6c0405d29e298111f6a3372b11dd7da85a9a22eee6e059e71e1b510e7cd7d5fb

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 8.2MB
Sample260830-1v2s5sam8w
SHA256 6c0405d29e298111f6a3372b11dd7da85a9a22eee6e059e71e1b510e7cd7d5fb
MD5 0bb4c12510eab446b1e36062d809d188
SHA1 e188f4bdbb5ed9e6a5b1ef5c5dba0393cc40aa76
SHA512 e936e4374a954a0c53889516b42db496f11ab0e09fbd0cb637ddc26bdffbd5ba753ee3f18b3c3c62aee02236a3a74bd209cdd5a6e96941baddd1b93ab577c6d7
SSDEEP 49152:U+ES+EpZ+ES+ES+Epx+ES+EpZ+ES+ES+Epx+ES+EpZ+ES+ES+Epx+ES+EpZ+ES+8:KOU/jIEeQfoR/IuOFVjUu5e
TLSH
T1C2969F02F9C78071E97701B00DDBD2BE8631BE6186218DEBF7CC861F6B32B915525B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2856	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
1956	svchost_AACBBBCCCBBBAABABAABCACACACAAACABCCABABBBACACBAACCAABAC.exe
1444	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACCBCCCACAABAACCBCACACBBCCCACCBBBAACAABABABBABCCBACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe"	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABABAAABACCAABCBABBABBACBABACCBBBBABACBBCCABCBBACCABBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBBBCCCBBBAABABAABCACACACAAACABCCABABBBACACBAACCAABAC.exe"	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5556	sc.exe
6072	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6120	cmd.exe
780	cmd.exe
4416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBBBCCCBBBAABABAABCACACACAAACABCCABABBBACACBAACCAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3192	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3192	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3192	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3192	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2856	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
2856	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
2856	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
2856	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
1956	svchost_AACBBBCCCBBBAABABAABCACACACAAACABCCABABBBACACBAACCAABAC.exe
1956	svchost_AACBBBCCCBBBAABABAABCACACACAAACABCCABABBBACACBAACCAABAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	2856	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
Token: SeDebugPrivilege	1956	svchost_AACBBBCCCBBBAABABAABCACACACAAACABCCABABBBACACBAACCAABAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 6120	3192	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 6120 wrote to memory of 1908	6120	cmd.exe	94
PID 2856 wrote to memory of 5092	2856	svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe	95
PID 3192 wrote to memory of 780	3192	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 780 wrote to memory of 5556	780	cmd.exe	100
PID 3192 wrote to memory of 4416	3192	2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 4416 wrote to memory of 6072	4416	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_0bb4c12510eab446b1e36062d809d188_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACCCBACACAABAAAAABCBAABABACACBABABAACCBACBACCAABCCCABCBCABCBBABABAABCCBBBBCCABBCCAAACBCAACBCCBABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACCCBACACAABAAAAABCBAABABACACBABABAACCBACBACCAABCCCABCBCABCBBABABAABCCBBBBCCABBCCAAACBCAACBCCBABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAACBBBCBBAAACBBAABABCACABBCAABAAAABACAACABCACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe" start= auto displayName= "UserDataSvc_BAAACBBBCBBAAACBBAABABCACABBCAABAAAABACAACABCACACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAACBBBCBBAAACBBAABABCACABBCAABAAAABACAACABCACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe" start= auto displayName= "UserDataSvc_BAAACBBBCBBAAACBBAABABCACABBCAABAAAABACAACABCACACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAACBBBCBBAAACBBAABABCACABBCAABAAAABACAACABCACACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAACBBBCBBAAACBBAABABCACABBCAABAAAABACAACABCACACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBCCCBBBAABABAABCACACACAAACABCCABABBBACACBAACCAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBCCCBBBAABABAABCACACACAAACABCCABABBBACACBAACCAABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
1⤵
- Executes dropped EXE
PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e087bc39543945894daa96b373dda564911b1c1080ab50f21762807b998f2eb
MD5 c6cc47aa0145bf7cb1f7c4877401e03b
SHA1 6d255bfa22ba5a6b52276419be3e69faf26d9b3d
SHA512 710908518947e8367d6582a6c3af4519aebf989de87899518df8fe9efed65b10023c22b03527dead5d67c226d6022b12d6f08fe1aa3fa34bdba39c5fa08717d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22f4da37fb1870a6c29fdea414970b49bb1591dcd1ef62ce5820b5dd45405ab6
MD5 8b7664308cd92f531db0e80e22825ee3
SHA1 6224d55c6e7e59a7d3590d74ba7313bf2a450ddc
SHA512 bd35e4d3df2308e8dcd155123dc633034b472cd4d9a31f20de5b89018fb114abff83a4dec05f06f9777d7b7d5a2497aba47b224175ee67e373b41770c40c978a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9fadffb0f1d79f08d294ed8ab6b2738865865067a23e0e3b118fcc8663afc6b2
MD5 c97c8c19025f9a2474e36d04df58d04c
SHA1 bf64f7e100426ffbecdba5878516fb53b1eab5cc
SHA512 71f1ad36a95c8171e8f00107ef2bb8541f689eac06b0bac524d4237a49f00bc88c9c8854565119128e429950d9782cddaa17176423fc655f3895b6ef049a4588
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f4d0e910c7cede76d9590a32f07337a6b8e66d5edbb8350b9284099381ae1d0f
MD5 c4f5f30391d0557a34b3ab1aa1fecf35
SHA1 7edc0dfe1f3fc26e47d3750acfccaedc01ba38d9
SHA512 38c8da7011fc61138ed64657ce462b0677ed4315e0812925fe70c4ce1ee2ecf1d2568ffba21d03e792be6e376642571dd62c8ab048d265fbb91a7f73fe3429ef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 271e0be171bdc0616716b2df6df0704cd6ef1eee29a6a45fddf37fcc68622846
MD5 c45699e3b93ee2cf7edf7b3742f618d1
SHA1 bbc4f4fe4c54fd224fab968e9ae2d18b4e194ed8
SHA512 b968f0312a877096b75e064d888625c3359a9774fad009a8acdb8e4c64889ee743c2c8d5ebee61aaa7f4db3681b2de47a4a628e80f7986520fc995d574942ab1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 faa7ce889db3cd841b65ef88e7925ae2013caa80d0a9ab694f5a8f4cd8d322fa
MD5 93b90aefe4603b3853057c72a6213225
SHA1 9bb52ae7354a656646dd2c1650e5ccfd0470844b
SHA512 315ae5980d67f821350b5da3465cda1b3b0ffb7263023d75a3518e9f18de50d49f8f4cdeea8337d21d5ccdc0f852df1a9a916134d9ac757f9df0e7f3fa4c2318
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cb3ea65ddaf1f4eb1be355cfa07058d279041e1069c2de0e02b0c634ab47208e
MD5 12c0a5a83bced7f5746ee880c1b7ab30
SHA1 20abd8c089909c2d895bd08ed1bb0449e8cf2ce6
SHA512 5a65096dd95d339c773381431b97093854d4481ecc539b9d7cba07be55835fb59749f885661823cc59791cbec129cc30d524911406cb445cea297dea333619e9
MD5 SHA1 SHA512

