4526acf7c73b8e1094caf85e9eeb5e5db7f9d080da05ef901dca64e85c3fdcde

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
Size 5.0MB
Sample260906-2qdfeshn6w
SHA256 4526acf7c73b8e1094caf85e9eeb5e5db7f9d080da05ef901dca64e85c3fdcde
MD5 8edea4ec8b35a0c1721a076cbce052b8
SHA1 e2097ea0dbb45cf2be63a6579de4239ef2564a39
SHA512 42780f77187af80c6df2c84557991724dc661d8eaf2c5bfdcb79f720e9f40dd854bffe31204e858dcd8a1d8882a77c37036904c47c7d2f68f63ca128086ffd06
SSDEEP 49152:U+E3qatgl+p+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+E3qatglOr+E3qatgx:g350l350R350l350cp7P
TLSH
T168365C58B7E95161F9B346708CAAC2B65D31BC204F2187EF6680F33D5E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4412	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
828	svchost_AABCCAABAABBABCACCBBBBCBACCCAABBCBABABBABCBCAABABABAABC.exe
1652	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBABCAABCBCBACBACBABCAACACBAACCABACAACCBABCABACBABCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe"	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCACCBAABBCABBCCBCCCABACBCCCBBBCBAABACAACCBBACBBBCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCAABAABBABCACCBBBBCBACCCAABBCBABABBABCBCAABABABAABC.exe"	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5456	sc.exe
3552	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2352	cmd.exe
2156	cmd.exe
2320	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCAABAABBABCACCBBBBCBACCCAABBCBABABBABCBCAABABABAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4148	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
4148	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
4148	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
4148	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
4412	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
4412	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
4412	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
4412	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
828	svchost_AABCCAABAABBABCACCBBBBCBACCCAABBCBABABBABCBCAABABABAABC.exe
828	svchost_AABCCAABAABBABCACCBBBBCBACCCAABBCBABABBABCBCAABABABAABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	4412	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
Token: SeDebugPrivilege	828	svchost_AABCCAABAABBABCACCBBBBCBACCCAABBCBABABBABCBCAABABABAABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 2156	4148	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe	92
PID 2156 wrote to memory of 5904	2156	cmd.exe	94
PID 4412 wrote to memory of 5920	4412	svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe	95
PID 4148 wrote to memory of 2320	4148	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe	98
PID 2320 wrote to memory of 5456	2320	cmd.exe	100
PID 4148 wrote to memory of 2352	4148	2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe	101
PID 2352 wrote to memory of 3552	2352	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_8edea4ec8b35a0c1721a076cbce052b8_amadey_darkgate_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCBCCBABBBBBCAABAABAABCACCABCCCBACBABCABBABACBBACACABCAABBAABBBABAACBABBAACAAABBCCCACBABCAAACCAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCBCCBABBBBBCAABAABAABCACCABCCCBACBABCABBABACBBACACABCAABBAABBBABAACBABBAACAAABBCCCACBABCAAACCAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACBAACBCCAABBBBBCABACACABBCCAACABCCABAAABABBCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe" start= auto displayName= "UserDataSvc_AAACBAACBCCAABBBBBCABACACABBCCAACABCCABAAABABBCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACBAACBCCAABBBBBCABACACABBCCAACABCCABAAABABBCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe" start= auto displayName= "UserDataSvc_AAACBAACBCCAABBBBBCABACACABBCCAACABCCABAAABABBCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACBAACBCCAABBBBBCABACACABBCCAACABCCABAAABABBCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACBAACBCCAABBBBBCABACACABBCCAACABCCABAAABABBCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCAABAABBABCACCBBBBCBACCCAABBCBABABBABCBCAABABABAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCAABAABBABCACCBBBBCBACCCAABBCBABABBABCBCAABABABAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
1⤵
- Executes dropped EXE
PID:1652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dacc85620b636c080126b26620bc840e57d64e2a091f259e1a8d1ecd22163618
MD5 2fff3069432a4eb8e4d37ef823d7fd3e
SHA1 8f6bb5c256738e8282cc246780de6b3b74e34ad4
SHA512 d6ec57875dc53f0c24c7b39eef8eb4210f08a8191b501e9c5fea9f16f51f5ea81ca0a10a097f63d1eb5f39ec33eff39d7c5f8855636649df41a7ee4ae78cd849
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fe0da0b9cafc4d6f45bb67344322e2830bf91c9dc7bdd320a26499414c223f8e
MD5 1cf827596d52073ab8fee8aba5b69977
SHA1 11f28215f081e790be5aa31b6b80d97ac1e0db1d
SHA512 ea607d464006171961088d1c4b8c94550c3e4bbd5bddbcdd126f4c79072c71f3788d824e47363e2f627df52d2521072bb57fe5e5ab680487029397d4eb8de4e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1d7a315032a99842c11688b3ea7a64801fd4f4d904b5f3d7a1ba903682ec666
MD5 a062c2f8e98b28e15eb8289cb47bed0f
SHA1 b2bc266404046aeab525ded48465be431837768a
SHA512 784122dc023594636af5e5374e051e42124394d6eb16bba06b5be31725cd45a4b0887fc96a1815dcc7e13268aabb987db554c7f59b5a15407b55c5e04ccfac84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 830467a0433999ada7779ac6108fb71d505b18a034b2e6f3351205ccc1b4c86e
MD5 c8c6f7a4711a5891b2414aa2ba490ce3
SHA1 3069034d4de17a07d7d97c7569311a565d8369b5
SHA512 c6dc30c11b2e4554029fd2d1c960de6a39229c9c97b6ba3de755ec3045bd46352e21a147ecacc086ed5c0cae741efb27d2e4adadbc954e6425fb621f8e7d7d84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f3b4de5cf031bb6219ae518a79691d69f665b5ae1271ff9ebeae713eeb9eb0f2
MD5 4a4ff0aedbb79065516a41870b79a986
SHA1 582bf3443cb744fabf5b5f082ca584430ead2ad1
SHA512 10b7dff0f638256c8b6beca0573a87d3ec65a96876a217d694c9bd567ac67ebfb5d6c5cf303fa9b4a82448a49eadd7629e461c9d76515cf71f5853d03be7ff18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 98450e27dc003acd1d9dd4a8d28b9137fd1c2cf11c91ed183e638b19f7cfc8fe
MD5 856b33fbf33f2dcdc7a3cc85825d1a68
SHA1 c73e43775af9931ce9dcef061fe67ef429f64abd
SHA512 9df790aa1123d981f68bdabd4757bf05b45233df83208f76f084f22e8986588b5974f67847d0c1d12573a384a79bc071ab61bfa98fa2f938fe33c36851bff8b4
MD5 SHA1 SHA512

