4e36d190360d0ab4a4985871d3a90789f65a5442dcdbbe42b3d2b2e28b178d8b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Size 21.3MB
Sample260826-nfgs7scp21
SHA256 4e36d190360d0ab4a4985871d3a90789f65a5442dcdbbe42b3d2b2e28b178d8b
MD5 bf118f792ba2efe900f8761504fa83ee
SHA1 73704d1fb0ce9a7a6b2be6e4bef1822723e28d0e
SHA512 b6dea60dcadc6ac97828d0081d15a0266a51a81c3bae463844fd5af00d5205550cf98a31dd43578d45ae77ed2dd983a8f83456e61e90fc23537952cd78a0f06d
SSDEEP 196608:O1tIDewjqkjiqM+1tIDewjqkjiqMsqajq:O8Kweky+8KwekyNa2
TLSH
T14D279E29FAA580F1F96F94789CABC376EA717A1048334B5BCA95C61F6F336514C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4720	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
3764	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
4420	svchost_BCACACCCCCCCBABBABCCCCAABACCCCABBBAAACAAAACACAAABCABCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCAABBCABBCBBACABCBAAAACBCCCBAACAABACCCBCBACAACBCACCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe"	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCCCCACCCCCABACBBBBBAACCCCCBBAABACBCACAABBCAAAACCABACAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACACCCCCCCBABBABCCCCAABACCCCABBBAAACAAAACACAAABCABCBC.exe"	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4888	sc.exe
3704	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3504	cmd.exe
1440	cmd.exe
1136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACACCCCCCCBABBABCCCCAABACCCCABBBAAACAAAACACAAABCABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2832	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
2832	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
2832	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
2832	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
4720	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
4720	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
4720	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
4720	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	4720	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4220	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3504	2832	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	95
PID 3504 wrote to memory of 2544	3504	cmd.exe	97
PID 2832 wrote to memory of 1440	2832	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	98
PID 1440 wrote to memory of 4888	1440	cmd.exe	100
PID 2832 wrote to memory of 1136	2832	2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	101
PID 1136 wrote to memory of 3704	1136	cmd.exe	103
PID 4720 wrote to memory of 4608	4720	svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe	105
PID 4608 wrote to memory of 4464	4608	notepad.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_bf118f792ba2efe900f8761504fa83ee_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCABCBBBAABBBABACACBBBABAACABACACAAACBBCACBBBBCCAAAABCBACBBAACBBCCACCBCCAABBBCBBABBBBCABCCBCACBACBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCABCBBBAABBBABACACBBBABAACABACACAAACBBCACBBBBCCAAAABCBACBBAACBBCCACCBCCAABBBCBBABBBBCABCCBCACBACBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCBBCCCCCCBCCABAAACCCBACAACACCBCCACBCCBBCBCBCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe" start= auto displayName= "UserDataSvc_ABBCBBCCCCCCBCCABAAACCCBACAACACCBCCACBCCBBCBCBCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCBBCCCCCCBCCABAAACCCBACAACACCBCCACBCCBBCBCBCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe" start= auto displayName= "UserDataSvc_ABBCBBCCCCCCBCCABAAACCCBACAACACCBCCACBCCBBCBCBCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCBBCCCCCCBCCABAAACCCBACAACACCBCCACBCCBBCBCBCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCBBCCCCCCBCCABAAACCCBACAACACCBCCACBCCBBCBCBCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACCCCCCCBABBABCCCCAABACCCCABBBAAACAAAACACAAABCABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACACCCCCCCBABBABCCCCAABACCCCABBBAAACAAAACACAAABCABCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 726c610255ffa9718fe16190d97181cba04322ca8e9001dac9a97db7ae9c21eb
MD5 88dc80d5acbba477d06a87bef3759de8
SHA1 f92d13cadd08ec1de633a6f702944cddf61f826b
SHA512 dc5bb67a8736c509590cb08b55b25b05e0a10031f5c65ad587b3cc2f4bacb785731d22e481d7f8e09c86c717e792564b4d6df0698cb0a1069105e7f19603a115
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d92c37a1aa35484cd88d5c5c077764d9ca1dfdaaa3dcb71c5c02826883a98056
MD5 c7b1d253039389baa0452800d1da0ff5
SHA1 9e25a1ae2f1ee10c17d56ecd22b43815319926e4
SHA512 b17108e2784876cf5d899791cfab0e678ae18ff0164fff1367c0e84aff570d7dd3b7fa7a8b0b394120916d592e0ea9d4fc9f70c4d79967410fc2bf55d646bbc6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8c7df8ccc06ff71412bacefac6f5c63bad848a80d14aabfb52ad5b48425bfb66
MD5 528e58d6bf09aec5e95d9a4e6e6d3e66
SHA1 4fd826773ba35e2b8927a944f11958cf8533309b
SHA512 cda4707564be823dc1a51e4155a4cf477b1cd9482a7bb827efb02031d7742bd5c89a711b90760d27f4d779e4f00af3b50781fad0e11cf50604a801e5519e4cd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f14387f3ceb07397f5886890e9277943992c47a56d49e9c3466fd29df27dbf44
MD5 ed447f2b519d86918abebc29a7b206f0
SHA1 f99b218688c92b026bd99b4e40fdc4b03fea6305
SHA512 9405eac0fe329c533ec2bafa4e272bcaafac6f93ab9085b0ae49097e6bfbcafa633fe63a260f8f2a2c69450c465fec595ede3d51911c6d19a3ec6343f83071c2
MD5 SHA1 SHA512

Submit Download

svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABABAABBCBACBABABABACAAACCCACAAAACBCBBCAAAACACBCAC.exe
Size 21.3MB
SHA256 4e36d190360d0ab4a4985871d3a90789f65a5442dcdbbe42b3d2b2e28b178d8b
MD5 bf118f792ba2efe900f8761504fa83ee
SHA1 73704d1fb0ce9a7a6b2be6e4bef1822723e28d0e
SHA512 b6dea60dcadc6ac97828d0081d15a0266a51a81c3bae463844fd5af00d5205550cf98a31dd43578d45ae77ed2dd983a8f83456e61e90fc23537952cd78a0f06d
SSDEEP 196608:O1tIDewjqkjiqM+1tIDewjqkjiqMsqajq:O8Kweky+8KwekyNa2
TLSH
T14D279E29FAA580F1F96F94789CABC376EA717A1048334B5BCA95C61F6F336514C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2832-0-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/2832-7-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/3764-73-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4608-68-0x0000000000B80000-0x0000000000B81000-memory.dmp

Download

memory/4720-26-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4720-39-0x0000000000950000-0x0000000000971000-memory.dmp

Download