b44ff3edeb96edea95628058830c86f0a9df6d09d6c7dd0c0ba8e8c943daf151

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 9.7MB
Sample260908-r9fpsasfnd
SHA256 b44ff3edeb96edea95628058830c86f0a9df6d09d6c7dd0c0ba8e8c943daf151
MD5 895639f832f1dc21c9e48cd2649c33e1
SHA1 b97c0ae2805db512ea38e399358954aaad9b6000
SHA512 462687f313ce902e8329a9930cb591224a0a5bf9f020de39185bf598d6be61f9509d4ab7078e68d6b67d1d9258996f952ea2ec8f85d12866dae239e1d5b8bf8b
SSDEEP 98304:F5r5r5r5r5r5r5r5r57OU/jIEeQfoR/IuOFVjUu5c:F5r5r5r5r5r5r5r5r57FIF0wum
TLSH
T121A66C19FA835071D93750B04CCBD2FE9D70BA2183214EEFF64DEA1B6B22AD1A439715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4516	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
3092	svchost_CABBACBCBBCAACABBCBCCABBBCAABBACBACABABAAABCBCABACABBBC.exe
5036	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBABBBBCAAACCCCCACBCCABBCABACCCAABACABBACACAABBBABACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe"	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCCCCCCBABCBCAABCAABCCCABBCBAAACCABBCBACBBAACCBCCCBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBACBCBBCAACABBCBCCABBBCAABBACBACABABAAABCBCABACABBBC.exe"	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4076	sc.exe
2816	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5616	cmd.exe
2288	cmd.exe
5928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBACBCBBCAACABBCBCCABBBCAABBACBACABABAAABCBCABACABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4232	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4232	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4232	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4232	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4516	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
4516	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
4516	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
4516	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
3092	svchost_CABBACBCBBCAACABBCBCCABBBCAABBACBACABABAAABCBCABACABBBC.exe
3092	svchost_CABBACBCBBCAACABBCBCCABBBCAABBACBACABABAAABCBCABACABBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	4516	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
Token: SeDebugPrivilege	3092	svchost_CABBACBCBBCAACABBCBCCABBBCAABBACBACABABAAABCBCABACABBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 5616	4232	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	92
PID 5616 wrote to memory of 2796	5616	cmd.exe	94
PID 4516 wrote to memory of 5668	4516	svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe	95
PID 4232 wrote to memory of 2288	4232	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	98
PID 2288 wrote to memory of 4076	2288	cmd.exe	100
PID 4232 wrote to memory of 5928	4232	2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 5928 wrote to memory of 2816	5928	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_895639f832f1dc21c9e48cd2649c33e1_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBACCCABBACBABCACCBABCAACABBABBCBCCCAACCCBCCBCBBBCCBACACCAABCCBBBBCBBBBBCBCACAABCBCBCAAABCCBACCBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBACCCABBACBABCACCBABCAACABBABBCBCCCAACCCBCCBCBBBCCBACACCAABCCBBBBCBBBBBCBCACAABCBCBCAAABCCBACCBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCAABCAABACCCCCAABCABBACCAACACCBBCACBACBBBACCBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe" start= auto displayName= "UserDataSvc_BBCAABCAABACCCCCAABCABBACCAACACCBBCACBACBBBACCBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCAABCAABACCCCCAABCABBACCAACACCBBCACBACBBBACCBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe" start= auto displayName= "UserDataSvc_BBCAABCAABACCCCCAABCABBACCAACACCBBCACBACBBBACCBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCAABCAABACCCCCAABCABBACCAACACCBBCACBACBBBACCBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCAABCAABACCCCCAABCABBACCAACACCBBCACBACBBBACCBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBCBBCAACABBCBCCABBBCAABBACBACABABAAABCBCABACABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBCBBCAACABBCBCCABBBCAABBACBACABABAAABCBCABACABBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
1⤵
- Executes dropped EXE
PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 141ff5f747520c0c90ef32d5abc295c6d7706809854bb3db13b79d1eaa85931b
MD5 c17d368ba4b1ff3a2c97377a62293925
SHA1 eea7b506300bb652673c99030a9f93f149ab7a52
SHA512 e9a8e1bd6c50f98bafe48bb8ed7e78daa4672f39eebb6396e989abd19253bf22a771269780f43af00dd4eec45fcbed7e0020d45742c1eb10e413a3c2ca4b6b75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f244d057a4fed92554fd1acbfe1c4568d62c5f13c2e7b37e6bbf1e186ca14ea
MD5 5223706cfada018f438513c9f5f6dbb6
SHA1 979b8d78961fd82cef1251c6eea5ed8789caf275
SHA512 3246777b780eb0e0de77314c58324548fe634a3dfb4a85cab76d7a4e6a1f7f0e0d020c12b6f6cd44ca150e8d4cde5c193547ab7ad5c8dcc44c24988883753e90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c6d8928e245357711588f2c4413d8f8860dcbf915a3cdd342e40828c7e04809
MD5 e935e0e130ecaf63d13eccfdd7a02785
SHA1 1dcee97d4de808274da704afb293facb44619a91
SHA512 071a989122dbe17d89543b587f502d8a08f8cfd99690f453939207b5060d5861dc2f6db5e516744c075fe073ad45ebe11f6c7a27318de7e482682f73f7d2fb1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 91ee3a5f9e186dc293a37a7d6ce0b0863271d7ba906fafd85a12824a75f39b80
MD5 9188b2d87ed1a44db18eae16acf6d5b2
SHA1 8c45c33ae1fdbd5afa7b4fa3399c32e98af50079
SHA512 add5ed3c6f3cd591bd33ce15dfa06b5135e0480e8b2313a2667884e0733065068a283424b40dd98d0e5dc0510cbbe0b45d3ab3f0a5a59284ad31e37a6dfd2275
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bb14026eec9e207036d3cbe7f3bc2d7f195737f96e1723b59a0716c56b0d516
MD5 0326c1573244d0cfd1b93511a1bfba13
SHA1 455a9bc0dc9acf4e0ae37da8c9dcc5b2f7c6d3dc
SHA512 11446b729ecadf409ce36323952cc682ea4da4912d2ccbd32855aca475762fb2babf70430be66d7283ee2a66dc351964121ed7e5ca01105653ed9fa7e4e2ca11
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ee89640ce2490dfd6afcc5f95d3786c2b172b687e3a0dfe0325f17e10d2d1b6d
MD5 3bd0cd2d3823e9ec23ff39a563cb2b88
SHA1 35c6806f6dd435c629bd74f697ff9834530d3ce0
SHA512 1419c598b7664a12d65c25ba764cac28a2eac9d2b983f111c20ad567188507c7e4140cb53ed7834d80400b404ae2252b6a45e811f7f74d5bd45e37bb73c44752
MD5 SHA1 SHA512

