34582eb0819b7e853f6eb33b1faff1c8bc498e32b0bfe9b157072ce08f285a35

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 9.8MB
Sample260818-dn2s8svelc
SHA256 34582eb0819b7e853f6eb33b1faff1c8bc498e32b0bfe9b157072ce08f285a35
MD5 877aa7b2e1bc9416c72f24d0a0c80bb9
SHA1 7aaea1cb5c5120dd1ea276365a048dc3bb47f3fd
SHA512 c0169b0705f3378ddef0a4f0304a3a7acd4e80be9a9a5cddf31e687cc2a50311d67885d787e385180d59113d93faee16c75e66bc67cdc708fed8910f55b1a8eb
SSDEEP 49152:U+ES+EWLxXpH+ES+EWLxXpH+ES+EWLxXpH+ES+EWLxXpH+ES+EWLxXpH+ES+EWL4:7OU/jIEeQfoR/IuOFVjUu5n
TLSH
T158A68E12B6C58431E5B301714DAB82BA8676BC215F318ADBB7CC722F6F31BC16931B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2480	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
4464	svchost_ABCCBABACBCABACCCCCBBBBABBCBACBCBABBCCBABACACACCABCACBC.exe
3748	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCAACBBAAACCACACCCBBAAAABABBABBCAABABABBCCABACBACBBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe"	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBCBAACBACABABBCBCACCBBBBBBACCBBCBCBCBABCCBCCCCCACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCBABACBCABACCCCCBBBBABBCBACBCBABBCCBABACACACCABCACBC.exe"	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3604	sc.exe
2712	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1220	cmd.exe
1656	cmd.exe
6140	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCBABACBCABACCCCCBBBBABBCBACBCBABBCCBABACACACCABCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5044	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5044	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5044	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5044	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2480	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
2480	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
2480	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
2480	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	2480	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1220	5044	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 1220 wrote to memory of 2308	1220	cmd.exe	94
PID 2480 wrote to memory of 2428	2480	svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe	95
PID 5044 wrote to memory of 1656	5044	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 1656 wrote to memory of 3604	1656	cmd.exe	100
PID 5044 wrote to memory of 6140	5044	2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 6140 wrote to memory of 2712	6140	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_877aa7b2e1bc9416c72f24d0a0c80bb9_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCCCBBABBAAABABCCCACCBBACABACABABACCAAAABACABBCBAABABBCACABAACAAAABABBCAACAAACBABCBCABABBCCAABAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCCCCBBABBAAABABCCCACCBBACABACABABACCAAAABACABBCBAABABBCACABAACAAAABABBCAACAAACBABCBCABABBCCAABAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABCBACACBACBBACACACBBBBCAABBACBAABBACCCBACCBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe" start= auto displayName= "UserDataSvc_ACCABCBACACBACBBACACACBBBBCAABBACBAABBACCCBACCBCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABCBACACBACBBACACACBBBBCAABBACBAABBACCCBACCBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe" start= auto displayName= "UserDataSvc_ACCABCBACACBACBBACACACBBBBCAABBACBAABBACCCBACCBCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABCBACACBACBBACACACBBBBCAABBACBAABBACCCBACCBCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABCBACACBACBBACACACBBBBCAABBACBAABBACCCBACCBCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABACBCABACCCCCBBBBABBCBACBCBABBCCBABACACACCABCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBABACBCABACCCCCBBBBABBCBACBCBABBCCBABACACACCABCACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
1⤵
- Executes dropped EXE
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcf77ba6323589f8ae89590620aa3118c9a99f60b66d3154a4f71ce3219d420b
MD5 49d3cc41965acc1342cc4ce275a810ff
SHA1 c641a9a16fd40950ab95610d7516b27d9bf5fb29
SHA512 c80e24170a449b6efa02eb4ac2f4cc45762b7ff245b98f3364a06e66b768e08fc051eb4365283b2a79e02e2897a492de6f8a40e51e17071da175db8e18acf51d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac5717029c9e4aed317b2c4299133dd033d26c64660614b2851839aa70e0f41f
MD5 c5f337f9d23f1c7d461c1a09f51f643f
SHA1 c38d09e3adbca470fbb60924db2a19d90eed745f
SHA512 b6d150336f35f99080bc184b57c489a5da611020d666f0aec6d3c272e3e7e146b2425b013ba8fb7196db0b6144790aef1406e727d6200384240460ac394c65d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 027db1102dd5c2f1d978fba95b54b68ff0935803e4e5102206094fc33bce236e
MD5 93c398e99b1822bbfdcdccea7c749baa
SHA1 69e1603346985e1e6048ed69ad2f06f665175f6b
SHA512 405fd3bda502544369b1c97329c8043b28da06508305e3bd1fa572c5dc2cd03c42fb4fb1c3d4086e382def9c54fb7b8d392052a14bb2e480a34d903a865d22a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33e699e500cc2324a4023ae44169f101a29079146c8633df9a24b73990400d38
MD5 60eea217da30c57d0d657d3f360414af
SHA1 bc4723edc06a3d17d03ce067fc49590fd8b17120
SHA512 0bd77bd564d33abb9d2a65692596b92d7d545834dfce96963129fd1e0c0c2836d84ad0f0b4dd2c9425b2558c3fe638371f36063a710fcb7481b1d43d54aefcff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 825b996d07b50207b744c8325d86982b3d4c24b741e18081263d60feff0eae5b
MD5 8d533f1b8719ba4fa12ce8badf92879a
SHA1 e13d9aec454fb26281a9691801f84dc44be78340
SHA512 65c20cbac64e657222d669f723b45a1b10fb2ced1e10d924c0de3cb26c6efad1ef8444727204896ff7e26197c56b8eaad87b65f7b18d3de58cfd2d211b4849a8
MD5 SHA1 SHA512

Submit Download

svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCACACBBCAACABCABCABAAAABBACBCABBACACAACABBABBBCCC.exe
Size 9.8MB
SHA256 34582eb0819b7e853f6eb33b1faff1c8bc498e32b0bfe9b157072ce08f285a35
MD5 877aa7b2e1bc9416c72f24d0a0c80bb9
SHA1 7aaea1cb5c5120dd1ea276365a048dc3bb47f3fd
SHA512 c0169b0705f3378ddef0a4f0304a3a7acd4e80be9a9a5cddf31e687cc2a50311d67885d787e385180d59113d93faee16c75e66bc67cdc708fed8910f55b1a8eb
SSDEEP 49152:U+ES+EWLxXpH+ES+EWLxXpH+ES+EWLxXpH+ES+EWLxXpH+ES+EWLxXpH+ES+EWL4:7OU/jIEeQfoR/IuOFVjUu5n
TLSH
T158A68E12B6C58431E5B301714DAB82BA8676BC215F318ADBB7CC722F6F31BC16931B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2480-24-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/2480-34-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/5044-0-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/5044-7-0x0000000000030000-0x0000000000051000-memory.dmp

Download