d1e86b215e7c90d12805058621df7a9db92f046f06f4bd3051d440ebffb928a7

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe
Size 5.5MB
Sample260827-va3baabp2x
SHA256 d1e86b215e7c90d12805058621df7a9db92f046f06f4bd3051d440ebffb928a7
MD5 5e67d8cd9e0d4cfb0f8e86fcc3c21e52
SHA1 6c772b444272866d66bf8bf6c537f50def788d34
SHA512 c8ab2383cb6f5e25364eb76255255b1c390d6ea96adc5ef9f9a6d491a963f2853a7232d5770e76998aa8d38f3ea3605487265d69f2ad957df7a969c1a4174fe1
SSDEEP 98304:JP5+P5+P5rKRuy5anP5+P5+P5rKRuy5aXp74:F52525rqs52525rq24
TLSH
T1CA468E59B7825132EA3351B1889FD3F66D7479200B3486DFA644B72D1E33AC0E63E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3608	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
6068	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
5488	svchost_BBCABABBCBBCACBABABBCBCABCABCBBCCACABABCBCCBCABBCBABABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABBCCACACBBABCCAACBCCBBBCACCACCCCBBABBCBBACAABBBCCBCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCABABBCBBCACBABABBCBCABCABCBBCCACABABCBCCBCABBCBABABC.exe"	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAACBBCBBCCCABCCBACCBCABCCABBCCABCCACAACCBBAACBACAABBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe"	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2976	sc.exe
2612	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3096	cmd.exe
4364	cmd.exe
1788	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCABABBCBBCACBABABBCBCABCABCBBCCACABABCBCCBCABBCBABABC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4528	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe
4528	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe
4528	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe
4528	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe
3608	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
3608	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
3608	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
3608	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	3608	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3096	4528	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe	92
PID 3096 wrote to memory of 2304	3096	cmd.exe	94
PID 3608 wrote to memory of 1920	3608	svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe	95
PID 4528 wrote to memory of 4364	4528	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe	96
PID 4364 wrote to memory of 2976	4364	cmd.exe	98
PID 4528 wrote to memory of 1788	4528	2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe	99
PID 1788 wrote to memory of 2612	1788	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_5e67d8cd9e0d4cfb0f8e86fcc3c21e52_darkgate_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCBAAAABCBABBCBBAABACCBCAAACBCBBAAAAACACBACACCACACBBBCBBBCCACBBAACACCCCAAAAACBCACBACBCBCBCBAAAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCBAAAABCBABBCBBAABACCBCAAACBCBBAAAAACACBACACCACACBBBCBBBCCACBBAACACCCCAAAAACBCACBACBCBCBCBAAAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCBABCCABABCCACBAABACACABABBABBABABBAAACAAABACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe" start= auto displayName= "UserDataSvc_AACCBABCCABABCCACBAABACACABABBABBABABBAAACAAABACABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCBABCCABABCCACBAABACACABABBABBABABBAAACAAABACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe" start= auto displayName= "UserDataSvc_AACCBABCCABABCCACBAABACACABABBABBABABBAAACAAABACABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCBABCCABABCCACBAABACACABABBABBABABBAAACAAABACABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCBABCCABABCCACBAABACACABABBABBABABBAAACAAABACABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
1⤵
- Executes dropped EXE
PID:6068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABBCBBCACBABABBCBCABCABCBBCCACABABCBCCBCABBCBABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABBCBBCACBABABBCBCABCABCBBCCACABABCBCCBCABBCBABABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1103e10d14638517953387d92d879e25041025f398f57ff7d0b74a4245a56673
MD5 094b62bf069c248a39d755643c5ce8c5
SHA1 fcfb9f61322e42dcda2cb2398b288fa7feba4538
SHA512 8670b69e9c7b72bc7ddb948c7e36c93d21d72a956c926e34bf08535d22a0d19888351fd04d5e214c86c74bd6c2be69e729227d42b1fe5c2fbc372485d446d2c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f7ea912b5be9ffeeaebf33315932dd628b7579cf3031d457358976deaabaf70
MD5 bbbead633f9f8cf383b7f9361b971f3c
SHA1 33569bb8f97ac289967caff134a7248aa4dbc526
SHA512 d0ed49e24a8790c30282049d4656092e7a5e4039d5f1c733cc069eaea5a2d6197e041170b6f51bd9f405dbac9705928dcd63f029ea9428de250f3d7d94d26b0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 34bc1ad9b475a0cb0db82b41df69075bff57130c02a9d89a92610cfdfbb9c859
MD5 17279db0b1cb926fa82880f17ad7e379
SHA1 ff62297a592a9565ad4ea8867d5eb6ff01b43faa
SHA512 5a57232535991cc0c97a75d5b17cc6562c9427846df101c1affd3ce1fd29f7a19b35fca6750a8f5c76d61706db87a822ea1c5535dde44ba4389ef9cc8848b4e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22c2b49729db9e683665879412ca348728635f2ad7d102556d2fa05019375318
MD5 bdf43110ab3184d5bd32435799c528a0
SHA1 ad9b6295fddb7c78379b8677cb2e72505ba68ef0
SHA512 594755805eb2f1d33c89528f95c2bf9ae002dda24b29b5b5a234b1cb8186f410220774f8e1c62aa9c17eb5c468b72bf5b56ee21dc66d1236e7e94ada0fd0b07a
MD5 SHA1 SHA512

Submit Download

svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBABCCBAACCCBBCAAAABBCAACACCBACCCACBABCCABACBCBCCBBB.exe
Size 5.5MB
SHA256 d1e86b215e7c90d12805058621df7a9db92f046f06f4bd3051d440ebffb928a7
MD5 5e67d8cd9e0d4cfb0f8e86fcc3c21e52
SHA1 6c772b444272866d66bf8bf6c537f50def788d34
SHA512 c8ab2383cb6f5e25364eb76255255b1c390d6ea96adc5ef9f9a6d491a963f2853a7232d5770e76998aa8d38f3ea3605487265d69f2ad957df7a969c1a4174fe1
SSDEEP 98304:JP5+P5+P5rKRuy5anP5+P5+P5rKRuy5aXp74:F52525rqs52525rq24
TLSH
T1CA468E59B7825132EA3351B1889FD3F66D7479200B3486DFA644B72D1E33AC0E63E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3608-24-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/3608-37-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/4528-0-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/4528-7-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download