4526acf7c73b8e1094caf85e9eeb5e5db7f9d080da05ef901dca64e85c3fdcde

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
Size 5.0MB
Sample260906-2qdfeshn6w
SHA256 4526acf7c73b8e1094caf85e9eeb5e5db7f9d080da05ef901dca64e85c3fdcde
MD5 8edea4ec8b35a0c1721a076cbce052b8
SHA1 e2097ea0dbb45cf2be63a6579de4239ef2564a39
SHA512 42780f77187af80c6df2c84557991724dc661d8eaf2c5bfdcb79f720e9f40dd854bffe31204e858dcd8a1d8882a77c37036904c47c7d2f68f63ca128086ffd06
SSDEEP 49152:U+E3qatgl+p+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+E3qatglOr+E3qatgx:g350l350R350l350cp7P
TLSH
T168365C58B7E95161F9B346708CAAC2B65D31BC204F2187EF6680F33D5E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
668	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
5684	svchost_CACABABBBABACCCACAABCABBACAACAABBAAACBAABCBBCAACBBBABBA.exe
3516	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBABCCABACCABACCACACABCBCAABAAACCBCBABCCCCBCBCACBCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe"	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCACBBCBABBCCABABBAAAABCACABAABCBBBCCACCBAACACBCABCCAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACABABBBABACCCACAABCABBACAACAABBAAACBAABCBBCAACBBBABBA.exe"	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5724	sc.exe
5748	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5064	cmd.exe
2072	cmd.exe
3984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACABABBBABACCCACAABCABBACAACAABBAAACBAABCBBCAACBBBABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4732	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
4732	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
4732	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
4732	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
668	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
668	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
668	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
668	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
5684	svchost_CACABABBBABACCCACAABCABBACAACAABBAAACBAABCBBCAACBBBABBA.exe
5684	svchost_CACABABBBABACCCACAABCABBACAACAABBAAACBAABCBBCAACBBBABBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	668	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
Token: SeDebugPrivilege	5684	svchost_CACABABBBABACCCACAABCABBACAACAABBAAACBAABCBBCAACBBBABBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3024	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 5064	4732	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe	103
PID 5064 wrote to memory of 2252	5064	cmd.exe	105
PID 668 wrote to memory of 3252	668	svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe	106
PID 3252 wrote to memory of 3176	3252	notepad.exe	107
PID 4732 wrote to memory of 2072	4732	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe	111
PID 2072 wrote to memory of 5748	2072	cmd.exe	113
PID 4732 wrote to memory of 3984	4732	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe	114
PID 3984 wrote to memory of 5724	3984	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACACCBCCBCABBACCCCACBBACCCBBCBCACABBBBBCBACBCBCBABBABBCAACBABCACCBAACCAACBBCCACBAACBAABCABABBCACACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACACCBCCBCABBACCCCACBBACCCBBCBCACABBBBBCBACBCBCBABBABBCAACBABCACCBAACCAACBBCCACBAACBAABCABABBCACACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCACCBBBCCACCCCAAAAACAABABAAACABAAAACABCACBABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe" start= auto displayName= "UserDataSvc_BABCACCBBBCCACCCCAAAAACAABABAAACABAAAACABCACBABCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCACCBBBCCACCCCAAAAACAABABAAACABAAAACABCACBABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe" start= auto displayName= "UserDataSvc_BABCACCBBBCCACCCCAAAAACAABABAAACABAAAACABCACBABCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCACCBBBCCACCCCAAAAACAABABAAACABAAAACABCACBABCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCACCBBBCCACCCCAAAAACAABABAAACABAAAACABCACBABCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBBABACCCACAABCABBACAACAABBAAACBAABCBBCAACBBBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBBABACCCACAABCABBACAACAABBAAACBAABCBBCAACBBBABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
1⤵
- Executes dropped EXE
PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bc81e9e21f936342ff41e14b0aadf54cc5e715ffadd6afbdbd1cc2c026426f08
MD5 6d024acfb1498e5f7bfdfb365fb8519c
SHA1 491263b92e44d9d09c2904b1a597a78aacbd20f8
SHA512 a25cb1f963fcdaf085c8c7687de8f2204cc0ab321c1c903fe5ee5ab45d04a92ab44aa8b7de0b581e51db354c3f76159cc2429f37e19e195f59270173fa787add
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dacc85620b636c080126b26620bc840e57d64e2a091f259e1a8d1ecd22163618
MD5 2fff3069432a4eb8e4d37ef823d7fd3e
SHA1 8f6bb5c256738e8282cc246780de6b3b74e34ad4
SHA512 d6ec57875dc53f0c24c7b39eef8eb4210f08a8191b501e9c5fea9f16f51f5ea81ca0a10a097f63d1eb5f39ec33eff39d7c5f8855636649df41a7ee4ae78cd849
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1d7a315032a99842c11688b3ea7a64801fd4f4d904b5f3d7a1ba903682ec666
MD5 a062c2f8e98b28e15eb8289cb47bed0f
SHA1 b2bc266404046aeab525ded48465be431837768a
SHA512 784122dc023594636af5e5374e051e42124394d6eb16bba06b5be31725cd45a4b0887fc96a1815dcc7e13268aabb987db554c7f59b5a15407b55c5e04ccfac84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0e1342c404a49d3ec6eee9cb6a99867cff4d497d24c579e97172817bf29f6470
MD5 b81c20d3622b9c7e5dd85acc19655e7f
SHA1 8959b20cab61be1c0c8a82aae8089bfc2c12761e
SHA512 a9787ef8d4046ffd719c532bfff1fdee184b359ccbb903369043cea6a2e032d0601353631ea67880ada7f98e6537d944a938a02db4bcccf653b819201bfb951d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d3b2226f27b401cd95003195e165ac6197cc0843e81c46b47bb28aadae6eda6e
MD5 faea021829e7583cbab456c1a907d1f4
SHA1 d7be775a1fd62ccaf6ec6ae08a759373725f1c76
SHA512 44a8a344a59228e8c77416d46b20cabd9907669829485dc84e9521b1d90cf32667675e73f6c2ad76d8906cb88d226263e0e024d7fb6aec9a3a932a435d68eef4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fe0da0b9cafc4d6f45bb67344322e2830bf91c9dc7bdd320a26499414c223f8e
MD5 1cf827596d52073ab8fee8aba5b69977
SHA1 11f28215f081e790be5aa31b6b80d97ac1e0db1d
SHA512 ea607d464006171961088d1c4b8c94550c3e4bbd5bddbcdd126f4c79072c71f3788d824e47363e2f627df52d2521072bb57fe5e5ab680487029397d4eb8de4e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 40036b86e6e36a384df073e0da7a11ebf48b4852f153c9248583a7549e2e1944
MD5 73c32aed254c1646347e19c6916e8621
SHA1 22950d4e2c3ec9420912732e20fe6da92a1d4720
SHA512 e61908ec474670827722bc92f5e83f8e418994939edc9e56db4db105f04611c77b5b485991932f412d2988ee684cb54aa4e3e0378bc869ba8648f3079dd29533
MD5 SHA1 SHA512