Submit Download

svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAACACACBCBCACBBCCBBABACAACBCBABBCCBAAAAACBBAACCBAB.exe
Size 5.0MB
SHA256 4526acf7c73b8e1094caf85e9eeb5e5db7f9d080da05ef901dca64e85c3fdcde
MD5 8edea4ec8b35a0c1721a076cbce052b8
SHA1 e2097ea0dbb45cf2be63a6579de4239ef2564a39
SHA512 42780f77187af80c6df2c84557991724dc661d8eaf2c5bfdcb79f720e9f40dd854bffe31204e858dcd8a1d8882a77c37036904c47c7d2f68f63ca128086ffd06
SSDEEP 49152:U+E3qatgl+p+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+E3qatglOr+E3qatgx:g350l350R350l350cp7P
TLSH
T168365C58B7E95161F9B346708CAAC2B65D31BC204F2187EF6680F33D5E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 8ad336b4c593a266f1335f491822bd24d62eceef6cc4998953aaa10b459fa60e
MD5 61e8ab06e4ff766f1f249b054d70c108
SHA1 da617ffab9ce88c9c70e41f1aeea19d6031d4234
SHA512 182c7fdf0f141aa765baf65fa2623af77027341647c947f2a639b9c462268f61d56dba0d95205d1acd4a66921f4762000b8fcb1da15509fd01fc73b7a4223f89
TLSH
T1D5112735F0F5C993F0326897A119DF8728943B9B285CEB78531A8219B69CC788F254A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/828-79-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/4148-0-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/4148-8-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/4412-32-0x0000000000080000-0x00000000000A1000-memory.dmp

Download