fb4b0dcc47513a930670fe5f8c653d123ff6e7d1ef49c6e99c2941a23f56e558

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 34.9MB
Sample260819-e1k7padm81
SHA256 fb4b0dcc47513a930670fe5f8c653d123ff6e7d1ef49c6e99c2941a23f56e558
MD5 c769d5e4fdea87d1d973ca5bc9f845b0
SHA1 40d91d08f7904b14ee35e28cdf3dbeb6c34b2690
SHA512 cb8d0bb3695914e9159f70010f41e3bebb4bd328fe1e64050f623a364cea0caa4b39f0d220a570b4eaf333ed7e79659d9f7ef1adac88ee1611758ef13a367e16
SSDEEP 49152:U+ES+E2+ES+ES+EpHwqp+ES+E2+ES+ES+EpHwqp+ES+E2+ES+ES+EpHwqp+ES+Eq:ZOU/jIEeQfoR/IuOFVjUu5o
TLSH
T1DC877D10F6F50C62E1BB11B15DF6E6790C31BB6A8238D58EF5DD464F6933BC04826BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4392	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
1380	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
1944	svchost_CCCACACABACBCBBACAACBBCBCABBCBCAAABBCBBCACBCBCACBCAACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBAACCBBBCACABBCAABABBCACBCBCCAABABBBBACCBBBBBBABCCACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCACACABACBCBBACAACBBCBCABBCBCAAABBCBBCACBCBCACBCAACAB.exe"	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BAABCACBACAABABABCBBBACACBAACCAABCBABACCCCBCAACBAABCBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe"	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4260	sc.exe
3900	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4660	cmd.exe
2060	cmd.exe
4548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCACACABACBCBBACAACBBCBCABBCBCAAABBCBBCACBCBCACBCAACAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5032	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5032	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5032	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
5032	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4392	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
4392	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
4392	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
4392	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
1944	svchost_CCCACACABACBCBBACAACBBCBCABBCBCAAABBCBBCACBCBCACBCAACAB.exe
1944	svchost_CCCACACABACBCBBACAACBBCBCABBCBCAAABBCBBCACBCBCACBCAACAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	4392	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
Token: SeDebugPrivilege	1944	svchost_CCCACACABACBCBBACAACBBCBCABBCBCAAABBCBBCACBCBCACBCAACAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2344	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4660	5032	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	91
PID 4660 wrote to memory of 1868	4660	cmd.exe	93
PID 5032 wrote to memory of 2060	5032	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	100
PID 4392 wrote to memory of 3496	4392	svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe	102
PID 2060 wrote to memory of 4260	2060	cmd.exe	103
PID 5032 wrote to memory of 4548	5032	2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	104
PID 4548 wrote to memory of 3900	4548	cmd.exe	106
PID 3496 wrote to memory of 3912	3496	notepad.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c769d5e4fdea87d1d973ca5bc9f845b0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCCABABCBACBABABCACCABACBCCCBBACCABCBBBAACBABCACACABACBBBBBCCAABBBBBABAABCCCBABCCCBACBACCAAAACCBBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCCABABCBACBABABCACCABACBCCCBBACCABCBBBAACBABCACACABACBBBBBCCAABBBBBABAABCCCBABCCCBACBACCAAAACCBBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACCCBACCCABCBCAACAACBBBBBCACBBCCCBACCBBBBAABABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe" start= auto displayName= "UserDataSvc_BBACCCBACCCABCBCAACAACBBBBBCACBBCCCBACCBBBBAABABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACCCBACCCABCBCAACAACBBBBBCACBBCCCBACCBBBBAABABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe" start= auto displayName= "UserDataSvc_BBACCCBACCCABCBCAACAACBBBBBCACBBCCCBACCBBBBAABABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACCCBACCCABCBCAACAACBBBBBCACBBCCCBACCBBBBAABABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACCCBACCCABCBCAACAACBBBBBCACBBCCCBACCBBBBAABABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACACABACBCBBACAACBBCBCABBCBCAAABBCBBCACBCBCACBCAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACACABACBCBBACAACBBCBCABBCBCAAABBCBBCACBCBCACBCAACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 09cf22f6e7dc65c8f5bd527af80fe56ec5f37de41db02391c931f83391eaf568
MD5 dd6ab80978df08b469e27ecd7808de56
SHA1 e450594517f0acc1ee0383c65c6f8c7badb9174d
SHA512 0b3f2a7d30ab91fd8dd7881c293bb23803864f80874253c3bef282dfc9b57f52964585fe7be434a0b37a6b753f3ef59d734e2f03d01f419c76062d8215a5a352
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ecdf8a1a2cfece4825c5b1c3eaa52e97a1478701a9dca8d079f3dbfde704b533
MD5 7b92695a3161e6db091f288690a99d41
SHA1 76269a237964d9b4f00e99036f4765d3bfc68674
SHA512 bd9b9d38726cce7daa68250105e4d1945884cdd90f3b5b7453b0057ea379813b7dc11ce133e58c2c7937a315d0f49381375eeda15a4bc14d02b843688f298e08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8af07b7dfb4421187187e995742b72775d185ad8fe3954875989b392f8194965
MD5 78f950ef94db71ee7b8d4391c0a7a7c8
SHA1 1cf36461bd3a83482c7af5fc8f2717578e237bdb
SHA512 6bbdd92ccaa36b5502d2a1e9b601a0c60493f62695ddcb53c7d8831cde2f0cd94549fcf40025f0ee881d0478c02c94004f0f5259cca23642be9286c267ab2ca7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 12bb13a1ca520022e63a39d2db4faaebef142aba20b7bc3dd95491865388fc28
MD5 0cf3047a9da29e0543a11e1c13b2aa40
SHA1 1c87cfed3668cabbb25870e1f437babc76bc9fa4
SHA512 998938b7fddacbaf571e337ae16a446d4fae0fcca79b236a00d391ee9349c5ab0fe9f0a6be44461a70b845a1b0384f1bcdb5fe77ae24f06891ff78d571477155
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 23dea8a4d659bee049e8a628f9b0b8adbf9c0d153c02e7b6d8b3274d018911a9
MD5 3fcbf84f9eb03fa4e2223eee543a10ae
SHA1 0b135b3353a8b8afc63a701ea803dbde04dcd92e
SHA512 7edce61784f3976fdb473475ac8f04349714d9d65d8c02e6b5f30b011aba3b2d2d00525d9ac00f088ed9479fd68d85661b167f29a9ff6e9118476ffc8a3a4327
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f1fac33039ece7fb1a215e37e0dada5e6d424aaec5305332ca6f2a6f96b14c2
MD5 94b777668c1613b98bb759193899ed35
SHA1 0444be7541a56e0d2775d478212b13d45e9af646
SHA512 f7dbe638608866c69695156af9811374ac1852adec9595bb3a956f1c5af7cbf6901bf6e653cd536c12c60d359b7fa5bc95a6d52760e258617f8296d24b252b65
MD5 SHA1 SHA512