Submit Download

svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABCCBCACCCCACBBBCCBCABCBBCABACABABCCCACACCCCACCBAA.exe
Size 9.7MB
SHA256 b44ff3edeb96edea95628058830c86f0a9df6d09d6c7dd0c0ba8e8c943daf151
MD5 895639f832f1dc21c9e48cd2649c33e1
SHA1 b97c0ae2805db512ea38e399358954aaad9b6000
SHA512 462687f313ce902e8329a9930cb591224a0a5bf9f020de39185bf598d6be61f9509d4ab7078e68d6b67d1d9258996f952ea2ec8f85d12866dae239e1d5b8bf8b
SSDEEP 98304:F5r5r5r5r5r5r5r5r57OU/jIEeQfoR/IuOFVjUu5c:F5r5r5r5r5r5r5r5r57FIF0wum
TLSH
T121A66C19FA835071D93750B04CCBD2FE9D70BA2183214EEFF64DEA1B6B22AD1A439715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c169ba0ac3aa1a4417809770810cbdba90cfb5fb3da9bc0e048bf41ef6e97baa
MD5 e3769491ff83a7883bd310ae95c2d2a9
SHA1 68b3f12a7302edfce9451c36ce0a51a38bbcb699
SHA512 dd6cd43e68883440e2a8d0f964e7fb58139f984584f725d55a2183db1777a92f5a17411a1f13f4d6aae5297682a3b307d4365cf05e8b4add2940f63906b70cf9
TLSH
T1B611E750B4A5DC93E8317487A526CFCB5CA43F9BEC58AF1C23488219AFC5D39CD59096
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3092-70-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/4232-7-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/4232-0-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/4516-24-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/4516-34-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/5036-81-0x0000000000460000-0x0000000000481000-memory.dmp

Download