f075d67ac4fd945978e3c84a8812424372e64805d3fe71898d71c797a9087330

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Size 2.5MB
Sample260905-m4c99add44
SHA256 f075d67ac4fd945978e3c84a8812424372e64805d3fe71898d71c797a9087330
MD5 5050de579f6c094b41c228924e6c244e
SHA1 e20a6d2165e4a53333c908719a66f7077e1f7bbd
SHA512 73451767338c1bdcd9dff0164d441d831d2d53aeb70732a6c3ea70c9a541a094481c6518346a8dbebcadeaa6c961d670ffcb6078896ec7e68894bc0beac9bf63
SSDEEP 49152:U+ETqatglSB+ETqatglSB+ETqatglSB+ETqatglSA+4gAjhgu:sdvdvdvdA+4jX
TLSH
T15FC58D46B6908AF2D56B0231895B92B697B3BC110F11C7CF6394972E3F337D0AA36752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3344	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
6088	svchost_AAAABBBACCAABBABAACBCABACBBCCCCBACBAAAABACCCABCBCABBABA.exe
3092	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBCABCCCABACCBCCBBCCAABABCCCACABCBCACCBAACAAAAACCABBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABBBACCAABBABAACBCABACBBCCCCBACBAAAABACCCABCBCABBABA.exe"	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBCBCACBACCAABCCBAABCBBACAABCBABBCBAACBACBAACCBCACBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe"	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3716	sc.exe
1612	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5444	cmd.exe
704	cmd.exe
4960	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABBBACCAABBABAACBCABACBBCCCCBACBAAAABACCCABCBCABBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4180	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
4180	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
4180	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
4180	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
3344	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
3344	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
3344	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
3344	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
6088	svchost_AAAABBBACCAABBABAACBCABACBBCCCCBACBAAAABACCCABCBCABBABA.exe
6088	svchost_AAAABBBACCAABBABAACBCABACBBCCCCBACBAAAABACCCABCBCABBABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	3344	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
Token: SeDebugPrivilege	6088	svchost_AAAABBBACCAABBABAACBCABACBBCCCCBACBAAAABACCCABCBCABBABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 704	4180	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	93
PID 704 wrote to memory of 5136	704	cmd.exe	95
PID 3344 wrote to memory of 856	3344	svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe	96
PID 4180 wrote to memory of 4960	4180	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	99
PID 4960 wrote to memory of 3716	4960	cmd.exe	101
PID 4180 wrote to memory of 5444	4180	2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	102
PID 5444 wrote to memory of 1612	5444	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_5050de579f6c094b41c228924e6c244e_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCACBBCCAACBBCBACCAABCABBBCCBCBACACCAAAABCBACBAABCBCACBCCAACBAAABBCBCCAACBBABCBCACBABAAAAAACABACBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCACBBCCAACBBCBACCAABCABBBCCBCBACACCAAAABCBACBAABCBCACBCCAACBAAABBCBCCAACBBABCBCACBABAAAAAACABACBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCABAABAACCABCBABAABACCCABAACCCBCCCBCBCBAAACBBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe" start= auto displayName= "UserDataSvc_CBCABAABAACCABCBABAABACCCABAACCCBCCCBCBCBAAACBBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCABAABAACCABCBABAABACCCABAACCCBCCCBCBCBAAACBBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe" start= auto displayName= "UserDataSvc_CBCABAABAACCABCBABAABACCCABAACCCBCCCBCBCBAAACBBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCABAABAACCABCBABAABACCCABAACCCBCCCBCBCBAAACBBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCABAABAACCABCBABAABACCCABAACCCBCCCBCBCBAAACBBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBACCAABBABAACBCABACBBCCCCBACBAAAABACCCABCBCABBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBACCAABBABAACBCABACBBCCCCBACBAAAABACCCABCBCABBABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
1⤵
- Executes dropped EXE
PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c94c9fe39021a75b38b654f445febc09da3752190df5cbda267b0393c73f12c9
MD5 71eacc3ed1aabc4c6e0e0e006fa10005
SHA1 fc281e1e22070ce3b7b8727f5d94bc3a4f19cb29
SHA512 a2ce06bcce46f755c7dccf7ced9f06fcbefcb91b1a9bead846e649cf69b5aca5ef6f1b3d0af35eb987d2ee074afa6545eb43da4a0ce72900257e94598eb38bc3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e718f2d456516ea8e9b6a07dbb807f701eae1376c9a7de7b284c7e3efb7beeb0
MD5 209af5c642488ffb83177bb444fa8d40
SHA1 0f951ffe8ace0389bf856c613d82637e2a1e486d
SHA512 34ab3b560593fe048482d89cbb9b8bd6f9fca0d460371dfcbcf3ea9ac0164b70d85b7e0caa4e4272597336b0031ac6553c907e1bb7e3c9e578cee426e3b8b698
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 55813ad01eee29b8282a44eccea1e6f90ea70b15b57945fc527fd10b84d93e8b
MD5 e1e28259bd4cb32c2a105714fa3365c7
SHA1 26c9859d6ec09e9ae6dc8fcb1af200757f873184
SHA512 ac9026ca594df8fcfa5f8bfe4ef96e8666ecf78117a603abd563541c2f9c0ce91b9123394fefa2670b18e676109cc5565a6e4ab36a2feae9207665bbdaa1522b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d8036cdc32e63c3946af692622c077e6003e74092d0bbd699a1b01440f66639c
MD5 b27049af84941b6d1c6312cfbcde0eac
SHA1 a46dc5f61d4f640699f7be1b62ee24452f5c27ce
SHA512 8c28d2adf253855e3f38b95f468f2d9972cb16ad55da1b3cb9d1009c7923272d5c3aead917a4a8fa918acc72050e0f636c68efc52943a7d828afc4cbfd3bdab1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6ec547aec3b6fbebcb6ee5c87545c30b339db2a1418d0075674397b8c8b688f3
MD5 1f5a3a3cbfa7afadd80ff962459950bc
SHA1 6f37e7e9f472bb765c745d87dbabcf14cd121447
SHA512 97413aac583b6bc78adedfaab3034239baf9614da10a318012416c7663e0a814a628ad60684fe74f5cfb5c1313f287a07112ae1e8c5b819d3d563b53c71d9dd8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d5253f27ddd9ac6361eda6cbc785289376990645b50b45d83403079d02372e0d
MD5 e9bfe0d1c2c9d71cf84f659d86c9eb6e
SHA1 91ad3f4cc4cd5c1accad2de0fde97726cd0ec144
SHA512 5c5b4ed0a7b2d661405627fc3c40790213718ced0bd3b7229485f436e9406bd02c264a86769b614498666d71a8511dcd787031402b56991bdbd064462451dc16
MD5 SHA1 SHA512