Submit Download

svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCCBCCACABABABBBBCCCACCCCBACBBCCCAAABACBCCCAACAA.exe
Size 8.2MB
SHA256 6c0405d29e298111f6a3372b11dd7da85a9a22eee6e059e71e1b510e7cd7d5fb
MD5 0bb4c12510eab446b1e36062d809d188
SHA1 e188f4bdbb5ed9e6a5b1ef5c5dba0393cc40aa76
SHA512 e936e4374a954a0c53889516b42db496f11ab0e09fbd0cb637ddc26bdffbd5ba753ee3f18b3c3c62aee02236a3a74bd209cdd5a6e96941baddd1b93ab577c6d7
SSDEEP 49152:U+ES+EpZ+ES+ES+Epx+ES+EpZ+ES+ES+Epx+ES+EpZ+ES+ES+Epx+ES+EpZ+ES+8:KOU/jIEeQfoR/IuOFVjUu5e
TLSH
T1C2969F02F9C78071E97701B00DDBD2BE8631BE6186218DEBF7CC861F6B32B915525B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1174b4b06f30a6830a3719ec87ff10bf43f815dbe3091d147607a36e7c64e659
MD5 6cf5b8e0bc57644ba6db8193a7224db2
SHA1 367c643f32bbd4086eacb607f7c93a6cb72a5705
SHA512 544c64039c504e867a7d1479956586f485d2749d0fc7a5619667a532ecdb002dcd2bd81d2098018948013cc29835f53ce8dfec6fecf89d819c39a1666d676573
TLSH
T1B011012191F9C8A3F42228CBA22E9B671CE4738F585CAA0812190318A788C31CD6D4F7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1444-84-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/1956-64-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/1956-82-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/2856-33-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/3192-0-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/3192-7-0x0000000000270000-0x0000000000291000-memory.dmp

Download