fb0d7f1b7333f52127cc5e648ca928326bc221bfad2838baae509c28bd3d1bad

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Size 3.1MB
Sample260905-bdw4wstfja
SHA256 fb0d7f1b7333f52127cc5e648ca928326bc221bfad2838baae509c28bd3d1bad
MD5 a826e88421a670421a32573427b1bffe
SHA1 9b9c219ea3aed0d12f3b7b5b5c383d6f8f308ff5
SHA512 7dd9e6551185b72184bdd5266d6dee479d323261705b8a1c97c1f2ae5ec51fe10028c8ee18f06b1502e79f6f36ca18401886ed0cd39083a6ee569825a8f2fc88
SSDEEP 49152:U+E3qatglOr+E3qatgl+p+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+E3qatgJ:gR350l35087p
TLSH
T1B6E54B49B7E95161F5B346708CBA82B65D31BC208F31C7EF6680B72D5E326C0E935B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1516	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
5488	svchost_CBCCACAACAAABCCBBBBBBAAABACCBBBABBCCCCAAACBBACCAABCCCCC.exe
3972	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCCCABCBCAACBCABBCABACCBACACCCCABABACBBAACABCBAACAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe"	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBACCCCACACABABACBABCAAABCACCBCBBBAABBBBCABBCCACCCCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCACAACAAABCCBBBBBBAAABACCBBBABBCCCCAAACBBACCAABCCCCC.exe"	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
760	sc.exe
2296	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4108	cmd.exe
3880	cmd.exe
2180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCACAACAAABCCBBBBBBAAABACCBBBABBCCCCAAACBBACCAABCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2504	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
2504	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
2504	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
2504	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
1516	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
1516	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
1516	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
1516	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
5488	svchost_CBCCACAACAAABCCBBBBBBAAABACCBBBABBCCCCAAACBBACCAABCCCCC.exe
5488	svchost_CBCCACAACAAABCCBBBBBBAAABACCBBBABBCCCCAAACBBACCAABCCCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Token: SeDebugPrivilege	1516	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
Token: SeDebugPrivilege	5488	svchost_CBCCACAACAAABCCBBBBBBAAABACCBBBABBCCCCAAACBBACCAABCCCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4108	2504	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe	92
PID 4108 wrote to memory of 1060	4108	cmd.exe	94
PID 1516 wrote to memory of 4620	1516	svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe	95
PID 2504 wrote to memory of 3880	2504	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe	98
PID 3880 wrote to memory of 760	3880	cmd.exe	100
PID 2504 wrote to memory of 2180	2504	2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe	101
PID 2180 wrote to memory of 2296	2180	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_a826e88421a670421a32573427b1bffe_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCABCAACCAAACACABBCBCABAAAAACBBCACBACBABAABACAACCCCACABAAABBBACBBCBCBAACACAAAABAABBACACCAAACBACCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCABCAACCAAACACABBCBCABAAAAACBBCACBACBABAABACAACCCCACABAAABBBACBBCBCBAACACAAAABAABBACACCAAACBACCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACABCCABCCBCBABAABCCACACBBAACACABCACBBCCBCCCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe" start= auto displayName= "UserDataSvc_CBACABCCABCCBCBABAABCCACACBBAACACABCACBBCCBCCCBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACABCCABCCBCBABAABCCACACBBAACACABCACBBCCBCCCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe" start= auto displayName= "UserDataSvc_CBACABCCABCCBCBABAABCCACACBBAACACABCACBBCCBCCCBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACABCCABCCBCBABAABCCACACBBAACACABCACBBCCBCCCBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACABCCABCCBCBABAABCCACACBBAACACABCACBBCCBCCCBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACAACAAABCCBBBBBBAAABACCBBBABBCCCCAAACBBACCAABCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACAACAAABCCBBBBBBAAABACCBBBABBCCCCAAACBBACCAABCCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
1⤵
- Executes dropped EXE
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b3e0555a49d8a3439ef94d50ee8e3e36fe8d30aae82e80e7a8b9933c5aa92267
MD5 7f0711e49762c9ddec3f774fbe553ec5
SHA1 c3187da777b186eef49d1445371ef24e60d243f8
SHA512 e407ed6cfa99d929c02d9a02b015b12930ca4c6d405de22d719353ceba603dceab9ced3ad92c734ecf7b4ea9cdacbea729c120c1976c29b1db8fcbe00089fbdd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 98f81a158e0b920f799f3ab3a98d6ca23cadfd9f09a4a81774c7f7d2acc1571b
MD5 9d77389a249b590e226ecf49540a90ad
SHA1 73a88227bc1fd8e2c07a2230dcf45adbae2e9fa4
SHA512 eb3d8d2cda7547fe9a9df33fd5a2fa355d3fd43cbad9dbf772deabdc406dc32a991e6bfcd9a9dfe4a8df04a5d784928a582e8d97d53d956666b078e0623130c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c52378f19d5b63f9ffd2a6a41dc19787aa8629b2024bb3725db842d717c50003
MD5 a270d80b500e006cd1006b4c7fcc35ce
SHA1 3b3bbdcbc721bd31cb5864da81101541192e26a8
SHA512 2fcf0c3340a6d6d55bb7c34f13c6edc84fdf96dad5d5488430050ec52936cd2b95f339d74b3cd4aa62fcd80a6a57cf09ad4d1f7f745f01bfd9ed5b06098883b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6bac6edbff946039823565e3aef31d4a13c218ef9a1cc2fb3dab77c76402596a
MD5 ea028b18fe51ecba6faf74d05a180f82
SHA1 38b9dc13e05e3670bb37f1db711b1d50fb522b5c
SHA512 491176406e655dfe47f59542789901432cb8443343c1b83e2065d2ab765c3b6a0918b6318bacd25784d52c876c54804c10084c6e05e035fe6612f0e4cd3708fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1676090a14cd3dc1cc1aa870d8abd482b23dbba888804a471a56113a6bd77adf
MD5 bb2b061b68f3dde03f6a5721c0c9a65c
SHA1 7037194557abe76ed528c90edd3aa501d4a8e30b
SHA512 9a785c5235b4a1a82cf36734cdf1deef5999f20b7e239800dc7feeb15016b5f4560e1cb55ae9bbdf95f61d737a223d71f22c07e40522e5fd7f1a3faac85af9d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36f6bb2ca113fd4184cc64adc378bce9120bd841d8e761f4d4668d9bafe189b3
MD5 9b7d72677c70959e0eff635e7bc45954
SHA1 7468f5e2cb90a4726fd412ce639045bc7fab60a7
SHA512 28fa723522f808cbd9d6b5e872efcfa014002c33aa4e5f6ee160bcf0cc2d6da7b3d6319e15ee515d80e3918d17c0fa3565c948200bd9c2de2071aed8caf3ada6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8a73a990a6a537124d3c5994cec1c0d2567de5eb00507edf35476097094fb562
MD5 51f7b9dda7e0fad92b722d4ebc3f7ed8
SHA1 31cfbde84f15b6cfa8cbcd6a5783f7d894204e33
SHA512 f9d8c4f29448d73d79fe475f1ea1620acc8f3be27ecf91e8a8038d9f85c36752f6ba62388affedbd6fbf6f8a2b8e1e2a64786e81bbaee4e12ba6bed4139f5050
MD5 SHA1 SHA512

