9e2434adbc774f7d9a8d7bf217ee61d83d7856172149b90fb1c6d643b4933b14

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe
Size 17.1MB
Sample260907-kthe4sfp21
SHA256 9e2434adbc774f7d9a8d7bf217ee61d83d7856172149b90fb1c6d643b4933b14
MD5 fe9a68bd027c99ce00d90d6ce96781c7
SHA1 29f4e12d1a5f4289a1cf9a46d9a67a736976b416
SHA512 0ef95ca763915fd6e5983fef94da4b33672b0d02f94e87757f3d0ffa002f634e2ac7c71f4f39a3156d642a592a9e2128652d17fcab3003e8402c0de0bc0a10f0
SSDEEP 98304:a350R350l350R350l350R350l3501l350R350l350R350l350R350l3504p7V:E5y5O5y5O5y5O565y5O5y5O5y5O5HV
TLSH
T1D0074B48BBEA5151F9B346708CAAC2F65D31BC204F2197EF6680F32D5E326D0E539B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2556	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
3508	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBBBCCABCBBABAABAABBAABACCBACCCCBABBABACBBBBBAABABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe"	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCAABBCBACACCBBACABABBBBCAAABBCCACCCBAABAAABCCBCBACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCCABACACCBCACCABCBBABAAAAABBCABCBCABAACBBCBACBAABCBA.exe"	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4948	sc.exe
5492	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2528	cmd.exe
708	cmd.exe
1664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5336	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe
5336	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe
5336	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe
5336	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe
2556	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
2556	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
2556	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
2556	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5336	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe
Token: SeDebugPrivilege	2556	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 2528	5336	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe	92
PID 2528 wrote to memory of 580	2528	cmd.exe	94
PID 5336 wrote to memory of 708	5336	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe	95
PID 708 wrote to memory of 4948	708	cmd.exe	97
PID 5336 wrote to memory of 1664	5336	2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe	98
PID 1664 wrote to memory of 5492	1664	cmd.exe	100
PID 2556 wrote to memory of 1496	2556	svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_fe9a68bd027c99ce00d90d6ce96781c7_amadey_darkgate_elex_glassworm_stop_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCCBBBABBBCBCCAAACCBBAACCABAAACBCBACBCAABBBACABBCABBBCCBBBCABACCBCBAACCCABBACAABCBABBACCCCCBBCBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCCBBBABBBCBCCAAACCBBAACCABAAACBCBACBCAABBBACABBCABBBCCBBBCABACCBCBAACCCABBACAABCBABBACCCCCBBCBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBCCBBCCACCCCAABCBABCCBBACCCBBCBAAAACBCACCCCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe" start= auto displayName= "UserDataSvc_BCBBBCCBBCCACCCCAABCBABCCBBACCCBBCBAAAACBCACCCCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBBCCBBCCACCCCAABCBABCCBBACCCBBCBAAAACBCACCCCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe" start= auto displayName= "UserDataSvc_BCBBBCCBBCCACCCCAABCBABCCBBACCCBBCBAAAACBCACCCCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBCCBBCCACCCCAABCBABCCBBACCCBBCBAAAACBCACCCCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBBCCBBCCACCCCAABCBABCCBBACCCBBCBAAAACBCACCCCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
1⤵
- Executes dropped EXE
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02a5af87bec72d963aba4ab7f8a6f1a1ef1179d4b833fa94b99c5b3845d5bc7f
MD5 bb1ed237d29c5282f8e491a51bf93054
SHA1 c6dee749d393ce3113c0e0f3828bd5f90ee22035
SHA512 e55fe7aa009e7c62a62d87327adfbc0de97cd412918d794ad4b1a6867e9963ee826add0cea5b4c8cb2a26b311d940e1025df996d3eb60a57c922b82fc23445cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f74a11f507e0b0b0d87dad84f27ede0c8fd687b7bdb5d3bd6e45bdba9c594fdc
MD5 dbc0e9f3796505deb7236f208fa55762
SHA1 271bd28d73b3cf44a428f44ad83ce8f727bc3819
SHA512 7e90b600c44b30cc8ce39c309d7d9baf0ac6a0c27370f81bb631d08f37222011176de43fa51feb5375105aaeea3d0a106a2c391613c4739e2553b91c11da007b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b1b1933cdd13023bd5d5f8e80ddf73c34b8a97481a2d247c5e445613250d907
MD5 19bb23bd97847ea3c028b47a0ab95a71
SHA1 d442cc13c62444738fa6c24243a8180679bb5059
SHA512 108f8ca57f90379ffec3243c72a5eb44e0c9d2d7fde96d3b387acb642699f4f4f04f9cefdeb131f4530e41ef6ed6078ee2c71f1bb2e50362fc4007151206786e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cd66faebfff31948ea11a9751e44ef51eb41f062be86f3cbd78f19c5af62a968
MD5 35bd679ef9ea329271d3f0cbf001fe51
SHA1 8d08b0e6843d4309c3934fb18df5facf25fd7cd3
SHA512 b53343957e7002fffd4afacc259ab8dceb63ee0ccfd65db680c9afe19b7fd12fc809cde67ea5c2ac05d16d58a191efd6e323ad440867c1fa5a25b55cf05dda10
MD5 SHA1 SHA512

Submit Download

svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACBACACCACAABACCCABABCBAAACCBAACBBBACBBAABBBCAABAC.exe
Size 17.1MB
SHA256 9e2434adbc774f7d9a8d7bf217ee61d83d7856172149b90fb1c6d643b4933b14
MD5 fe9a68bd027c99ce00d90d6ce96781c7
SHA1 29f4e12d1a5f4289a1cf9a46d9a67a736976b416
SHA512 0ef95ca763915fd6e5983fef94da4b33672b0d02f94e87757f3d0ffa002f634e2ac7c71f4f39a3156d642a592a9e2128652d17fcab3003e8402c0de0bc0a10f0
SSDEEP 98304:a350R350l350R350l350R350l3501l350R350l350R350l350R350l3504p7V:E5y5O5y5O5y5O565y5O5y5O5y5O5HV
TLSH
T1D0074B48BBEA5151F9B346708CAAC2F65D31BC204F2197EF6680F32D5E326D0E539B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2556-24-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/2556-37-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/5336-0-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/5336-8-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download