26b5be3ccd9228c911477cb03bdff7954a641fad900b2df1ea271fbd39d926fc

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe
Size 4.8MB
Sample260827-gnmk4adn51
SHA256 26b5be3ccd9228c911477cb03bdff7954a641fad900b2df1ea271fbd39d926fc
MD5 eafafd9e9241c1850573532e40a30ac4
SHA1 41b4430d2d585fb77fe13e6c4e28b52fb8a03728
SHA512 8ee09ee9501a6c1d1b4b9ed0026702d6791c58af077c46bbe3b6446e58391eb1a3f405ec1b3cf53627853ef9ef589552c1c65de83e422f15f0099c32ba6611cf
SSDEEP 49152:U+E7+ELX+E7+ELX+E7+ELX+E7+ELX+E7+ELX+E7+ELl2+E7+ELX+E7+ELX+E7+E4:Vp7k
TLSH
T147369E06F5879075E56B40B00DDFC2BE9631BE628A118DEBF7CC8A2F5D32B907524729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4232	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
3688	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
2972	svchost_CCCAABCCBCABAAAABBAAABCABABBBCCACAACCBBCCBABBBBCCABAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABCCCCCBACCBCCABAAACAAABBCCAACBBBCCAABAACBAAAACABBBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe"	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACCBCAACABBAAAAACCBBBCCCACCCABACCABACAABACACBCACCBBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCAABCCBCABAAAABBAAABCABABBBCCACAACCBBCCBABBBBCCABAAAB.exe"	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1132	sc.exe
1048	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1820	cmd.exe
2544	cmd.exe
4816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCAABCCBCABAAAABBAAABCABABBBCCACAACCBBCCBABBBBCCABAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3324	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe
3324	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe
3324	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe
3324	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe
4232	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
4232	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
4232	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
4232	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3324	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	4232	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 1820	3324	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe	91
PID 1820 wrote to memory of 1140	1820	cmd.exe	93
PID 3324 wrote to memory of 2544	3324	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe	94
PID 2544 wrote to memory of 1132	2544	cmd.exe	96
PID 3324 wrote to memory of 4816	3324	2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe	97
PID 4816 wrote to memory of 1048	4816	cmd.exe	99
PID 4232 wrote to memory of 5232	4232	svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_eafafd9e9241c1850573532e40a30ac4_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCBCBBCBCBCBCBACBCACCBACCACBBBCBBACABACBBAAAABBAAABAACCCCBABACACCBBABCAABCBBAAABACAABABACACACBCACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCBCBBCBCBCBCBACBCACCBACCACBBBCBBACABACBBAAAABBAAABAACCCCBABACACCBBABCAABCBBAAABACAABABACACACBCACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCACCACACCCACABBABBCBABCCAACABBBCBCABCBCBBCCABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe" start= auto displayName= "UserDataSvc_ACBCACCACACCCACABBABBCBABCCAACABBBCBCABCBCBBCCABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCACCACACCCACABBABBCBABCCAACABBBCBCABCBCBBCCABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe" start= auto displayName= "UserDataSvc_ACBCACCACACCCACABBABBCBABCCAACABBBCBCABCBCBBCCABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCACCACACCCACABBABBCBABCCAACABBBCBCABCBCBBCCABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCACCACACCCACABBABBCBABCCAACABBBCBCABCBCBBCCABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
1⤵
- Executes dropped EXE
PID:3688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCBCABAAAABBAAABCABABBBCCACAACCBBCCBABBBBCCABAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCCBCABAAAABBAAABCABABBBCCACAACCBBCCBABBBBCCABAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6c9d45f2cf43f8051ecdd7340adb108cec40dc139e306882a0c1d2e9ffc2ee6
MD5 c5d6be6f460aa897794663ef230e916d
SHA1 a4034ee6619cc4542aeeeaef5726603a8b5ce0eb
SHA512 97addd91adbab587dff9569bf3dd395f53dd39bf78f87b6c901ccf29f81aa223c373d2b2089cde4f964a6b990c1f050ae706922b3cd439e7c3cb4004afe9a44b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a2855a04817cbe44760c93ee35aeacb4dacd8db5a647acf1d9a43a318495e80e
MD5 2cf1a944ca8e7c987ec43cc06c1cfe27
SHA1 8f36a39a47f3d7ce73cfeaa0fe35253eb6043389
SHA512 6f5440d676429dc847588fc0c99e87a8f4ae60d10ebaf53aa41a08ee4bf5994ff24583e4755127fdc4397d9cb8abe5cc5dac48e8eacf203dceae51cb63a7e8a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 55472b42a98652bd361231f55d264141b6739e3be6175f34fab79e565d0d2147
MD5 a90f21c7c8d5530f285d603e97b95332
SHA1 5a290b3855262467e41d2d90330a11039e06d77c
SHA512 2df9c15a2d6252f5c84bc33612d86c19f45c7cd711648773ced86d2d3e5bec7bdea59d07ea8f3a5d0c12cb20d2374f5d1beff98b9d88c65ad93e989bb600528a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d57c02eac42a5ea18871c853a3180f124d6a21dcfb26ca7db0986a89e34a9045
MD5 4d9500dbee04ee766d44dbb80c5d47a1
SHA1 6034a0c0054c6105ea3c3c3c677c0002b0daed7a
SHA512 f4ce0c651877422878a4e30ec515d24a3b8c55de0706fd3e4ec5983c17ac3a417d6383ab6d2225d6c67c553cb431c9d836bfb5ed9f5a28162794fd137a6239c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b25ee43ed4f0c8befc9233c7514179212f26a76bfc0fc6e226f673a210466f8c
MD5 e485467c136c9c4474614468c958df69
SHA1 a5e43eee897e0035ec23a9e96e5786a84a788505
SHA512 1720334cf3fe05725d021d76d0b74a836e804285be1ccb31985980f75aa3180cd620b2b1f7843777276327b7bc8d3dcacc22b826e1f1933b572a486430137d0a
MD5 SHA1 SHA512

Submit Download

svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBCACABAACABCBCBAABAAAACBACBABBBCCBBACBAAACAACBBBCC.exe
Size 4.8MB
SHA256 26b5be3ccd9228c911477cb03bdff7954a641fad900b2df1ea271fbd39d926fc
MD5 eafafd9e9241c1850573532e40a30ac4
SHA1 41b4430d2d585fb77fe13e6c4e28b52fb8a03728
SHA512 8ee09ee9501a6c1d1b4b9ed0026702d6791c58af077c46bbe3b6446e58391eb1a3f405ec1b3cf53627853ef9ef589552c1c65de83e422f15f0099c32ba6611cf
SSDEEP 49152:U+E7+ELX+E7+ELX+E7+ELX+E7+ELX+E7+ELX+E7+ELl2+E7+ELX+E7+ELX+E7+E4:Vp7k
TLSH
T147369E06F5879075E56B40B00DDFC2BE9631BE628A118DEBF7CC8A2F5D32B907524729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3324-0-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/3324-7-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/3688-67-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/4232-23-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/4232-36-0x0000000000300000-0x0000000000321000-memory.dmp

Download