170b5fd227d22d1ba9500c9935b80432c73ce1bb956c98e6bd105325df002283

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe
Size 26.5MB
Sample260907-w4hdms1wft
SHA256 170b5fd227d22d1ba9500c9935b80432c73ce1bb956c98e6bd105325df002283
MD5 6e573bb9fdb7ba8b95bb063a16cd0fba
SHA1 39ad184ffebbf7e97b3dfa5cd5a1e95c215b26c8
SHA512 44a6a72ef2139bd2e71fd5307ceb38b4e3828ebd7a2ceef7b0b7ab44e421daa837c44565e3cc9d1a78028d1dd08375d31c3424ffba676826cfdda4861be288fd
SSDEEP 49152:U+ESgX+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgsAoK+Es:Jp7e
TLSH
T138572B09F98340B1D82B51B04DCBD3BF8A70BB2586128EFBF74DCB5B6933BA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c534-26.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2612	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
2280	svchost_BBACACCBAAAABACCBABCAAACBBBCCBCCACBBABCAABBABBAAABACCAA.exe
2412	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBCAACCCCABBBBBACCBCBCABCBBCACBCBAACABCAACACCACABBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe"	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACCCBBAABABAABAABCCABABCBBCACBCCBABACCBCABABCAABCCBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACACCBAAAABACCBABCAAACBBBCCBCCACBBABCAABBABBAAABACCAA.exe"	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3936	sc.exe
2720	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2664	cmd.exe
2312	cmd.exe
3444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACACCBAAAABACCBABCAAACBBBCCBCCACBBABCAABBABBAAABACCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5992	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe
5992	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe
5992	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe
5992	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe
2612	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
2612	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
2612	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
2612	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
2280	svchost_BBACACCBAAAABACCBABCAAACBBBCCBCCACBBABCAABBABBAAABACCAA.exe
2280	svchost_BBACACCBAAAABACCBABCAAACBBBCCBCCACBBABCAABBABBAAABACCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5992	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	2612	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
Token: SeDebugPrivilege	2280	svchost_BBACACCBAAAABACCBABCAAACBBBCCBCCACBBABCAABBABBAAABACCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 2664	5992	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe	92
PID 2664 wrote to memory of 2296	2664	cmd.exe	94
PID 2612 wrote to memory of 1992	2612	svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe	95
PID 5992 wrote to memory of 2312	5992	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe	98
PID 2312 wrote to memory of 3936	2312	cmd.exe	100
PID 5992 wrote to memory of 3444	5992	2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe	101
PID 3444 wrote to memory of 2720	3444	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_6e573bb9fdb7ba8b95bb063a16cd0fba_amadey_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBABBCBBCABABBCACCBACACABBBCCAACACCCABBBBAACCBACBCACBBACBACACAABBCCBBBAACAACAABCBBBABBBBBCCABCACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBABBCBBCABABBCACCBACACABBBCCAACACCCABBBBAACCBACBCACBBACBACACAABBCCBBBAACAACAABCBBBABBBBBCCABCACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCABCBCABBCCBCCBCCCAAAABBCAAAAAAABAABBCBCCAAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe" start= auto displayName= "UserDataSvc_CCABCABCBCABBCCBCCBCCCAAAABBCAAAAAAABAABBCBCCAAACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCABCBCABBCCBCCBCCCAAAABBCAAAAAAABAABBCBCCAAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe" start= auto displayName= "UserDataSvc_CCABCABCBCABBCCBCCBCCCAAAABBCAAAAAAABAABBCBCCAAACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCABCBCABBCCBCCBCCCAAAABBCAAAAAAABAABBCBCCAAACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCABCBCABBCCBCCBCCCAAAABBCAAAAAAABAABBCBCCAAACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACCBAAAABACCBABCAAACBBBCCBCCACBBABCAABBABBAAABACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACCBAAAABACCBABCAAACBBBCCBCCACBBABCAABBABBAAABACCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
1⤵
- Executes dropped EXE
PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70c8c7484869f734dfec4cf6d5d1fdf1e43213cbeba5aba84564dca7d47d2c76
MD5 419e2be12fcc7fd1cee847d09c952a65
SHA1 a9d9a5c88c794853bea3fe57fdfd889a72bd8796
SHA512 7c59836fa777376f3ee7d90d4627912568b76468d07eeee1eafee24481300df9a32462bbf48e7f7ba49632ae9f8537c5608a625b08d8b7d1ae4157f926cfce27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ea01f9a017ec157e2f6659a376faaf03e6ff805da8488e503e76560bc128ec2
MD5 e6a56af9d46c1005fed8e2192b745dfa
SHA1 99f4d3d5286fcdcc245e272cdd572f705780b6e5
SHA512 981382982a81fe32d3a16698d271049931b21abd2e8810a73b74ef787a46aa34cb87162c2a0ec954ca2a032eee5990340ccefa05ea939b3ad2e1d15bc0505a19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 06b9dd9822ea8f14086847d67ec93cd5c4bf6c1830966b3d217714eb9414a45e
MD5 f8fcb4d28a979fb7de87f75391ffa5e7
SHA1 77be9de29a9a5a06505bed0aa69f81acb1e70973
SHA512 f910afc5dd5ee58067ba8cd5715476eb58b9683881bde9100bc6ff71fb8d529aa5357395b303f6ec2899d8490ad7482fe6edc129ff9d352b22a7337d3d077455
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 685b0a9745ace860e23f831ff528ce3daed2e8fbecb3fdb219fe845774006659
MD5 f30d23cd7d5fc24b462ab57bc529b1d7
SHA1 e4c40da15317924eb9f0c4db68a4935421d902bb
SHA512 0c5f7bb054fe6b35158365d2df2c8934d840e5bc2db984105c9fa154b641905feae6f741199689c8b3b82207db2d5b6d2e8658ada294b3524c6a69f4bec08301
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1de39e811feae80934f7e78d1bc17f419f8523d71f730669ecdbf83bf2881013
MD5 9a97ea6134b575d73f0a5d0620c054a4
SHA1 893969dace145a42228f73d5ea7557aa6bfe60c7
SHA512 8a0f8834a338e42240e75cc8ce912edf91c3e9d8a68ffa09775bcd5ff3958740ef51cb786696c73b5003c5b8d81fd31d293cd610ac182c957e23a0ef9026d2fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bb2814d0271ea71e1fb9aa774121dce141c60bc208277fa99d4ef4b4f5043828
MD5 1e882d27be52094485a59c732bd3ba6a
SHA1 e9095020d7c44df7ecfdb22e0e65858b375919f1
SHA512 c652f68b59b552a081303889bb092a526b072061ddf97eb96ccc08eea7a486cc4150db9bdeaeed19da9c520363ae1ac87c4dd5a22eee4757a4ba00f1e76230f2
MD5 SHA1 SHA512