Submit Download

svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCBACBCCCCCBABBACBCBAAABACCBBBCCBABACCBCCABCCCBAAA.exe
Size 2.5MB
SHA256 f075d67ac4fd945978e3c84a8812424372e64805d3fe71898d71c797a9087330
MD5 5050de579f6c094b41c228924e6c244e
SHA1 e20a6d2165e4a53333c908719a66f7077e1f7bbd
SHA512 73451767338c1bdcd9dff0164d441d831d2d53aeb70732a6c3ea70c9a541a094481c6518346a8dbebcadeaa6c961d670ffcb6078896ec7e68894bc0beac9bf63
SSDEEP 49152:U+ETqatglSB+ETqatglSB+ETqatglSB+ETqatglSA+4gAjhgu:sdvdvdvdA+4jX
TLSH
T15FC58D46B6908AF2D56B0231895B92B697B3BC110F11C7CF6394972E3F337D0AA36752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5909629e6bebca13e8931d02984e5baf7228988fd5851d8ec1818fc597cb1459
MD5 8f65f865476f51003291eedf8ec3c98f
SHA1 b0a003ec9a49d8a9ce31539e4f3ea58a5eed41c9
SHA512 a28893f909128c6957845f9eb704394d43271ab88771d4b3ff5bca1aade8f1129b6de71fff045f9d88be731c83063686e71f3dbacdf31e42627ff776da030c22
TLSH
T115115937F1A5C8D3E13124CBA6259E574DD03B9B585CAB00330D431CA369C3A9E258EA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3344-34-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/3344-24-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/4180-0-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/4180-7-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/6088-70-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download