Submit Download

svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACBCCBCACCCAAACCBBABBCAABBAABBBBCCBCCAAACCACAAABCCB.exe
Size 3.1MB
SHA256 fb0d7f1b7333f52127cc5e648ca928326bc221bfad2838baae509c28bd3d1bad
MD5 a826e88421a670421a32573427b1bffe
SHA1 9b9c219ea3aed0d12f3b7b5b5c383d6f8f308ff5
SHA512 7dd9e6551185b72184bdd5266d6dee479d323261705b8a1c97c1f2ae5ec51fe10028c8ee18f06b1502e79f6f36ca18401886ed0cd39083a6ee569825a8f2fc88
SSDEEP 49152:U+E3qatglOr+E3qatgl+p+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+E3qatgJ:gR350l35087p
TLSH
T1B6E54B49B7E95161F5B346708CBA82B65D31BC208F31C7EF6680B72D5E326C0E935B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e0419c4e9caeba3feb3146f740ab9e0881618d93c07c929fd8a7de11664d8edf
MD5 14deed2b77e60289636050cc957467aa
SHA1 281604bebe7188db109a90f9302afd47e7575020
SHA512 908047feb51ce5470d5e2b5950936d07645b76f51a613386c3226e90fe4f06ecedf309be987c4db813873568d3db01832017e9c49aef24111bac6284e90133b1
TLSH
T1FB11E7649165D813F1332CDB876DEF8B4CE83BAFD814AB6813884218E795C34DE16CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1516-34-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/2504-8-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/2504-0-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/5488-74-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download