Submit Download

svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCBAACAABCAAABCCCCBBBBCCCBCCCBBCCCAACBCCABBBACBACC.exe
Size 34.9MB
SHA256 fb4b0dcc47513a930670fe5f8c653d123ff6e7d1ef49c6e99c2941a23f56e558
MD5 c769d5e4fdea87d1d973ca5bc9f845b0
SHA1 40d91d08f7904b14ee35e28cdf3dbeb6c34b2690
SHA512 cb8d0bb3695914e9159f70010f41e3bebb4bd328fe1e64050f623a364cea0caa4b39f0d220a570b4eaf333ed7e79659d9f7ef1adac88ee1611758ef13a367e16
SSDEEP 49152:U+ES+E2+ES+ES+EpHwqp+ES+E2+ES+ES+EpHwqp+ES+E2+ES+ES+EpHwqp+ES+Eq:ZOU/jIEeQfoR/IuOFVjUu5o
TLSH
T1DC877D10F6F50C62E1BB11B15DF6E6790C31BB6A8238D58EF5DD464F6933BC04826BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 4925f4171d87a4715a52cada90581ee6de2b345eaa4066c70d619ee142f18983
MD5 27fb5cd039b86759fcee4d3c1a858b96
SHA1 5d07bcbe3d5fc36065be510cdb79cbec8f591980
SHA512 2e5ddae98b83e01759c7779e91b2ed110a28c9312a603f55952fdd07b7d51d99982e2ba8269a4d0f8fcc39cbe29751618b1db019aac9193523da862a6ed34404
TLSH
T128110410B8E5A85BE83268DB5E2D9BE288D437DFA89CAA4423044218A785D73CE454D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1380-74-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1944-89-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/3496-66-0x0000000003690000-0x0000000003691000-memory.dmp

Download

memory/4392-38-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/4392-25-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/5032-6-0x0000000000250000-0x0000000000271000-memory.dmp

Download