201946bfbfee32350f56c3f0a2d895c915b3be898c1366f3637dd609d80130b8

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Size 6.4MB
Sample260827-hamvdazfrb
SHA256 201946bfbfee32350f56c3f0a2d895c915b3be898c1366f3637dd609d80130b8
MD5 e375a9d281620b748e081ed4b100289a
SHA1 b73658cadb5b22c95daf1418dc7c3858d5ea77b9
SHA512 27d201cd8d3706a7bb474e733c331fbc191aaed2c20af8164dd5fc1cb7e43beb6b7a53a69fee3d90a1a791f10a185c6be81559697f364a37be78140847ebb014
SSDEEP 49152:U+EWz+ES+ES+EkqatglxQ+ES+EWz+ES+ES+EkqatglxQ+ES+EWQhOBhOp+EWz+Ex:5Q7Q7QQ3Q7Q7QQl+4j5
TLSH
T1D3667C09B69548F1D9774130899BC2BAC672BC214F21CBDFA294D73E6E337D0A939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3212	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
3936	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
1292	svchost_CACBACCABBCCBCCBBAABBABBACCACBACCBABCCBAABAAACBBACABCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACBBABCBCAABAACABBAABCCCAAAACCCBBCBBCABBCCBCBACCAACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe"	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAAAABCCAABCBACBBAAACACBBBAABCBCBBBBAABCBCCAABAAABCBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBACCABBCCBCCBBAABBABBACCACBACCBABCCBAABAAACBBACABCAB.exe"	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3156	sc.exe
4548	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5972	cmd.exe
4612	cmd.exe
2752	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBACCABBCCBCCBBAABBABBACCACBACCBABCCBAABAAACBBACABCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1228	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
1228	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
1228	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
1228	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
3212	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
3212	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
3212	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
3212	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	3212	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 5972	1228	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	91
PID 5972 wrote to memory of 5628	5972	cmd.exe	93
PID 3212 wrote to memory of 3144	3212	svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe	94
PID 1228 wrote to memory of 4612	1228	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	95
PID 4612 wrote to memory of 4548	4612	cmd.exe	97
PID 1228 wrote to memory of 2752	1228	2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	98
PID 2752 wrote to memory of 3156	2752	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e375a9d281620b748e081ed4b100289a_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCABBACACBBCBABBAACACAABACCCBCBBBABBBAACBBCAAABACACBACBCBCCBBCCBCCCCBBBAACAABACACABBBAABBBBBAAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCABBACACBBCBABBAACACAABACCCBCBBBABBBAACBBCAAABACACBACBCBCCBBCCBCCCCBBBAACAABACACABBBAABBBBBAAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAAACAACABCAACCABACCCAAAACBCBABACBBABABCCCABACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe" start= auto displayName= "UserDataSvc_AAAAACAACABCAACCABACCCAAAACBCBABACBBABABCCCABACCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAAACAACABCAACCABACCCAAAACBCBABACBBABABCCCABACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe" start= auto displayName= "UserDataSvc_AAAAACAACABCAACCABACCCAAAACBCBABACBBABABCCCABACCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAAACAACABCAACCABACCCAAAACBCBABACBBABABCCCABACCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAAACAACABCAACCABACCCAAAACBCBABACBBABABCCCABACCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
1⤵
- Executes dropped EXE
PID:3936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCABBCCBCCBBAABBABBACCACBACCBABCCBAABAAACBBACABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCABBCCBCCBBAABBABBACCACBACCBABCCBAABAAACBBACABCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e80b55f4ef69ef8416ac1926b03c5aad6c7dbae68e406ec45f8161bafff5bad6
MD5 d82f480582f990172a0e74c1ac931125
SHA1 11d950ed625f488b57d7313864f9694acc55c3fc
SHA512 175a57868511e374ad62743cc09559bb58a3f3c458c56d208c2d2c120837fe412875b003f4badb4813656cae3c094caf525db8bc49812794fdee6a559f104831
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 444ce5c38bfe65620a0524be11f9354c00b79ace0b380fee4bcd1796e5c43e49
MD5 ef4e3fe60fdb786f6ebcaf08fc60cf89
SHA1 3c031d5401e8b1747afa04acd2c1f851b69ed131
SHA512 dae0e8fe30da5a6f0a5900a70e1dff07d06a19693c00216b63117e010bb84b569c525fbbdcb0e94958e7622b8d0c2c9a79b40054cd6539e8a6e14fa5b8bfd7ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2d653c4ec6b689e14be1f0d9b885d83b4d7aba957ae79d8c79662ac14b81b73
MD5 decfe40c76a9ef782fdbe20f84c5df92
SHA1 e30a55b6c7549e558cbe3ace6abc0123a579ee8c
SHA512 d97d31a1f4839c3be16469264095790a7b1bd4777f2eb2f350624ead8368d2e5e85eca7a8d519959a306f687c3c6e85c6bcc8abc3f5dd4c54b5b244373c634d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f39c4a5e93a16fca3c54caf396e6bbaddce772c6e9e797a7e77b933a86b8a708
MD5 038a2a6520ff89918f667d709170ecc5
SHA1 aa989f6867669a8c54f742639276b61fce195317
SHA512 38a0f5ba26e5254ffb3bdcd6225188179e28045f04fd85f057bfaeab3137c9bbf53c6dcf1144095ca80dd84b4f2b50cda9d3b7c787df77851c22fdbf146ac4a5
MD5 SHA1 SHA512

Submit Download

svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBAACCCCACBABAABCCBAAABCCCCABBACCAAACCBBABBBABCABBAAB.exe
Size 6.4MB
SHA256 201946bfbfee32350f56c3f0a2d895c915b3be898c1366f3637dd609d80130b8
MD5 e375a9d281620b748e081ed4b100289a
SHA1 b73658cadb5b22c95daf1418dc7c3858d5ea77b9
SHA512 27d201cd8d3706a7bb474e733c331fbc191aaed2c20af8164dd5fc1cb7e43beb6b7a53a69fee3d90a1a791f10a185c6be81559697f364a37be78140847ebb014
SSDEEP 49152:U+EWz+ES+ES+EkqatglxQ+ES+EWz+ES+ES+EkqatglxQ+ES+EWQhOBhOp+EWz+Ex:5Q7Q7QQ3Q7Q7QQl+4j5
TLSH
T1D3667C09B69548F1D9774130899BC2BAC672BC214F21CBDFA294D73E6E337D0A939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-0-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/1228-8-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/3212-24-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/3212-34-0x0000000000230000-0x0000000000251000-memory.dmp

Download