Submit Download

svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCCBCABCABAABBCBCCCBAAABBCCBBCACCBABACCACBCABAACCCCB.exe
Size 26.5MB
SHA256 170b5fd227d22d1ba9500c9935b80432c73ce1bb956c98e6bd105325df002283
MD5 6e573bb9fdb7ba8b95bb063a16cd0fba
SHA1 39ad184ffebbf7e97b3dfa5cd5a1e95c215b26c8
SHA512 44a6a72ef2139bd2e71fd5307ceb38b4e3828ebd7a2ceef7b0b7ab44e421daa837c44565e3cc9d1a78028d1dd08375d31c3424ffba676826cfdda4861be288fd
SSDEEP 49152:U+ESgX+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgsAoK+Es:Jp7e
TLSH
T138572B09F98340B1D82B51B04DCBD3BF8A70BB2586128EFBF74DCB5B6933BA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ffa9629d211f2f1960eef823285dc6b456ac5800b1caa10dd6ffddb4d7e9a6bd
MD5 3d81895a6d0c893a0d0854faf89cecf0
SHA1 7c08adeb24e8bc5dcf3b0497156275ef113c6701
SHA512 f75c4af1d97af40c1e61f007e47e61d5ff37ba793cd002f16bdc57b0471e4ff2b0f43c01b2ed4c5defb511f06a5705c71d07b19487f74d18407b0f2e064ecd31
TLSH
T121110D51F0A9D4F3E13128C7952ADA470DE03B5F699CEB1853094318B7B2C3BBD154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2280-100-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/2412-106-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/2612-48-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/2612-33-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/2612-71-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/5992-22-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5992-85-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5992-0-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5992-59-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5992-11-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5992-34-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download