fe38bcc033e8010d8e74fc5cea595e1d6f352c909d7c86c496199778e69d6e86

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe
Size 5.6MB
Sample260830-y4skqa1sav
SHA256 fe38bcc033e8010d8e74fc5cea595e1d6f352c909d7c86c496199778e69d6e86
MD5 26f32fa597335c027b2aac8d6f715e8c
SHA1 82c6769b7a66cc9d2b8629822f198023ce6bb199
SHA512 e858250f380592afafd556df9717dc87921cb7c4f4f8eb43db02ec41b34ad3643b4102be88cfa0f950b67451451dac5f005b28cb574abf7ea11f4f93e8246a00
SSDEEP 49152:U+ES+EpR2y6i1z7aB+ES+Ek+ES+ES+E2+ES+ES+EpR2y6i1z7aNkwqQ+ES+EpR29:A5fp5fOp7A
TLSH
T14A465B05B6E50471E4B7017049A6D27D8A30BD25C3229EDFA6849EEEFFB2BC05835B71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5688	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
1084	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
3276	svchost_CABBCCCBBABCBAABBBBACBACCACACACBCACBBBACCCCBCABACCBBBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBABABABCCBCBACABAAAACABCBBCCCABBCACBCBACABABCBBCAAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe"	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABCABBCBBCAAAACBBCBABACABCABBBACCABBBACAACABBBCCCACAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBCCCBBABCBAABBBBACBACCACACACBCACBBBACCCCBCABACCBBBAB.exe"	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5872	sc.exe
6100	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1120	cmd.exe
3380	cmd.exe
5960	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBCCCBBABCBAABBBBACBACCACACACBCACBBBACCCCBCABACCBBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4060	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe
4060	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe
4060	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe
4060	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe
5688	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
5688	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
5688	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
5688	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
3276	svchost_CABBCCCBBABCBAABBBBACBACCACACACBCACBBBACCCCBCABACCBBBAB.exe
3276	svchost_CABBCCCBBABCBAABBBBACBACCACACACBCACBBBACCCCBCABACCBBBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe
Token: SeDebugPrivilege	5688	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
Token: SeDebugPrivilege	3276	svchost_CABBCCCBBABCBAABBBBACBACCACACACBCACBBBACCCCBCABACCBBBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 1120	4060	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe	92
PID 1120 wrote to memory of 1652	1120	cmd.exe	94
PID 5688 wrote to memory of 2972	5688	svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe	95
PID 4060 wrote to memory of 3380	4060	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe	96
PID 3380 wrote to memory of 5872	3380	cmd.exe	98
PID 4060 wrote to memory of 5960	4060	2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe	99
PID 5960 wrote to memory of 6100	5960	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_26f32fa597335c027b2aac8d6f715e8c_amadey_darkgate_elex_icedid_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBAAABBAABBCAABCABACACCACBCAAAACACCAAACBBBBABAABBCBAACCBCACCCBCABCBBBBAACAACCCABACCACBBAACBAACAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBAAABBAABBCAABCABACACCACBCAAAACACCAAACBBBBABAABBCBAACCBCACCCBCABCBBBBAACAACCCABACCACBBAACBAACAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBBBBACCBBBCBABCBCABBCACBACCCCBCCBCAABBACBABBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe" start= auto displayName= "UserDataSvc_BBBBBBBACCBBBCBABCBCABBCACBACCCCBCCBCAABBACBABBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBBBBACCBBBCBABCBCABBCACBACCCCBCCBCAABBACBABBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe" start= auto displayName= "UserDataSvc_BBBBBBBACCBBBCBABCBCABBCACBACCCCBCCBCAABBACBABBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBBBBACCBBBCBABCBCABBCACBACCCCBCCBCAABBACBABBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBBBBACCBBBCBABCBCABBCACBACCCCBCCBCAABBACBABBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCCBBABCBAABBBBACBACCACACACBCACBBBACCCCBCABACCBBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCCBBABCBAABBBBACBACCACACACBCACBBBACCCCBCABACCBBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a5fc84db8291128ce84e8259209f6de1771a25da7961b1a2b84406530e8774a
MD5 9df17c7080a059fc561df6cc5639de8c
SHA1 112d40c116e01727a8f12b6a2f3aff0a3bb91015
SHA512 079040261d3c00667c304b7ab372081949b2bf1b660902ef80b18e7e6aff3fc87ab395e3dd698521c385d74fce8de41208dae56d117b2e282bf80af48e29697f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3699c2ee7fc5ed39f2d7dfb955dfcf53c47f9883de766464bb1e1870bc6a2290
MD5 22d36bef81bd29dbe657698f48b9ba86
SHA1 20295949e09529a605bcb4a18cebb867677b00c3
SHA512 edc9124c839817e2df541efe7b8c4c3e08aaba59b0bff1b09eb63ba59c3e289fc1814e27914c0841861a574789d574a7bdbec8be7f249a318353a8aa1dad4416
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 252308e79ffe283e86cb0017448e4f846a3ebf5bc63e28dcb1a1dba233b26260
MD5 0a14d6515583d9ca301958d36b40ddc5
SHA1 fc25dadff3ce1738593043d3fd0d3b1589b34cbb
SHA512 9e8723814a6b42f2b6382d8b15f422e04d0d73a52b616271d05f9fd0f7506b0b3566439fb67987c44d946253798fa89d55c332e8cd6b3c5084459158e7f19a19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c896fd35a62e58dffc18b0378949be622447c65eed58a766fb7e5d16cc4eb319
MD5 16e8e164af00469071969b5aca701536
SHA1 b448193e7b5e5687a6d29903027d4cb59a8cc4a4
SHA512 3332e17cd07a2441e5f8c7d4b4c4597b3fdb412c1f1b88b5f8465823d6e600de20a0ef456ce4c2e46989f591636563963e337b0d4dbecd507269570f73b7f426
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2c230438ced4f768fc11f25226af816087f5849a7f6a389ef3f91f309f596d5d
MD5 7a45c51110b3bb8c35a713abd69d174b
SHA1 6eb2258abdf75ab1b78eca1264845894f997030b
SHA512 fe21d63912e651ac9c79594468d3edfaabdba49435f961fb1ca96e562bdb68c73084cd7b124aca1f7fc91b6a0bf6c1a4834672a3e614560681b69f69e570b479
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ad835bd4a599f9890fdbe25426af10208da5e9b7b43ba1dbc067bb77cdba045c
MD5 706fe18ae04f299d33857ab670146276
SHA1 fc83c71a9c014caa599e39b0d51981428afcb438
SHA512 d6d7548f40567aed33947f1d681d52e8a6e74bd0d3e9a1a35429dbe09b521d19f5fd8f7d0d7fe59e619a42dfac14c862a10bc5ca7c31b8baec9b399195553ca2
MD5 SHA1 SHA512

