c74bcbccaea09f89c9e3ed986b422ca5f8dddf8fc3185f67b3047ff38335337c

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
Size 10.8MB
Sample260818-crtrcsvwaw
SHA256 c74bcbccaea09f89c9e3ed986b422ca5f8dddf8fc3185f67b3047ff38335337c
MD5 4e34ce267f297101e671032c3281bc84
SHA1 25f6e6c9045456028a973e7f77baab4961dd0f03
SHA512 87f80ed9292b2f886fe5c3971b8469f1f4ed3733bf0aefbcd38227f9dfd21a7db999b41824ee0e7b95fe0a28cfa492bf2e93d6915ab0f9b6077ff87ec67310a5
SSDEEP 49152:U+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+ES+ES+Eg+ES+ES+ES+ES+ES+E2+ES+Ey:xKRuy5apKRuy5aRp7v
TLSH
T15EB65C09F94340B1D92B50B04DCFE3BF8A64BB2586128DF7FB4DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4200	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
2560	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCCABCCBBCBCCABBCBCABCCACCBABCCCABCABACCACCCAABBBACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe"	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAABCCABCBBBBCCBBCCBACABACBCBBAABBABBACABCABCBCAACCBAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCBAACCCACAAAACAACABBBBCCCCCCBBBAACCCACBBABBCAABCCBC.exe"	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3836	sc.exe
4692	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4384	cmd.exe
4612	cmd.exe
992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4116	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
4116	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
4116	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
4116	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
4200	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
4200	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
4200	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
4200	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
Token: SeDebugPrivilege	4200	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3388	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 992	4116	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe	95
PID 992 wrote to memory of 680	992	cmd.exe	97
PID 4116 wrote to memory of 4384	4116	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe	98
PID 4384 wrote to memory of 4692	4384	cmd.exe	100
PID 4116 wrote to memory of 4612	4116	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe	101
PID 4612 wrote to memory of 3836	4612	cmd.exe	103
PID 4200 wrote to memory of 2064	4200	svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe	105
PID 2064 wrote to memory of 1088	2064	notepad.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBACBCACBCBAAAAAAACBBACCABACBCBABCBCABBCBCAAAACCBCCBACABABCBCCBAACAABABCBBBCACACCBABCCCBBCBCBBCAAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBACBCACBCBAAAAAAACBBACCABACBCBABCBCABBCBCAAAACCBCCBACABABCBCCBAACAABABCBBBCACACCBABCCCBBCBCBBCAAABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCABABBAABAAABAACBCBBBCBBABBBBABCACBAABACCCCBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe" start= auto displayName= "UserDataSvc_BCABCABABBAABAAABAACBCBBBCBBABBBBABCACBAABACCCCBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCABABBAABAAABAACBCBBBCBBABBBBABCACBAABACCCCBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe" start= auto displayName= "UserDataSvc_BCABCABABBAABAAABAACBCBBBCBBABBBBABCACBAABACCCCBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCABABBAABAAABAACBCBBBCBBABBBBABCACBAABACCCCBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCABABBAABAAABAACBCBBBCBBABBBBABCACBAABACCCCBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18d5d85e239a86c424f736524c38bec99fe2e015f9af9fa94cbbd5d463ea66cd
MD5 7bb009dead9d3e9aa1cc3c5c21ad94f6
SHA1 47a85078df8e9d3ff65f413c0a6e0a5fdbdd1fda
SHA512 06dabb0e3bc19bd5436a2a5eca47c38d4b74ae4624d0309b772121646965c8020073bb3cfe2e2f20e01a04cc997be329d8d013da7150f79bcba1fc5281ed1193
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 800f261e05040bf9bf2f6d689e8b60b17e5c74d0218d9580df1ee26511488e3d
MD5 65818a967e3a4a46b3dc9d3fbfbde7f6
SHA1 fa64a32c23b5238b2715e5b2987a449b93d6c8cd
SHA512 3c1b27b7a1a3ddc4b87636445fefcbffe22f7f4dd97486b85d7acb40e2e056b247519f73c378e941aa5fdc371467ee33738e8475a3ee7f03f8fdc73c3c8d9552
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1b61e43413e6883682896b64784066103158bd0f9acba4bfdd3e392c56f861e9
MD5 e1f67084518702202c57ac8688605b7e
SHA1 a7dab2aa8cbb42da3217947a95ed13530e0079a0
SHA512 69fd0a191183b5e34d0cc97f38ef2729d3380929b6613e831f8f93707b51508510e89d6ccdd1980770d158a74fedb5a96b5144974626cdcfca7a88875c1d9e78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1c30035821b724b5105fc3e44e4ef79575dceef35ff1f012661fc34172474544
MD5 7a45058e401aa4b8b5e13119433e7c34
SHA1 63d026c0570e376b1b0642b135823dc75ab06353
SHA512 a7c60b18c45f5eddbd72ad655c1c359b6b8c8834477da27071dd0a9b9492f6a22281d05e072a35a620264cc5f0f19a96299e4d0cd0c2530b8413f28b31737a4c
MD5 SHA1 SHA512

Submit Download

svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBBAABBBCCBBCACCBBACCCBCAACCBABAACABCCCAABAABBABCAAC.exe
Size 10.8MB
SHA256 c74bcbccaea09f89c9e3ed986b422ca5f8dddf8fc3185f67b3047ff38335337c
MD5 4e34ce267f297101e671032c3281bc84
SHA1 25f6e6c9045456028a973e7f77baab4961dd0f03
SHA512 87f80ed9292b2f886fe5c3971b8469f1f4ed3733bf0aefbcd38227f9dfd21a7db999b41824ee0e7b95fe0a28cfa492bf2e93d6915ab0f9b6077ff87ec67310a5
SSDEEP 49152:U+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+ES+ES+Eg+ES+ES+ES+ES+ES+E2+ES+Ey:xKRuy5apKRuy5aRp7v
TLSH
T15EB65C09F94340B1D92B50B04DCFE3BF8A64BB2586128DF7FB4DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2064-68-0x0000000002E20000-0x0000000002E21000-memory.dmp

Download

memory/4116-0-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/4116-8-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/4200-27-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/4200-40-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download