d15b695bb2a1b60f4d416cc3326751286ed2c989867498c956ded8c53f749fd4

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 20.5MB
Sample260831-qt3c6sshjd
SHA256 d15b695bb2a1b60f4d416cc3326751286ed2c989867498c956ded8c53f749fd4
MD5 e29407f23d752043e41903c2ae4f70e1
SHA1 f11be82bbd14cb36be7795805308168104598808
SHA512 8b8be9bf41378b78ced1b12be03a58e170526ea188e7670f4da125254e6cd4cc1deb88ea3bbf4ff6aab0c7ddecb516db952547423313f59cf8fc58ec86e62aa0
SSDEEP 49152:U+Er6+EP+ES+EH+ES+EH+Ere3+ES+EH+Er6+EP+ES+EH+ES+EH+Ere3+ES+EH+E1:vKjKWQckVgtev5mnlNLB
TLSH
T18E275D06F98340F1D86B10B04DDBD2BF8A71BF2186218EFBE74DC65B6933BA15828755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
408	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
4520	svchost_CAABAABCCCACAAACBBBABCBABABAAABBBAAACBABBCABABCCBABCABC.exe
5416	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABAAAABCAACCBBABBCCCCCBCACBCCACABCABCBCABCBABACBACCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABAABCCCACAAACBBBABCBABABAAABBBAAACBABBCABABCCBABCABC.exe"	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCACCABAACACCBCBACACCCCBACCCBCBBCCABABBBCACACCBBAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe"	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5660	sc.exe
5552	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4212	cmd.exe
4780	cmd.exe
3412	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABAABCCCACAAACBBBABCBABABAAABBBAAACBABBCABABCCBABCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
1416	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
1416	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
1416	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
408	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
408	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
408	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
408	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
4520	svchost_CAABAABCCCACAAACBBBABCBABABAAABBBAAACBABBCABABCCBABCABC.exe
4520	svchost_CAABAABCCCACAAACBBBABCBABABAAABBBAAACBABBCABABCCBABCABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	408	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
Token: SeDebugPrivilege	4520	svchost_CAABAABCCCACAAACBBBABCBABABAAABBBAAACBABBCABABCCBABCABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4212	1416	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 4212 wrote to memory of 1280	4212	cmd.exe	94
PID 408 wrote to memory of 3240	408	svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe	95
PID 1416 wrote to memory of 4780	1416	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	98
PID 4780 wrote to memory of 5660	4780	cmd.exe	100
PID 1416 wrote to memory of 3412	1416	2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	101
PID 3412 wrote to memory of 5552	3412	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_e29407f23d752043e41903c2ae4f70e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACAAAABBBBACCBCCBCCCCAAACABCBBCBCBACAABAAAABACBBBBBCCCACBBABACBBABBCBCBCBACBAACAABCABABAACBBBAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACAAAABBBBACCBCCBCCCCAAACABCBBCBCBACAABAAAABACBBBBBCCCACBBABACBBABBCBCBCBACBAACAABCABABAACBBBAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCBAAACACAABAAAACAABBCCCABCABBBABCCBCBABABCCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe" start= auto displayName= "UserDataSvc_CACCCBAAACACAABAAAACAABBCCCABCABBBABCCBCBABABCCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCCBAAACACAABAAAACAABBCCCABCABBBABCCBCBABABCCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe" start= auto displayName= "UserDataSvc_CACCCBAAACACAABAAAACAABBCCCABCABBBABCCBCBABABCCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCBAAACACAABAAAACAABBCCCABCABBBABCCBCBABABCCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCCBAAACACAABAAAACAABBCCCABCABBBABCCBCBABABCCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCCCACAAACBBBABCBABABAAABBBAAACBABBCABABCCBABCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCCCACAAACBBBABCBABABAAABBBAAACBABBCABABCCBABCABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
1⤵
- Executes dropped EXE
PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b2061063d89c8b8d38fd6562c73119a161700efede9baf8a77586f522da8438
MD5 4c8e2b11eb903dfd412a9a75b9945f47
SHA1 a8cdd5ecf0fa1e2b77ae6167b57c78aa4b6dafb8
SHA512 24e459eee4c02b106d490d595292250d365620e0032f2e13111dbcd22c13e17581255114a45e738f00b07ee262ba518c4296f7f4c12e34c959ab9a37873fa323
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 082266194676757897582a0a144efc54a231e1f6eae677774a14847e90372650
MD5 b35c7b8c9549de613a66feb97984385b
SHA1 0bc5e6e601c90bef25b364fcdae73382f6a5d7fe
SHA512 653a2d4607f2424212075245f990653366694929a843d1cd4b233bb184b42868f0f3fa42e873c5a713c9ddcc9526c4163a1cf7b9c1bb9cc045c832b0d3b8fb99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a75205453db387a7167e13d9d2fa0f04a1cd8a64189941fd4c2e1f7aa965f901
MD5 4d3ebfb16fca18433be7a80405506377
SHA1 6701b4145640f3d1576b71a8652035b316a46203
SHA512 3567b36b6242206b5b0421b20c1b8aece8ae2bd2095baf9a7381a2bbd4550128693ba97e98f65d62022902e0db1bcd0ee8d8a2f8b889bc92aa63caa4cd34e78d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5b596a271e970a1966c5cc14e5b2d270d17596325523442ae933fa4b8842ec4a
MD5 1041dca05a5d90f247c0b72f60c06688
SHA1 0f0b97eae84434b77956afc26a29128de1c33490
SHA512 9ac953fdbc1e353c304f681dbb3204db2b7c6c556473669885de898d58062c7eaad10e283e744895911cc1dd18478d480cf134605cd9235936ae56fe3fa0b662
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 259448a0f0ea227d2db3ee182a75482b18b94a21e8a0bc452546657a05926226
MD5 a797e733161d66ad72ef74482c586919
SHA1 cdbcd6b8e5abf71c0914bf5adc2ce05436c28ce4
SHA512 687d10889720a9bc44b4fb0941a0474db782a561f88487374ffe919b3576b62170fac609b0e430c6ba07a3e69bd98dfedc6270293986740a43e89920fd3dae6f
MD5 SHA1 SHA512

