1238daf7882eee84e4a4e669dd2082aa1caed722e6a13407dcd91c5d05e983ed

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 18.8MB
Sample260818-dfdfnsdk6s
SHA256 1238daf7882eee84e4a4e669dd2082aa1caed722e6a13407dcd91c5d05e983ed
MD5 b404b388bbf51b49056093e3611b461c
SHA1 ff1338ef6c59fb6304f91414a1f82d0d7c610d8f
SHA512 463eac157feb67905e42aee3c6dd8ae7a2e6d3e619fbc23a677ee0aa0e39b2bcfe9ee67e551503fee9ed78c4caf75b8790880b509f9dbb46285ccfffb35cc0ab
SSDEEP 393216:pO4q78UhasRO4q78UhasRO4q78UhasRO4q78UhasRO4q78UhasRO4q78UhasRO4c:Qhas4has4has4has4has4has4has4hax
TLSH
T159174B2CBD9441B6D4728671C8E6E6EDEA3179126B004ECF61D6534E4E3BBD26C30E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
7128	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
592	svchost_BBACABAAABCACABAACBBACACCCBBBAAAACCCBBBBBCCAAACAAACAAAA.exe
5904	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBACBCABCCACBBBABACBBBBBCBAACCCAAAACACBBCBCABACBBCBCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe"	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBBCCAACBACBBBBBABAABBCBBCAABCBBABBBACBCAACBCACBBABACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACABAAABCACABAACBBACACCCBBBAAAACCCBBBBBCCAAACAAACAAAA.exe"	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6704	sc.exe
2584	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
976	cmd.exe
6812	cmd.exe
5368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACABAAABCACABAACBBACACCCBBBAAAACCCBBBBBCCAAACAAACAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6952	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
6952	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
6952	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
6952	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
7128	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
7128	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
7128	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
7128	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6952	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	7128	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6952 wrote to memory of 6812	6952	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 6812 wrote to memory of 4260	6812	cmd.exe	94
PID 7128 wrote to memory of 3816	7128	svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe	95
PID 6952 wrote to memory of 5368	6952	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 5368 wrote to memory of 2584	5368	cmd.exe	100
PID 6952 wrote to memory of 976	6952	2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 976 wrote to memory of 6704	976	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_b404b388bbf51b49056093e3611b461c_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACBACBACABAABABCACCBBAAACBABBCBCABABBCBBCCABAAABBCBCABABACACABCCCAACBAABCBABBCCABBACBBBCCBAAABCACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACBACBACABAABABCACCBBAAACBABBCBCABABBCBBCCABAAABBCBCABABACACABCCCAACBAABCBABBCCABBACBBBCCBAAABCACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABBACACBCCCCAAACCCCCBCCACAAACBBACCABAACACCAAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe" start= auto displayName= "UserDataSvc_AAAABBACACBCCCCAAACCCCCBCCACAAACBBACCABAACACCAAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABBACACBCCCCAAACCCCCBCCACAAACBBACCABAACACCAAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe" start= auto displayName= "UserDataSvc_AAAABBACACBCCCCAAACCCCCBCCACAAACBBACCABAACACCAAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABBACACBCCCCAAACCCCCBCCACAAACBBACCABAACACCAAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAABBACACBCCCCAAACCCCCBCCACAAACBBACCABAACACCAAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7128
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABAAABCACABAACBBACACCCBBBAAAACCCBBBBBCCAAACAAACAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACABAAABCACABAACBBACACCCBBBAAAACCCBBBBBCCAAACAAACAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
1⤵
- Executes dropped EXE
PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f13b053f08610d679094a0341ef1df884cecfba4208e8c4e467d3ec57f38d5b8
MD5 4530e72fd24c98254e4af509b5a0825a
SHA1 f40a0abb2655d67c2b7859bebb6caaf030ea3272
SHA512 b807f466db4b442d97045c568c534d7f5bf8e61cf8349434e968293e105893fea01e6d634c670addea59edf282a440f4adf377885569a99463c8de403152f0e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1aa788edeec2dbf8e5a9aac8d30d25eaa0b4fa43910274d1bd008ee031bf232
MD5 37f8d246e9d3b02bbaf281739ed4ca1d
SHA1 6a0c7dca52b890e8212fe1815dec2d5cbaa63dde
SHA512 a3a788b1a87c4ad7e5b742bf1d8bd174cc076cd10dcdb457ee22e53943058861788576f3fc563f4c33e450493891e3c27655e99e349242c990a6d946a3790f40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d0b741807fbbf3652e304de6c5565e6ddcb76adeb1ba56079a55c2bcd80f52b8
MD5 33e291e3ffc797c09182855d6fa95ce3
SHA1 745f7b997f38cdb91a6fabb7f686cd532c8a4feb
SHA512 aa4299d6d21c4f820a9a24e32ec07d4aa16d6407540c4fd6534a58eb19b58eb56c8642e6a30584892f5ac8ebd73189ce7f6885bae36816fed9daf9d3f1b7a2da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac35c58db9b05201bb60818628c10444c61433b7dc804c0b3c22c360341a2d7c
MD5 e722d298da7735c04d76dee29538edfa
SHA1 ec8baa00fa63bdf5bb91ed535edf073f48b1b6ab
SHA512 1c624d1bc6df38a2acbebd127895fcffa6182f8722e674de2e2a8013c7cf81ee110fe6bcfc243584016ca247eb1d49392f2ceef27533804e1e2ac51c907722b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7640099dd572aec9a07ad0fde1fab6a0fdedfc1ffbcf726598c7f55ceb025103
MD5 2875b3d6d5699830176eb8c43bfcea0c
SHA1 37ffbcc55456ac4f93d7712ed78e2d77454239c4
SHA512 d98ac6b55028b245d6966c8ea11f88fa24797feffd3ff5ba32783403ce3008168c51a0fd2e163cb6ccacf0891d8ce916cef091d602324ddfd45b1e1107670654
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a7b438d6c9b857cf1ea58a8c5438738d23dbd4a124e69a9a82a099fbdfb8422
MD5 87fea5ff06d7683fe4bd492ca032c73c
SHA1 88470c7f7217dab54ab4eec03fa488e27f44c8a0
SHA512 0c18c585fc3c186338f71aa18b028c49bfcb79fabe32073347b929f04b661381ffb01f3cd846d99d3c01bb786929c6e16a00a44c1b9ebe0fcef2cbd70d4eff64
MD5 SHA1 SHA512

Submit Download

svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBBBCCBACBABABACACCCBAABABBBBBABABCCABABCACACACACCB.exe
Size 18.8MB
SHA256 1238daf7882eee84e4a4e669dd2082aa1caed722e6a13407dcd91c5d05e983ed
MD5 b404b388bbf51b49056093e3611b461c
SHA1 ff1338ef6c59fb6304f91414a1f82d0d7c610d8f
SHA512 463eac157feb67905e42aee3c6dd8ae7a2e6d3e619fbc23a677ee0aa0e39b2bcfe9ee67e551503fee9ed78c4caf75b8790880b509f9dbb46285ccfffb35cc0ab
SSDEEP 393216:pO4q78UhasRO4q78UhasRO4q78UhasRO4q78UhasRO4q78UhasRO4q78UhasRO4c:Qhas4has4has4has4has4has4has4hax
TLSH
T159174B2CBD9441B6D4728671C8E6E6EDEA3179126B004ECF61D6534E4E3BBD26C30E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-65-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/6952-0-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/6952-8-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/7128-34-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download