464280273a2765e1e9eb774d2cef2b589dda219c1cc658af983c24f948ddcc6b

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
Size 74.8MB
Sample260817-jp24aawcmd
SHA256 464280273a2765e1e9eb774d2cef2b589dda219c1cc658af983c24f948ddcc6b
MD5 7bd589d17e724474756eb4b8eea825d8
SHA1 75a51c47a5d814b3745850b93200e2d3abdf9f72
SHA512 dceed280e5cc194abd4d12a273660f2d482c25dc044a721e726323d638968b9a0bb3d92cd3686a5b20f7a707228a891cfc1b5700733e034d45b005fe7b7180d8
SSDEEP 1572864:i33333333s133333333s633333333s133333333sX:i33333333+33333333X33333333+333o
TLSH
T18208E146FD8680B0EC7A25304CE7E2374936BE3AC435CA8EB9C977096F33E61541B656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6564	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
4432	svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe
3692	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACABCBABCBABCCABABABBBACACABABCAAACBACBCBBAACABCAAABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe"	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBCBAAACBABBBCACBAAABACBBBBAACACCACAABCBACBBBBCBCCABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe"	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2016	sc.exe
6552	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2004	cmd.exe
4680	cmd.exe
920	cmd.exe
5876	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2204	schtasks.exe
3620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4468	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
4468	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
4468	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
4468	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
6564	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
6564	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
6564	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
6564	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
4432	svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe
4432	svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
Token: SeDebugPrivilege	6564	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
Token: SeDebugPrivilege	4432	svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4680	4468	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe	92
PID 4680 wrote to memory of 2204	4680	cmd.exe	94
PID 6564 wrote to memory of 5040	6564	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe	95
PID 4468 wrote to memory of 920	4468	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe	98
PID 920 wrote to memory of 6552	920	cmd.exe	100
PID 4468 wrote to memory of 5876	4468	2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe	101
PID 5876 wrote to memory of 2016	5876	cmd.exe	103
PID 6564 wrote to memory of 2004	6564	svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe	105
PID 2004 wrote to memory of 3620	2004	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_7bd589d17e724474756eb4b8eea825d8_amadey_coinminer_darkgate_elex_glassworm_hawkeye_hijackl.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACACCCABABAACCBABBABBABCCBACCCBBCBABCBCCABABAABBCBCBBCABBCACACABBBBCACBACABACBACBBCCCACABBACACACCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACACCCABABAACCBABBABBABCCBACCCBBCBABCBCCABABAABBCBCBBCABBCACACABBBBCACBACABACBACBBCCCACABBACACACCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCBAABCCACBBABCCABCBBBCBACBCACABBBBCCAAACAACBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe" start= auto displayName= "UserDataSvc_AACCBAABCCACBBABCCABCBBBCBACBCACABBBBCCAAACAACBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCBAABCCACBBABCCABCBBBCBACBCACABBBBCCAAACAACBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe" start= auto displayName= "UserDataSvc_AACCBAABCCACBBABCCABCBBBCBACBCACABBBBCCAAACAACBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCBAABCCACBBABCCABCBBBCBACBCACABBBBCCAAACAACBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCBAABCCACBBABCCABCBBBCBACBCACABBBBCCAAACAACBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6564
