683011fbd94b2a723d53414f5ff88bc6e1bb3ce2cb669444cb5badf332af368f

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 18.5MB
Sample260818-dx8cdadn2w
SHA256 683011fbd94b2a723d53414f5ff88bc6e1bb3ce2cb669444cb5badf332af368f
MD5 4e30ae894842d19b0bccf043401666ee
SHA1 0402e496e05f68a3cd994ea0c5ab14101bad2db4
SHA512 fecd913a6ea28135525d404ba5e5caa815a6f9de3f554745ef930935c27d6c3f2e5523744fedf9efd2160f9879aefdf3d52cf2cf7e9fa320d23cefcae81587bb
SSDEEP 393216:n5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nYcZEIvC:n5S5S5W5S5S5W5S5S5W5S5S5W5S5S5WQ
TLSH
T1A3177D19B7E61121FAB37A7088BAD3F66D397D204734C6AF5600A61D1D329D0E83D72B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4572	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
1852	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
960	svchost_BCABBCBAABACCBCCBAAACBBBBCBAAACCABCACCABAACBCBBCCCCACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCAACCCBABCCBACBCBAACAAACCAABCAAACCBCCBBBACABBCBBACBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe"	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACAABBBAABAABACACBCCCCCBAABAAAACBABCABAAAAABAABABCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBCBAABACCBCCBAAACBBBBCBAAACCABCACCABAACBCBBCCCCACAB.exe"	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3544	sc.exe
2152	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
792	cmd.exe
3348	cmd.exe
6136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBCBAABACCBCCBAAACBBBBCBAAACCABCACCABAACBCBBCCCCACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6016	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
6016	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
6016	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
6016	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4572	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
4572	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
4572	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
4572	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
960	svchost_BCABBCBAABACCBCCBAAACBBBBCBAAACCABCACCABAACBCBBCCCCACAB.exe
960	svchost_BCABBCBAABACCBCCBAAACBBBBCBAAACCABCACCABAACBCBBCCCCACAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6016	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	4572	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
Token: SeDebugPrivilege	960	svchost_BCABBCBAABACCBCCBAAACBBBBCBAAACCABCACCABAACBCBBCCCCACAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 792	6016	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 792 wrote to memory of 4836	792	cmd.exe	94
PID 4572 wrote to memory of 1180	4572	svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe	95
PID 6016 wrote to memory of 3348	6016	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	96
PID 3348 wrote to memory of 3544	3348	cmd.exe	98
PID 6016 wrote to memory of 6136	6016	2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	99
PID 6136 wrote to memory of 2152	6136	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_4e30ae894842d19b0bccf043401666ee_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABABCBBBAACACCABBCBBCABABABCCBACABAACCCACBBABABBCACBAABABACABCABCCCCBBABABBCBCCCACBBCBABCAACBBACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABABCBBBAACACCABBCBBCABABABCCBACABAACCCACBBABABBCACBAABABACABCABCCCCBBABABBCBCCCACBBCBABCAACBBACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBBBCCAAAACCBCCCABCCABBCBBCCABACACBCCCCCABABCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe" start= auto displayName= "UserDataSvc_ACCCBBBCCAAAACCBCCCABCCABBCBBCCABACACBCCCCCABABCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCBBBCCAAAACCBCCCABCCABBCBBCCABACACBCCCCCABABCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe" start= auto displayName= "UserDataSvc_ACCCBBBCCAAAACCBCCCABCCABBCBBCCABACACBCCCCCABABCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCBBBCCAAAACCBCCCABCCABBCBBCCABACACBCCCCCABABCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCBBBCCAAAACCBCCCABCCABBCBBCCABACACBCCCCCABABCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
1⤵
- Executes dropped EXE
PID:1852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCBAABACCBCCBAAACBBBBCBAAACCABCACCABAACBCBBCCCCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCBAABACCBCCBAAACBBBBCBAAACCABCACCABAACBCBBCCCCACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54dd1cbc40897af2e05a1a65743ecfa1c4d103e4b917b8646d6441fd13820c79
MD5 42b2d6f17682dba580f4efd21202f504
SHA1 aba57545cff9542722795adabec86e4d63e19350
SHA512 549198f5983f8bf4f59fdddc6b3f8224d1147f53ed87b608633c1e92d4678ec8a714f1c68d082e79023a5c3ad6a5ae812298a7f8d614f45ba45a5cd959b1bf73
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ee03e79028055fe0101dc997d1f8aa342c5e5f1a6e362adace7603866ca31440
MD5 270ef0b7ecf9959d1cfaca05c619d881
SHA1 944e61e85386e847d7805b463718723754686102
SHA512 77fdf1bdb4eb41e600e3eb60f3823ee70845c6e3007ad703cda9dd6c3d060553018fe9f2f3dca6b5f29e2bd917baad963c1d247b8eb4a0ed2dacd64e92c28e38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 62e434215626af86cdf9eb5e758a7231b6d0850a3acfc50430c3b71e361b774e
MD5 95fd08f7e6bd76fa467f0db24ef5af4c
SHA1 4af90d99081da140360c117a57eea2d481bb1bc3
SHA512 01bd11847e1f50cbad8a317116c042a102a7ae7c15321cc259a67081d0fafe50ffc4e97ea6448fdf2d1f01a633cf8fa6a1534b7972a4e777eaea4b9075779a0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 03d074dbf50d15caa635d5bf99bbd2165732dae7bbde5f9ee80f15750f42e26b
MD5 10748e62a69fad9f64bf0f6d1f0a485f
SHA1 67ca053429561e2259fb63cc59a264fddd40fb6a
SHA512 2ec0fb6f18ad31b7d71328f05b265025beff628926a99fb6596489fcfb4b618addadd8fb6bd87845bc2d7d52cfcef5dd5f5864d2f17b389390a1947b823892fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b25b0188eb641a80da244713cf037122124d66b8e360f98813d084ae9748229e
MD5 646ec19d9c9195cc3c550a2032554f5b
SHA1 e4bd168d5ad6d8bac5d77d99bc5abf92c38e90d2
SHA512 4dcc2ef5bd2d8ae918dc91993a5f3338be82e37402f0545c4a554e07a0a3e29bbc9656c9c401a879dffdf310ebb395addea53c70041c7d3d99dc998439bc7ce2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b2158ef9e57ef9afaf0552ceb207cb1c84bf4ce1cb407e491c0ee1b9709d9f58
MD5 7364e0b1e7c685eb3e187924b619be11
SHA1 171e0b98c5d45de4bbf332c137f2d453ad3e7e1f
SHA512 cb080fccda072b9972219fd7b6910cc1390d870465574acb7897e19f91532e598e56dfbccaccb53c92e1a5dd1f8053701112212eba235ded777c8441f9ed55bc
MD5 SHA1 SHA512