Submit Download

svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBACCBCBBCBCBBCCBBAABBBBACBACCBBCABBCAAACBABCCAAABB.exe
Size 5.0MB
SHA256 4526acf7c73b8e1094caf85e9eeb5e5db7f9d080da05ef901dca64e85c3fdcde
MD5 8edea4ec8b35a0c1721a076cbce052b8
SHA1 e2097ea0dbb45cf2be63a6579de4239ef2564a39
SHA512 42780f77187af80c6df2c84557991724dc661d8eaf2c5bfdcb79f720e9f40dd854bffe31204e858dcd8a1d8882a77c37036904c47c7d2f68f63ca128086ffd06
SSDEEP 49152:U+E3qatgl+p+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+E3qatglOr+E3qatgx:g350l350R350l350cp7P
TLSH
T168365C58B7E95161F9B346708CAAC2B65D31BC204F2187EF6680F33D5E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 03e2adaca5d08b0526e842139d82e31f1ee2785387bc5d765b1edcdbbecd2644
MD5 df248a6ececdb289f4e037ea699a1f08
SHA1 a586cc73f717cadc1c54375b1fc748a2e4dbadac
SHA512 2b34cdc3069d45c453c9756d3b670a6fb92a0391ce2e40eb506fb058ccc6bca17f483f5d5c37c4150cc1e7979191d0b8d335fadcb3b11c6d3ef04063921348b3
TLSH
T14711B651E0F5D853F134289393199FC71C997A8BAC1CAB7823198219B798879CE194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/668-37-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/3252-60-0x0000000005220000-0x0000000005221000-memory.dmp

Download

memory/4732-0-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/4732-8-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/5684-82-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download