c74bcbccaea09f89c9e3ed986b422ca5f8dddf8fc3185f67b3047ff38335337c

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
Size 10.8MB
Sample260818-crtrcsvwaw
SHA256 c74bcbccaea09f89c9e3ed986b422ca5f8dddf8fc3185f67b3047ff38335337c
MD5 4e34ce267f297101e671032c3281bc84
SHA1 25f6e6c9045456028a973e7f77baab4961dd0f03
SHA512 87f80ed9292b2f886fe5c3971b8469f1f4ed3733bf0aefbcd38227f9dfd21a7db999b41824ee0e7b95fe0a28cfa492bf2e93d6915ab0f9b6077ff87ec67310a5
SSDEEP 49152:U+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+ES+ES+Eg+ES+ES+ES+ES+ES+E2+ES+Ey:xKRuy5apKRuy5aRp7v
TLSH
T15EB65C09F94340B1D92B50B04DCFE3BF8A64BB2586128DF7FB4DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3980	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
3852	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
1408	svchost_BBACCBABBBBBBCACACABABABACBACAACBBACCCCABCBABCBCABABBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCAAABCCAAABBACBBBBBCBAACBACBCAACBCCACBBACBBACCCABBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACCBABBBBBBCACACABABABACBACAACBBACCCCABCBABCBCABABBCB.exe"	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCBAACBCBAACBBBABAAACBCBBCCBCABBCCACBABCACCBCBBCBCAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe"	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3920	sc.exe
1788	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5152	cmd.exe
6088	cmd.exe
1984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACCBABBBBBBCACACABABABACBACAACBBACCCCABCBABCBCABABBCB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1196	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
1196	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
1196	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
1196	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
3980	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
3980	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
3980	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
3980	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
Token: SeDebugPrivilege	3980	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 5152	1196	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe	92
PID 5152 wrote to memory of 2904	5152	cmd.exe	94
PID 1196 wrote to memory of 6088	1196	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe	95
PID 6088 wrote to memory of 3920	6088	cmd.exe	97
PID 1196 wrote to memory of 1984	1196	2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe	98
PID 1984 wrote to memory of 1788	1984	cmd.exe	100
PID 3980 wrote to memory of 5092	3980	svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_4e34ce267f297101e671032c3281bc84_darkgate_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAACBAAABACBACBBACBACABACACCBAACAABCCCABCBAABAAABCBABACCCAABBCAACACCAACBBCBAAACBBBABBCABAACBABCACCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAACBAAABACBACBBACBACABACACCBAACAABCCCABCBAABAAABCBABACCCAABBCAACACCAACBBCBAAACBBBABBCABAACBABCACCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBACBBACBBCBABACACABCBBBCABCABBCCCCCCAACCABBBCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe" start= auto displayName= "UserDataSvc_BCBBACBBACBBCBABACACABCBBBCABCABBCCCCCCAACCABBBCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBACBBACBBCBABACACABCBBBCABCABBCCCCCCAACCABBBCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe" start= auto displayName= "UserDataSvc_BCBBACBBACBBCBABACACABCBBBCABCABBCCCCCCAACCABBBCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBACBBACBBCBABACACABCBBBCABCABBCCCCCCAACCABBBCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBACBBACBBCBABACACABCBBBCABCABBCCCCCCAACCABBBCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
1⤵
- Executes dropped EXE
PID:3852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCBABBBBBBCACACABABABACBACAACBBACCCCABCBABCBCABABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCBABBBBBBCACACABABABACBACAACBBACCCCABCBABCBCABABBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 76b69a0e1129401bdfe2c3524d9fe4466d76b0f4331c848a96440bac64567f5c
MD5 0751ad9ace448a1c95996af401bc0947
SHA1 ad9876f4864bb06e1e1435fc14a28c65fbaa1182
SHA512 c5e4d2c94e727f8b3b6331a9cc801e456362d6377e6a21f4e3e28eabe9f39e36861ecd94e4b580f25f24b4c8017d68b3b0e4559a9376bd85680672c17c92f5fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 494237d1e6ecb66e87716891cbf96b07e6959282a5b314c7a3c45af1fbbe8e85
MD5 a77d809ddbc440a007cd23b89b713274
SHA1 9a182f913160f651f6f51bc6e81f3961fdcb7e87
SHA512 a427e6f3cc78dcfe0c400624005e6091c174c933519fd2e3bd7156e33116be37d775be6145988edf8e1e376a562e7b66be08559053fefc2aa20a7bede6a1ce63
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fced5ba1d8abf2864752e66e292cddeadf0a5ae0c26c70a01901ed0ef65753e4
MD5 85a1e0c41802c7b1674b51765c8ccd70
SHA1 26be4ab9ca7a8a33ef95ba83883d471d15ff9a09
SHA512 13b6320dced7b9378204da77bcff59938f0bc4e38cd2734501ab03a55607ad589cf9f0ad0e3579131d859cb3c129cdf5a430c35954bbd8466e6589b018331808
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8a4e436a4c3e22842fa7a900c2eb279ba74f42dccb587e9d2204ce4c4b49188
MD5 6e13baf2411192015327f9dfda4aacfb
SHA1 8eacf8d27c73da16c42d6bf8cb62a3e84b2af0a3
SHA512 f85711a53be9a3f8abed1925c1cf972dda104ce7c372b63a1a90d08d75919d7204df99f97f2f968373c824442e0e34922f66aacccc9e6b1a76a9207df4668495
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e37a8d5b19fe2a8baaa0199ac90063a725c87c52f479ba8c2d9d2ac295b67e1
MD5 0fd30e27b25ee89ff398813b8c4f62c9
SHA1 594d476023ecdec97419e953ebda384270681b89
SHA512 d31561bbe67d9b0365a24b3d33de9d273b1f0eb75e5dbee26fd4d0f5c66e5a5021f05d9a38bc031af0002ffa312305837a155b9ab879459a1f6d18008752e423
MD5 SHA1 SHA512

Submit Download

svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBAACBCBCCACBBAACCABCCBBBBAABACBABCCCBBCACBCABACBAB.exe
Size 10.8MB
SHA256 c74bcbccaea09f89c9e3ed986b422ca5f8dddf8fc3185f67b3047ff38335337c
MD5 4e34ce267f297101e671032c3281bc84
SHA1 25f6e6c9045456028a973e7f77baab4961dd0f03
SHA512 87f80ed9292b2f886fe5c3971b8469f1f4ed3733bf0aefbcd38227f9dfd21a7db999b41824ee0e7b95fe0a28cfa492bf2e93d6915ab0f9b6077ff87ec67310a5
SSDEEP 49152:U+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+ES+ES+Eg+ES+ES+ES+ES+ES+E2+ES+Ey:xKRuy5apKRuy5aRp7v
TLSH
T15EB65C09F94340B1D92B50B04DCFE3BF8A64BB2586128DF7FB4DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-6-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/1408-74-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/3852-66-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/3980-22-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/3980-35-0x0000000000320000-0x0000000000341000-memory.dmp

Download