683011fbd94b2a723d53414f5ff88bc6e1bb3ce2cb669444cb5badf332af368f

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 18.5MB
Sample260818-dx8cdadn2w
SHA256 683011fbd94b2a723d53414f5ff88bc6e1bb3ce2cb669444cb5badf332af368f
MD5 4e30ae894842d19b0bccf043401666ee
SHA1 0402e496e05f68a3cd994ea0c5ab14101bad2db4
SHA512 fecd913a6ea28135525d404ba5e5caa815a6f9de3f554745ef930935c27d6c3f2e5523744fedf9efd2160f9879aefdf3d52cf2cf7e9fa320d23cefcae81587bb
SSDEEP 393216:n5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nYcZEIvC:n5S5S5W5S5S5W5S5S5W5S5S5W5S5S5WQ
TLSH
T1A3177D19B7E61121FAB37A7088BAD3F66D397D204734C6AF5600A61D1D329D0E83D72B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3316	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
784	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
4452	svchost_BBBBCABCCACBACBBACCABACBCCCAACBBCCACAACCAACCCCCAABAACCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCACBCACCBAACCAAAAABCCBCCACAABBAAACCBCBCCACCCCAABBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe"	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCABBCAAAACAABCCBCABBBBCABABBCCBCAABACACBCBACAABCCBCBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCABCCACBACBBACCABACBCCCAACBBCCACAACCAACCCCCAABAACCB.exe"	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2804	sc.exe
1520	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4568	cmd.exe
4636	cmd.exe
944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCABCCACBACBBACCABACBCCCAACBBCCACAACCAACCCCCAABAACCB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1576	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
1576	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
1576	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
1576	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
3316	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
3316	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
3316	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
3316	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	3316	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1292	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 4636	1576	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	105
PID 4636 wrote to memory of 2760	4636	cmd.exe	107
PID 1576 wrote to memory of 944	1576	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	108
PID 944 wrote to memory of 2804	944	cmd.exe	110
PID 1576 wrote to memory of 4568	1576	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	111
PID 4568 wrote to memory of 1520	4568	cmd.exe	113
PID 3316 wrote to memory of 988	3316	svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe	115
PID 988 wrote to memory of 4612	988	notepad.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBCBCCCACBBCABBACAABBABACCAAAACCBABBCAACCCCABCACAAAACCBCABCAABBCCBCCCBCBCBCCBCAAABCBBACCCBABBCACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCBCBCCCACBBCABBACAABBABACCAAAACCBABBCAACCCCABCACAAAACCBCABCAABBCCBCCCBCBCBCCBCAAABCBBACCCBABBCACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCBCBAAAABCABCCBCCAABABACACBCCCABBAABBBBCBBCACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe" start= auto displayName= "UserDataSvc_BABCBCBAAAABCABCCBCCAABABACACBCCCABBAABBBBCBBCACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCBCBAAAABCABCCBCCAABABACACBCCCABBAABBBBCBBCACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe" start= auto displayName= "UserDataSvc_BABCBCBAAAABCABCCBCCAABABACACBCCCABBAABBBBCBBCACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCBCBAAAABCABCCBCCAABABACACBCCCABBAABBBBCBBCACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCBCBAAAABCABCCBCCAABABACACBCCCABBAABBBBCBBCACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
1⤵
- Executes dropped EXE
PID:784

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCABCCACBACBBACCABACBCCCAACBBCCACAACCAACCCCCAABAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCABCCACBACBBACCABACBCCCAACBBCCACAACCAACCCCCAABAACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4f63105182d03dd801cc6ddf4ce9f77e5f84c2710f3d18abcfaa3a410ebe35e
MD5 7058c5b35dd9d20805ea37f08072d59e
SHA1 a867d5782ebe48bfb91540273a57c4fd59c31e8f
SHA512 d1dd0d6da29c312a0242ead72a57a4f257f17a457de7737e30668857a9e37ee48a90e7dde1b843ccf126f50f70668f01d8f51343870ce5f3a42c7891ec08cd04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c237c6513ea1c7228880e0e4e652af48ff0994e92ae2b1e7df80c1bff9e42e1c
MD5 e325c194249f69438dc195986fcab7bc
SHA1 342614381811513de987d7ae4680859d7c14266d
SHA512 a84308e7f0ca9dee819f41b9083fbdc4b5b24b6f5f3a6dc543a120da8c50de1f8c97d1d72f555bb1eefa5f34f90aa6dad2a1f40a52a41c982fe2c2add99ee33e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12cdec340c562199b7c8af6bb1e94c180d5b6a6ea074655954d3b693fdf960de
MD5 85b93fb9b6ecf5c8c0690b3310897edf
SHA1 57792b837439bd7a3299c97ecd4810ac76b5dd01
SHA512 f490131e4686e343411c04af5c02dd10837b9edf348bf2f2834bfc4bd6297943cd8153a3ba7c673e0e4199ca743e686fc0858eb00f0188a77fece37f5950a008
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cac4391cbd06d31362cc125a07531933cdc51d680b62f342213b0aedff9997ac
MD5 02075b784d7d7f4a70e6a5036db2c143
SHA1 8c6647b2b8269f35ccce90baeb63ba8a63413fb1
SHA512 d5a5ee8c112567332df9d4dd2c1a94eb0dc383b3a0b2d705e77bb6ab4ab43acf02edf32c8ec0397c56f77f420d6b7bef22f3ca9f6090d28786a8a99cf8c5d743
MD5 SHA1 SHA512

Submit Download

svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAAAABBBACABABCBABBBCBCBAAAABABCACABCCBCCABAAAACBCC.exe
Size 18.5MB
SHA256 683011fbd94b2a723d53414f5ff88bc6e1bb3ce2cb669444cb5badf332af368f
MD5 4e30ae894842d19b0bccf043401666ee
SHA1 0402e496e05f68a3cd994ea0c5ab14101bad2db4
SHA512 fecd913a6ea28135525d404ba5e5caa815a6f9de3f554745ef930935c27d6c3f2e5523744fedf9efd2160f9879aefdf3d52cf2cf7e9fa320d23cefcae81587bb
SSDEEP 393216:n5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nYcZEIvC:n5S5S5W5S5S5W5S5S5W5S5S5W5S5S5WQ
TLSH
T1A3177D19B7E61121FAB37A7088BAD3F66D397D204734C6AF5600A61D1D329D0E83D72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-89-0x00000000053F0000-0x00000000053F1000-memory.dmp

Download

memory/1576-23-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/1576-25-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/1576-36-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/1576-0-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/1576-64-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/1576-12-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/1576-5-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/3316-37-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/3316-55-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/3316-78-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download