACAABBCBCAACAABABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe" start= auto displayName= "UserDataSvc_BCBBAABBCBBABBBBCABCCBBCBABCAAAACAABBCBCAACAABABCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBAABBCBBABBBBCABCCBBCBABCAAAACAABBCBCAACAABABCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBAABBCBBABBBBCABCCBBCBABCAAAACAABBCBCAACAABABCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAAABBBCAABABACBBCCBBBBCBCBCACCCAAACBCAAAACAABCAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAAABBBCAABABACBBCCBBBBCBCBCACCCAAACBCAAAACAABCAAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b4448b5401bee44ce4ba58c7694a3a1376d325772af9e8a58931305aaea9209
MD5 09ef9c33013e2e14755fb74fed0dcebc
SHA1 afb8c4ec3fc766b1f617b94112619c69d72ebddc
SHA512 d02cd5ed73cae0be9c1ea9f143f043c9686259c26d7d7718a8cc8eafef62c461758bf2d1e25594ca25999195bbbe4c3c40f7bb9882b5973c98bd2dba8c96a085
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48aa9bf7735f07e3d2961e36fc90344fd4f29291190452c38552c06243a9fe75
MD5 e21c8b096653047ffebb3f3050e9d537
SHA1 f63aa99e1b05900815002c312e31f962da9f598e
SHA512 372a9348a50f7ea15c365cdcca7828a12418bd2103ca02b80642d4c3e7fac2370bb3e218d61c976fa92a40f971701cdb5de96ed5f101dbc1c8ac4749da6e0797
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47137e61be0280c80946dc51395c998de58b5cb5733f32ba774c2fd6036615a8
MD5 c0e4c81dc83dec82baf368be314d6cf6
SHA1 2717c9bf8f46a6069c204d0bd55c703c0a556325
SHA512 55935314981647535a80bcf9b98a142384f5f4ee50352b619b855e422bf63fee1b292616b2d177551da52311107d414f84ad45e9e6d36bc96c431c0aef30c289
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6bb06e99f98d53e376883d4af4143731b10c0399f9b2747799f51b47e47b042e
MD5 f1081a5659ded5190087351c8badc456
SHA1 eed752dfef5c2581d9a18e6aafff85ed8ff5da75
SHA512 2b11d451fa4da8826f9add603aacfe29421a1f42f2087a87706c38f7a78db78806e0455b65cfc5f58f14c41b5c0c451ff1f80611013cad3ef2f71699787dd077
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7f56fbcaa76ae194912b44c6441b4088ad99a1b7fb468482ca9a493ed4083153
MD5 ab2e628856874d1b4dbcb2d887a10238
SHA1 1aa1aff987e018a906d890df265d36674d0bcbc5
SHA512 d7462e992eb7a6f32e5ad36f9cf28edb0da75b0409a1e2d33195b2f4274279fe6f05800b2d4e1638019a0bbb4beb451039cfd635b1276f0ec668a68b9b17c898
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABCCCABCCBCBBABACBCACBABACCACBBCBCBACBBCBCCACCCAAC.exe
Size 10.6MB
SHA256 12b583f02b21c8049aaa8c88106a4cbad4cc5a97f26aaa33e512304f2182bbcb
MD5 cb12393bf563aeea5e4773834da7cb7f
SHA1 14d3ad04f12b5ef924a83089fbb3689f358fd687
SHA512 3f1092a20968dd234fbc7bedbcc5c8288d4eb9143605c4ee0896a60a1a559f024a520f10a27d211a107f3e9dc122edd1623b19fcaf737d7e2428f74c48a39f22
SSDEEP 98304:gKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5aBKRuy5ayKjKWQcJ:gqgqgqgqgqgqgqgq0KWQc0gEYnvLD
TLSH
T142B6BF13E3D600B1E6B23530467FA3756D7EB7214634899E93940A7E5E32EC09E3876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3300-26-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/3300-39-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/3688-74-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/4092-67-0x0000000004A00000-0x0000000004A01000-memory.dmp

Download

memory/4908-0-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/4908-7-0x00000000008E0000-0x0000000000901000-memory.dmp

Download