f6e58a313460368c9651e314c0f68edfdbb655210bc37d5a3528f4cf7b1710a4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Size 6.3MB
Sample260907-m27fbagd78
SHA256 f6e58a313460368c9651e314c0f68edfdbb655210bc37d5a3528f4cf7b1710a4
MD5 a74b0e2500b3c1b7117a32871b9b52ac
SHA1 385c55add372210334dae69deeeda649f19d3204
SHA512 ecfb4faceb83d3d49ba9dcb73c3800649e1f472f20e872f5a6b765ad8d8d2178613c38455fbf5611a84fa87aed5c3b7b971cb681500cd5b86db152d0612a17da
SSDEEP 49152:U+Ex+E3qatgl+p+EeC5g+E3qatglOr+E3qatgl+p+EeC5g+E3qatgl+p+Ex+E3qa:a350R350l350R350l35087p
TLSH
T121664B49B7EA5161F5B346708CBAC2B65D31BC204F3187EF6680B32D5E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2988	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
4640	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
4280	svchost_CCCCCBAAABCABCACABBAACAABACCABABBCCACBCBABCBBCCCAAAABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABCCABCBCAACACBABBABBBCCBABBCACACBAACCABCCBAAABCCCBBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe"	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABACCACABBBBBBCCBBABCABBBACBACBBBCCBBBCCACAAAABBACACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCBAAABCABCACABBAACAABACCABABBCCACBCBABCBBCCCAAAABAA.exe"	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3168	sc.exe
1968	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4844	cmd.exe
4144	cmd.exe
4920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCCBAAABCABCACABBAACAABACCABABBCCACBCBABCBBCCCAAAABAA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3760	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
3760	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
3760	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
3760	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
2988	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
2988	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
2988	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
2988	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Token: SeDebugPrivilege	2988	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 4844	3760	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe	101
PID 4844 wrote to memory of 4852	4844	cmd.exe	103
PID 3760 wrote to memory of 4144	3760	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe	109
PID 4144 wrote to memory of 3168	4144	cmd.exe	111
PID 3760 wrote to memory of 4920	3760	2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe	112
PID 4920 wrote to memory of 1968	4920	cmd.exe	114
PID 2988 wrote to memory of 4668	2988	svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe	116
PID 4668 wrote to memory of 1908	4668	notepad.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_a74b0e2500b3c1b7117a32871b9b52ac_amadey_darkgate_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACBBCAABCACCCCCABACABBCBCCAAABBCBBAAACCBCACCACABBCCCBBACBACAABCACBABBCBABBBBBBACACCBBCBBCBAAACBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACBBCAABCACCCCCABACABBCBCCAAABBCBBAAACCBCACCACABBCCCBBACBACAABCACBABBCBABBBBBBACACCBBCBBCBAAACBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBAACAABBAACBBBCCBAABACBCCBBBACAABBCCBCABAAACCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe" start= auto displayName= "UserDataSvc_ACBAACAABBAACBBBCCBAABACBCCBBBACAABBCCBCABAAACCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBAACAABBAACBBBCCBAABACBCCBBBACAABBCCBCABAAACCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe" start= auto displayName= "UserDataSvc_ACBAACAABBAACBBBCCBAABACBCCBBBACAABBCCBCABAAACCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBAACAABBAACBBBCCBAABACBCCBBBACAABBCCBCABAAACCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBAACAABBAACBBBCCBAABACBCCBBBACAABBCCBCABAAACCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBAAABCABCACABBAACAABACCABABBCCACBCBABCBBCCCAAAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBAAABCABCACABBAACAABACCABABBCCACBCBABCBBCCCAAAABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f44ea6cb4c1be2d0e568d48fb041cadc78cdc1239e5d3ee28ede7019cbe4e571
MD5 1e0e8cf8e382181038690646c1d89060
SHA1 ce5af875dea8349b740fbc02c3c40da713960e54
SHA512 fc5b3c3402caed2b5a37b03fdf721c110415bd95dbff3f6419903b475aa8860bbdca6d15abb663ea09c480dcbd159a3b4ac96dc631f5f71d24ad165d9a3a5936
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f6af45940c06045264c78806e463063eaa78096505edf63010627ce1b9f34973
MD5 41601ff32743f12252c2f134c9cd33c0
SHA1 01de8d4aeb85053034dc6d7e3f08412ccbe20103
SHA512 d64ea459a7eb417e8c66af70511c0a8e2f54d7dea6ac8cb790bd49697d3e17581c93858b7d8f9ea1f9cbccf28fbd4495f2b9e3c001889258e8a6460cc590fe12
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7522781afb9e17b0e85ebfb89c48d6aeebae7cc94f79a502e81350eb2b61d65e
MD5 8f2c57860343c35c551ea0bae100b36f
SHA1 b32f9a42598b937e84d67326fdfce170fe852757
SHA512 1cc6033a4e566d6060269429fcdce0a1a4d9eb15d46de02dba595ea4bfdb95d60f81df3a16360f9a132a46b4dc49fe468489f4c9e5a2f5b6195c0a1eef6917e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e9c25f493781e23fed65b44cc75b4705da4ca97f86e9efd7a03d67333691b3b2
MD5 1bff55f13dac55c1321b9759a3d2676c
SHA1 3f39b5ab0080b21f25f5699e8da6f1d4e888de1c
SHA512 4c9e2016a0cebe60840558de15f7b08db96eea20cf3cb69dc7e5e8a4dd890bdc1dd79664813b7f1395bcffe7bac645ee0a1788930e24f5f3bea95a59341cea93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 71c819caf2864cfda376eb99cd60dc762c51f78a964899efd61339cd98e0136b
MD5 af625e92e68d1da105c0f4b7bc9754fb
SHA1 9ee0a86bfb4c7f6b091bdaeaea3142f9d6a4f8a5
SHA512 3f994ff63c026f9f2d1aecd497ea87f2ab7eafbe07c300c2a118e7c87be555bfd0914191eca38d60ac519764059f44462868568d304ba37ec7e32e5912487d50
MD5 SHA1 SHA512

Submit Download

svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBABAAAABACCCCACCBCABCCBBACACBCBAAACBBABCACCBBCAAAAA.exe
Size 6.3MB
SHA256 f6e58a313460368c9651e314c0f68edfdbb655210bc37d5a3528f4cf7b1710a4
MD5 a74b0e2500b3c1b7117a32871b9b52ac
SHA1 385c55add372210334dae69deeeda649f19d3204
SHA512 ecfb4faceb83d3d49ba9dcb73c3800649e1f472f20e872f5a6b765ad8d8d2178613c38455fbf5611a84fa87aed5c3b7b971cb681500cd5b86db152d0612a17da
SSDEEP 49152:U+Ex+E3qatgl+p+EeC5g+E3qatglOr+E3qatgl+p+EeC5g+E3qatgl+p+Ex+E3qa:a350R350l350R350l35087p
TLSH
T121664B49B7EA5161F5B346708CBAC2B65D31BC204F3187EF6680B32D5E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2988-25-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/2988-38-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/3760-6-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/4280-82-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/4640-74-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/4668-67-0x0000000005890000-0x0000000005891000-memory.dmp

Download