Submit Download

svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAACBBACCBAAACCCCCBAABCBCAAABBCCAAAACCAACBCBBBAAACC.exe
Size 20.5MB
SHA256 d15b695bb2a1b60f4d416cc3326751286ed2c989867498c956ded8c53f749fd4
MD5 e29407f23d752043e41903c2ae4f70e1
SHA1 f11be82bbd14cb36be7795805308168104598808
SHA512 8b8be9bf41378b78ced1b12be03a58e170526ea188e7670f4da125254e6cd4cc1deb88ea3bbf4ff6aab0c7ddecb516db952547423313f59cf8fc58ec86e62aa0
SSDEEP 49152:U+Er6+EP+ES+EH+ES+EH+Ere3+ES+EH+Er6+EP+ES+EH+ES+EH+Ere3+ES+EH+E1:vKjKWQckVgtev5mnlNLB
TLSH
T18E275D06F98340F1D86B10B04DDBD2BF8A71BF2186218EFBE74DC65B6933BA15828755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1a7961a3ea838a3206643fac7788564a64a68b7c81a146bc561b80aa4e6db3d4
MD5 840c955e844f91bb6568d2ce33312dad
SHA1 cb1ad2d21265aa69360a868fc52c9fe7c29f580f
SHA512 e596cc868687024954d0e4eb2068132c18231667884b2a6ea2498a96161eebfc873dd34a455f8ca95dee7014b4eb8bc750d9a5cb87d3a2036ce86ac9aeea7a29
TLSH
T172119E62E0E5D8F7F9332C9BD11AD9871CA4279B785CAE14331AC218A7D9C31CE194A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/408-32-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/1416-0-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/1416-8-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/4520-79-0x0000000000240000-0x0000000000261000-memory.dmp

Download