Submit Download

svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABAAACCBACAAAABCACCBACAACBBBABCACCCAAABCCABCACACCBC.exe
Size 5.6MB
SHA256 fe38bcc033e8010d8e74fc5cea595e1d6f352c909d7c86c496199778e69d6e86
MD5 26f32fa597335c027b2aac8d6f715e8c
SHA1 82c6769b7a66cc9d2b8629822f198023ce6bb199
SHA512 e858250f380592afafd556df9717dc87921cb7c4f4f8eb43db02ec41b34ad3643b4102be88cfa0f950b67451451dac5f005b28cb574abf7ea11f4f93e8246a00
SSDEEP 49152:U+ES+EpR2y6i1z7aB+ES+Ek+ES+ES+E2+ES+ES+EpR2y6i1z7aNkwqQ+ES+EpR29:A5fp5fOp7A
TLSH
T14A465B05B6E50471E4B7017049A6D27D8A30BD25C3229EDFA6849EEEFFB2BC05835B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 19520629da1b666f4f732e673fc02e8a19ea463275368fb304bb1d2aa415383e
MD5 6f6c0911b2502097a182ebf02b0994ad
SHA1 09bc2e220aacc219a5347d1d6fb9b5a226308c3f
SHA512 ed6b3c762998f2858d5d7914e3a323d56f59600aa192f81ddc54922280fbec45d5740360bf50d6ed8230169b10dbd784aa6d2da1452a199713867ada73eb7d76
TLSH
T18A113D80D0EAC593E93228CB5935DA671CD4338F981C6EA03305432DB3A8C358D960E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1084-76-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/3276-81-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/4060-0-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/4060-7-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/5688-36-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/5688-23-0x0000000000410000-0x0000000000431000-memory.dmp

Download