7f80ce1bbfbcaca9a3e1762b3f3043df5eaf7e924d146119e3d56118705d6b7f

Analysis

max time kernel
151s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe
Size 72.9MB
Sample260817-js3tzswdkf
SHA256 7f80ce1bbfbcaca9a3e1762b3f3043df5eaf7e924d146119e3d56118705d6b7f
MD5 387206e7d223c411dc2edef74647498d
SHA1 18c9f26ec6b375eee5d906f8cd88a099a9e2bb61
SHA512 946bb8661c5bbaf4445e0c7e9705c8629c0fd43be4cdb16153436a6910b85e2e4299215e251715220d9cc85fe7419e5946d573fe283c4e6392b2e0adfcd275b1
SSDEEP 1572864:i33333333s133333333s633333333s133333333shN:i33333333+33333333X33333333+333W
TLSH
T1D5F7E147FD8640B0EC7A25304CE7E2374936BE3AC425CA8EB9C97B096F33E61541B656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4728	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
5200	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
3428	svchost_BCCBCABBABCBBBACBBAAACCCCBBCCCBBBBCACAABCCAACAAAABCABCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAACBABCBAABBAACBABCBCAAACBBABCCBACBCCACCACBCBBAAAABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe"	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABBCBBAABACCBBCCACBBCCBCCBBCBBBCBBBBBAABCBAAABCAABBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCABBABCBBBACBBAAACCCCBBCCCBBBBCACAABCCAACAAAABCABCA.exe"	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1360	sc.exe
2288	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2308	cmd.exe
1340	cmd.exe
5464	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCABBABCBBBACBBAAACCCCBBCCCBBBBCACAABCCAACAAAABCABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5236	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe
5236	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe
5236	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe
5236	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe
4728	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
4728	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
4728	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
4728	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
3428	svchost_BCCBCABBABCBBBACBBAAACCCCBBCCCBBBBCACAABCCAACAAAABCABCA.exe
3428	svchost_BCCBCABBABCBBBACBBAAACCCCBBCCCBBBBCACAABCCAACAAAABCABCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5236	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe
Token: SeDebugPrivilege	4728	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
Token: SeDebugPrivilege	3428	svchost_BCCBCABBABCBBBACBBAAACCCCBBCCCBBBBCACAABCCAACAAAABCABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 2308	5236	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe	91
PID 2308 wrote to memory of 5568	2308	cmd.exe	93
PID 4728 wrote to memory of 2664	4728	svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe	94
PID 5236 wrote to memory of 1340	5236	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe	95
PID 1340 wrote to memory of 1360	1340	cmd.exe	97
PID 5236 wrote to memory of 5464	5236	2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe	98
PID 5464 wrote to memory of 2288	5464	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_387206e7d223c411dc2edef74647498d_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_r.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABACBAABCCCACCACBCBACCBBCBBACAAACBCBCCBBAABBABABCABBBAABBBBBCBBBBCBCCAABACCBACAABBBCCBAABBBACABBABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABACBAABCCCACCACBCBACCBBCBBACAAACBCBCCBBAABBABABCABBBAABBBBBCBBBBCBCCAABACCBACAABBBCCBAABBBACABBABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABABCAACCBABBBCBAAAABBBAABCACBBCCCACAAACBBCCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe" start= auto displayName= "UserDataSvc_ABABABCAACCBABBBCBAAAABBBAABCACBBCCCACAAACBBCCBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABABCAACCBABBBCBAAAABBBAABCACBBCCCACAAACBBCCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe" start= auto displayName= "UserDataSvc_ABABABCAACCBABBBCBAAAABBBAABCACBBCCCACAAACBBCCBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABABCAACCBABBBCBAAAABBBAABCACBBCCCACAAACBBCCBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABABCAACCBABBBCBAAAABBBAABCACBBCCCACAAACBBCCBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAABCCBACABCABAABCBBAABCBACBAAAABAABBAACCCBCAABAB.exe
1⤵
- Executes dropped EXE
PID:5200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABBABCBBBACBBAAACCCCBBCCCBBBBCACAABCCAACAAAABCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABBABCBBBACBBAAACCCCBBCCCBBBBCACAABCCAACAAAABCABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5355e464fb5aa63ddc17ccb97e02c6091519ed5f0e3feb8f2c70c54f258ff97
MD5 cc330b2fa53b0dbeba1316097cc7fad4
SHA1 63b3fd5dcc7ae99982807839786eac39a39005fd
SHA512 33cd1eef4e7cf7ca90451ec46ba6cc58fa8794ab0184081175a6128857d180736125c65d45a62eb237e0e630028f2c45c3ac1e9131c648c6947c7969857b41c1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 908f18f9c9a7a02a50fb94addb31610b6a01717355da58750e0173773fd615d2
MD5 e3140fb313fd0cfbe598a40318c02a7d
SHA1 610745d19058d5bf30a8dfa8eee181054a004ac0
SHA512 2cfb468ea7e150b6906ad67fe2e6fd400340826abdbe28dff229eb2e492e9698f2d44e8d985600a85cd59115a0366d12b49bd2243763f117572f3f0fc2f23b53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 487f6b238effb16447e72527c9703c44376fbcab548a330eb273dafa971028fb
MD5 353191d0a46d6e3ae059e21a17ce63d2
SHA1 4d4322b51c7aa4f63baace3203d86d420ee09542
SHA512 adb0a6cab239ea2935fc15577f0f5cc09f5ab998a35dd6654730b70be70904a1af696a9e1510d99e49bbd8476d0189f7ca7411351afb8fed1de6eb1d92be016c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 60bf507350756350869e193845a10712c9b071f1e0b5e190b6cd2dc5d937eb59
MD5 d4c29fc024ca9c8197fb36a550a43651
SHA1 43057fb477f1cd05d4c711ffdd3d245b8052269b
SHA512 71db23042676ec4de15da8ff69c78aef562f0574c8ece62a481672a1113e421720ca3d77bd75e030c5bb18358152078e838e5c075f7498242e2536c4a8144c36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0917a26ce2707ae42fc2ca5d0c7b0f43d9ab3ddbac79438650c78a8e9f0507f9
MD5 56b5af22520ee4db3717fb148e4a556a
SHA1 44b8f8c58698e48e2cbb33a443638838291a702a
SHA512 81323fc3f85f63ee5e9d0b5cbff2d644f53277193c8e762e3a401e74ee36ef3046e925955b6c0dc360df84bd7cd309f3936a8f2d2a3d38498e1a3c273930d79d
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 16b13f6bc8d10b26b575b6e0f5eedba724df4cf334b599593ae305bdd1e9d5d4
MD5 e4809170e1c3bffb02b61b0f18d5e075
SHA1 9750c6c5f362f23fb4ca41cef775bf8a67904a7b
SHA512 f134a7a09572c571b553ec9f9d722c1573f8b796cb050f89f6862ffe0ec7786095869379a0e58b90e6410a09a9a0d81e1976e8772e28c12cd8d32a5ba78ccfd8
TLSH
T1B411C453E8A5DC97FC332D9AA239DA420CA4378BAA5C7A1492444318BB45C358E154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4728-24-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/4728-37-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/5236-0-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/5236-7-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download