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCACABBABBBCABCAAABBBBCABABACBBAACABACBABBCABBCBACABABABBACACACCCCAACCABABCACBACACCCBCCCBAAAAACCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCACABBABBBCABCAAABBBBCABABACBBAACABACBABBCABBCBACABABABBACACACCCCAACCABABCACBACACCCBCCCBAAAAACCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCBCBAACCBCACCCCCABAACCABCBBBCAABBCACAACACCABCBBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAACCAAAACAACBABCABACCBCACAACBACBBBAAABAAACBABBBAABB.exe
1⤵
- Executes dropped EXE
PID:3692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f8217b3bc73e5abebd97b33ec225adc61b6947f4b52e35aa2a82b393e5df168
MD5 8b63043301999a5b22ce8c582272c580
SHA1 44a79eb8bc463fcf8600ea95963a271559d50285
SHA512 9941fd7177d2514072f8a65bd00e93bb426a2421cc6016b44eb20dc8b4d6b80c7c6ee654da30e0219a0efc663d85eab52a2c6b55b7fde78a725ac3d9fa07d68d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 66c4ebc533e672b76702cf62606aada8f360169a838eda01cfbfcf42fc2b0bb1
MD5 2ac6159072df69f7961f76285b939f47
SHA1 ca40860f755cff6cf402ee94de615d532b253b90
SHA512 517aab7dd0df0bba0733f7a1ad759fe649002516302961b7ff8e61bf92f3fbdcd506b16319d2b489987236470ab4cb2b74f9e448a73c26798b7658b670e23037
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d399b504082d04989f30836e22b10d68bb6679b301f3ce3813a56ed9ee015b20
MD5 5a10e150ca2bc512afe8d6fd6bbb0be5
SHA1 f4d38a3e7cf2cf4c26b33fec927b7784d12a5393
SHA512 d18d2cc48eb8b6b719f39deb23bd44b82ccadce1d3ce65132005cb96d1a6bcddf4fb9f231cbf1188a60fb6a3447d0bd8b73a0bee522ed9b5c2ce46d48537ec20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 80036dc91967fcb0a0ca553306f3961214d0254ecc83191db3a1cff1d10bee86
MD5 31ef048f96d03f3b70e98cca0eac1dc6
SHA1 afb9b5e2dcc1f4da1f0f12b095e19278cce76d80
SHA512 b6b8d597364613b05da000aa33d429d13b3849fbeea76125ee1d42428b64814230da9bb15a2b9622a6d738ece77ca3e8c478682920701d22d993a2b1468be1e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eefeac3f99a086c43e3c881287478c5142413cebb38af7660fc1ded8d106db7f
MD5 1b4712e1c6b1a2a93a04860de33e57fe
SHA1 c190fdceda868488f47fcdbd115f216208e2501c
SHA512 b483860e1a3d1b34b11a4b346497fa38425a6bc076fd93f59aa3f9b770135ca9bdb5049c4aefc61b8af5699b66776411da60ad4f39bee67668bb29cdadd1d0b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f0d9725e1662a33af2315cd54d63326030cf39ae93a20a58d3d40d1aa21b8e2
MD5 92fdcb45d79ad76e79bd8bd18bd78312
SHA1 9d4f9bb66187ace6de944061941cb3b0b6460d41
SHA512 a0e148430ff35a8d8a4e8b3ce83cf9da7cb5c573c9ca599bce0bc91ea3fe21ff37d59daf1c4a6b068c17e392f01d0a3cf2973b77350ab8c9c609d1b65567ff7c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ad7aa2348d202e62cb739d70d9f8cddddaeade1c9ebc37826645d6656ba4f808
MD5 b8c3e7f1161fee2c1db06e21bd372853
SHA1 b53de10cbe2290839c99b34f246f35a398c6f17e
SHA512 59300df810751949512cb9db0997eadc43fcd64831da43e051943348727cdcd55f8c493b802ace282972bb14aa13a400d573e22c2f5b849f30274f469c167aef
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e1cc90a61b25992a83a15a57d5d1b6e9256af69e357e14c3b5c5d04cb085424c
MD5 4c0887617ba5d20284403810d70899fd
SHA1 46b70c03e2ae86d8afd79870f0f69ed2f969868a
SHA512 e90c71e52a4c99fd8f099780af7dd4bcd81ada5319defe706c9c693cd9c4000fa2687f45d709559939765ce18de527dd6121be3cfe9890a693675e56459071ae
TLSH
T1AD112E61BCD5CC23F932698B4A2D9B830CE4356FED5C6A046388821D6B94C314D194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 34be8f81707d7dd780a7fc63e92091e2cfb82cea302cb56062243ff1180c347e
MD5 ad750af90d06c0cf64ae18a64bf1b017
SHA1 2c591b9512d5fe7c3daa5e2bed1f1b63d7e5c2f9
SHA512 6b3410c44eba5f6c318824b2b56da589eb549bc8676c178925d455e6ff61328448c4910f9f93176b1509cc31e14f89b2e293ee88a84db25cd9c2065e38ed781f
TLSH
T1D2112E61B8D5CC73FA22A9CB4E2DAB920CE4356FDD5C6A04538C82197FD4C31CD094E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3692-73-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/4432-69-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/4432-87-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/4468-6-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/6564-33-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download