Submit Download

svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCABBBCACBBBBCBCBCBCACAABAABBBABCCBAABBBBACBCABCAAA.exe
Size 18.5MB
SHA256 683011fbd94b2a723d53414f5ff88bc6e1bb3ce2cb669444cb5badf332af368f
MD5 4e30ae894842d19b0bccf043401666ee
SHA1 0402e496e05f68a3cd994ea0c5ab14101bad2db4
SHA512 fecd913a6ea28135525d404ba5e5caa815a6f9de3f554745ef930935c27d6c3f2e5523744fedf9efd2160f9879aefdf3d52cf2cf7e9fa320d23cefcae81587bb
SSDEEP 393216:n5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nW5S5S5nYcZEIvC:n5S5S5W5S5S5W5S5S5W5S5S5W5S5S5WQ
TLSH
T1A3177D19B7E61121FAB37A7088BAD3F66D397D204734C6AF5600A61D1D329D0E83D72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b0791dded38dc5898d546eb69881d865f201dbfcb90ab882ce4d24c640207176
MD5 71696aaf9b63946ccae85e15069b135a
SHA1 09808542d2e8507cb7f5cb25d9c8b85bfeb2b61b
SHA512 4319f93e39e6e23bf6964face9cf82bb39c8cd00f4c53eb64a8d26e7abc553bbd10cb92002dd04638ae2de9336eac12f339e02a89bc6d3e40dfcd595faaf1df3
TLSH
T185112B1194BA8C93F83369CBCA2EDAD24CE43397DD586E48230C811DA754C36CD1ACF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-81-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/1852-66-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4572-35-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4572-22-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/6016-6-0x0000000000950000-0x0000000000971000-memory.dmp

Download