8249541afa3a2f58d604a96416e71b7ac9d23fcd9a43ec0862a3cef2ad2c7f3c

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 35.6MB
Sample260818-dycbbsfb65
SHA256 8249541afa3a2f58d604a96416e71b7ac9d23fcd9a43ec0862a3cef2ad2c7f3c
MD5 4d3ce719605a6525e31e04c5340c471b
SHA1 1a6e5d3ab14243b8aec2013438cd398884b140c0
SHA512 b5c0e81e3d234029df70b01e7fee5563387cb35712d5624c38b90dd9064da3686ceb69104d702157ba8f52dabdd4e96fbe1dfe87cddca529f94366a7d375d830
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EOM+ES+ES+ES+ES+ES+EL+ES+h:vOU/jIEeQfoR/IuOFVjUu5x
TLSH
T160874B09F94340B1D92B11B04DCFD3BF8A60BB2586128EF7FB4DCB5B6933BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2072	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe
1124	svchost_BBAACAABAABBCACCAABCBACCCBCAABBAACBACCAACBABCCCCBCACAAB.exe
1836	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABABABCCCABBABCAAAACBACCACCCCCCBAAAACACCBCBBBACCABCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe"	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACCABACABBABCCABACCCBBCABCABCABABBBCCABBBACACBCBBBCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACAABAABBCACCAABCBACCCBCAABBAACBACCAACBABCCCCBCACAAB.exe"	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2868	sc.exe
1976	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2568	cmd.exe
2068	cmd.exe
5616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACAABAABBCACCAABCBACCCBCAABBAACBACCAACBABCCCCBCACAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4472	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4472	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4472	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4472	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2072	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe
2072	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe
2072	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe
2072	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	2072	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 5616	4472	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 5616 wrote to memory of 3556	5616	cmd.exe	94
PID 2072 wrote to memory of 2224	2072	svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe	95
PID 4472 wrote to memory of 2568	4472	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 2568 wrote to memory of 2868	2568	cmd.exe	100
PID 4472 wrote to memory of 2068	4472	2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 2068 wrote to memory of 1976	2068	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_4d3ce719605a6525e31e04c5340c471b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBAAAABCABCBABCCBBBAAAABCBCBCACAACCBABBBABABACCABCBBCABBCBBABBAAAABBCBCAABBAACBABAACABBBCBAABCCAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBAAAABCABCBABCCBBBAAAABCBCBCACAACCBABBBABABACCABCBBCABBCBBABBAAAABBCBCAABBAACBABAACABBBCBAABCCAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACCACBBBABABBBCACACCCBCACAACBCBBCCAAACCABABACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe" start= auto displayName= "UserDataSvc_AABACCACBBBABABBBCACACCCBCACAACBCBBCCAAACCABABACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABACCACBBBABABBBCACACCCBCACAACBCBBCCAAACCABABACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe" start= auto displayName= "UserDataSvc_AABACCACBBBABABBBCACACCCBCACAACBCBBCCAAACCABABACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABACCACBBBABABBBCACACCCBCACAACBCBBCCAAACCABABACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABACCACBBBABABBBCACACCCBCACAACBCBBCCAAACCABABACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACAABAABBCACCAABCBACCCBCAABBAACBACCAACBABCCCCBCACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACAABAABBCACCAABCBACCCBCAABBAACBACCAACBABCCCCBCACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe
1⤵
- Executes dropped EXE
PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8b209623cb9cc1bf98646ea1769c1950268d4d28c6866223f98f03ece510c1b1
MD5 a00458c41e9293d345014389f62687eb
SHA1 d7847d4ec74ae3a9fac12f1002a1d5fd6adc3dae
SHA512 261fd63dd27460959667f46b4a188cbe542c6c68e34c082c642dd0a9b234e8a298ba8df2d44ada47ea9c274462925c0ea5961de29f07960f1234af4c620de45f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 349c214959a0de5095c94bd599a088bba43f7f46dd435f3c00642836e018033c
MD5 122561480fb9b714406c7a30dad8cdae
SHA1 167fad95fbf777d8dfe9d32fdfbbd6eab3c0ccf9
SHA512 80f1e4a7ce7a7e2e61670c6990b22208eb9cc54768592fa6b8e4c5b1e4be00a2952cfe03684611dbd7c6d4622e7ed0bbffe1352f9164796c519e9911340052b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf9346d2bbd664bed9ae2651a06feea4993f8d5ab6280911a01a7cd9582f99bc
MD5 606340a72d291624e0a807dc8ec755fe
SHA1 ce50ddc5b2fafd0981d0c457a4e0a873dccf39ed
SHA512 5b7a2565649d584773a3af85587a23c9c70edf605b8b8ba51b1c0233373ee6972a14939320aa0faac03c418102cee7b1d450c2ac179061d6523e570ff56108dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d3d5b3672dfba07def3e40752ae82f1ec21b8a6e0df5b18726e25d8fd3bb97c9
MD5 a675a0b2d8c2461a5185bee9c29515ca
SHA1 0e32cedfb9c5e8fe77a74edccb09bf944def7eab
SHA512 ada52809b81855a4cafe5a90c20689c40d127e0ffd2b95eecb9ce6bb798f7b33fd7144f66dd7de52d7901cad06e714fb11703801025d049d0a004e5c4e4e6bfd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0dc285ee8adb3845628d4d7e8d0777d79c0b510d2dc5794f325c8e45ea943a9a
MD5 ea40da8e1e0db80d3c1465909e0d4c81
SHA1 8232acaf04a9932e78acb1978664046eb12fc386
SHA512 5d6155300e29e2dd679f1f01aea872345e9872eb102f03b63b68e183f2a0b0c797ce260932c61494cf68fda4c78daed6adb3f62bc10ef96fd893a966b615b31e
MD5 SHA1 SHA512

Submit Download

svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAACBCCBCACCABBABCCABACAACBABBCAACABABABCABCACCCBBBB.exe
Size 35.6MB
SHA256 8249541afa3a2f58d604a96416e71b7ac9d23fcd9a43ec0862a3cef2ad2c7f3c
MD5 4d3ce719605a6525e31e04c5340c471b
SHA1 1a6e5d3ab14243b8aec2013438cd398884b140c0
SHA512 b5c0e81e3d234029df70b01e7fee5563387cb35712d5624c38b90dd9064da3686ceb69104d702157ba8f52dabdd4e96fbe1dfe87cddca529f94366a7d375d830
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EOM+ES+ES+ES+ES+ES+EL+ES+h:vOU/jIEeQfoR/IuOFVjUu5x
TLSH
T160874B09F94340B1D92B11B04DCFD3BF8A60BB2586128EF7FB4DCB5B6933BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-70-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/2072-24-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/2072-34-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4472-0-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/4472-8-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download