0651afd7a1d829b2ca4d3b1d9896d7f23209c2c0706fa2d1aa56a73b1455ddae

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 7.3MB
Sample260827-gh7dbadn2y
SHA256 0651afd7a1d829b2ca4d3b1d9896d7f23209c2c0706fa2d1aa56a73b1455ddae
MD5 f0087ce99120b6c3bbcca9231326674b
SHA1 789805d02899e01e591ab20a50cf1f81c08566ab
SHA512 ab1684cf17dfcf602a1fdfd75bb90bb34a2c2e6a55306878a22ca93dd43fb99b13af450de057bd0db7da442c203498223d1a889bf4b64ec1ea9c00ff307a2c22
SSDEEP 49152:U+ES+ES+E2+ESV4x+ES+ES+E2+ESV4x+ES+ES+E2+ESV4x+ES+ES+E2+ESV4x+EB:8OU/jIEeQfoR/IuOFVjUu5r
TLSH
T158768E06F9838071E87711704DDBD2BE8A30BE6186224DEBF78C871F6B32B915935B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3612	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
3520	svchost_CBCCAAABBBACACACAAABBBABBCCCCCCCCBBCCBBCABABBCBACAAAACA.exe
3076	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACBACABCBBBCACBBCBACBCBACCCBCCBBBCCABABABABCCCCCBAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe"	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBAABBACBBBBBBCBACCBBBAABBAAABBACABBACAACABACACBABABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCAAABBBACACACAAABBBABBCCCCCCCCBBCCBBCABABBCBACAAAACA.exe"	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2028	sc.exe
1260	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3132	cmd.exe
6012	cmd.exe
5460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCAAABBBACACACAAABBBABBCCCCCCCCBBCCBBCABABBCBACAAAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2632	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2632	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2632	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2632	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3612	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
3612	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
3612	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
3612	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	3612	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 3132	2632	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 3132 wrote to memory of 5816	3132	cmd.exe	94
PID 3612 wrote to memory of 2136	3612	svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe	95
PID 2632 wrote to memory of 6012	2632	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 6012 wrote to memory of 2028	6012	cmd.exe	100
PID 2632 wrote to memory of 5460	2632	2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 5460 wrote to memory of 1260	5460	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f0087ce99120b6c3bbcca9231326674b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABAAACCCCCBCCBBAAAAAAACAABCCACCCCBCBACCCCCBBBCBABCAAACAABBBACCACAAAAAABBBBCCACABCBCBCABCCBBCBABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABAAACCCCCBCCBBAAAAAAACAABCCACCCCBCBACCCCCBBBCBABCAAACAABBBACCACAAAAAABBBBCCACABCBCBCABCCBBCBABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCBAABBBAACABACCCCCAACBCBABAACACACBABCBACACCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe" start= auto displayName= "UserDataSvc_CBCBCBAABBBAACABACCCCCAACBCBABAACACACBABCBACACCBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCBAABBBAACABACCCCCAACBCBABAACACACBABCBACACCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe" start= auto displayName= "UserDataSvc_CBCBCBAABBBAACABACCCCCAACBCBABAACACACBABCBACACCBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCBAABBBAACABACCCCCAACBCBABAACACACBABCBACACCBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCBAABBBAACABACCCCCAACBCBABAACACACBABCBACACCBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCAAABBBACACACAAABBBABBCCCCCCCCBBCCBBCABABBCBACAAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCAAABBBACACACAAABBBABBCCCCCCCCBBCCBBCABABBCBACAAAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
1⤵
- Executes dropped EXE
PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 092931f5cb81743c5286437fe107da057e7c6e666de36d9d80f3bbec73b4134f
MD5 a597cae048362e4ba37d9751adb3a527
SHA1 29334fee2871958c924c2d7074cd0f0016c15dd0
SHA512 810d8868871ca966cb4ba944fc85c4aed101911cd42e8b54c82dd559ba7baded9918b475d09b60744bfe83ec3380353cf9e580aec22088d436da38897b056840
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7a0cf90c58096f845f21bbe112929f9e873b34edbb84718de04adcb2096816ab
MD5 006a7d67c6f0cdcc98f036d0d3cebd96
SHA1 693399723d960ac37909c5a8669832049ea1edc6
SHA512 fdf9c8d2441bddce03c6f2fd33845f28affe761b91fc21a7af4a6da945d3e7cc7478e5ef75be8e1491f632647f7e2e0e35d4c9cbc576ec83c7bdb0f8738e2a27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 86f75dee50d71ecc97fd541c14468a73ce7d40f3df8ac8c7f918de6082d8e131
MD5 11fd98ceea9b958d195270c11a78a6cd
SHA1 57a34d2a46a9da7eca891e995e1f99a9452a8c60
SHA512 c1bd6596f06e7fb64bf8726231ed4c44bd1c350e9502d830d6744516be69a78d5c86a21d006a6ea50d30de3e1b7b7391de95582333967d498ec8c70fbcf3395e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a98379263c2090bbab6ae0ecad8dba918e4755e412298a9871cd2e3f2cfe00cd
MD5 f7daae0be8fd8fd9e4493424ded26718
SHA1 a590d4066e4491c25b9f6a11d369ba56d1f09501
SHA512 9582be154b6a376b6e400ffa6be136fb402fc7026320a40731afce5724362feeb983a6e47de4e1272ba20aaae29ac5fa89eafde26f83de850d1b7a1eaddde3af
MD5 SHA1 SHA512

Submit Download

svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBBCAAAACAABCBCCCAABBAACCBABCAABCBCACBACABBBBBCBBCC.exe
Size 7.3MB
SHA256 0651afd7a1d829b2ca4d3b1d9896d7f23209c2c0706fa2d1aa56a73b1455ddae
MD5 f0087ce99120b6c3bbcca9231326674b
SHA1 789805d02899e01e591ab20a50cf1f81c08566ab
SHA512 ab1684cf17dfcf602a1fdfd75bb90bb34a2c2e6a55306878a22ca93dd43fb99b13af450de057bd0db7da442c203498223d1a889bf4b64ec1ea9c00ff307a2c22
SSDEEP 49152:U+ES+ES+E2+ESV4x+ES+ES+E2+ESV4x+ES+ES+E2+ESV4x+ES+ES+E2+ESV4x+EB:8OU/jIEeQfoR/IuOFVjUu5r
TLSH
T158768E06F9838071E87711704DDBD2BE8A30BE6186224DEBF78C871F6B32B915935B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2632-0-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/2632-8-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/3612-24-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3612-34-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download