0af9135fa84df14f2fdd6e18deb445b1c0b8e58c68c8aaa7a508b0464c5d090a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe
Size 17.9MB
Sample260910-2dpmxsyyfy
SHA256 0af9135fa84df14f2fdd6e18deb445b1c0b8e58c68c8aaa7a508b0464c5d090a
MD5 e2081f35c4741755dc8d41e8899d6285
SHA1 5eed992da700686eb34c01da6677ee4b09f3346d
SHA512 875ca8e925e9e3074fe6c6e57b6b740cb9273930660722850127d2d372febb262cc8813dc195668d06a4866b5780e65a2a6fd5eab8ab7c3048a9d0f689e913ef
SSDEEP 49152:U+ES+EN+E2+ES+ES+ES+ESf+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+EF:Ap7ep7GKRuy5am
TLSH
T16C173C09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DC75BA933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2500	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
4432	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
4200	svchost_BBABBCCCBABBABABBBBACCBCBCBBBBBCBBCCCABCCBAAAABACBBBAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABCBBBCCABABCCAACAAACAABBCCACCCAAABBBCCAACABBBCBCCBABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe"	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBCBBCBCCCBABABCBCACCBBBCAACAAACCCBCAAABBAABABCBCBBCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBCCCBABBABABBBBACCBCBCBBBBBCBBCCCABCCBAAAABACBBBAAC.exe"	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2968	sc.exe
4424	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3900	cmd.exe
4500	cmd.exe
4812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBCCCBABBABABBBBACCBCBCBBBBBCBBCCCABCCBAAAABACBBBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4472	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe
4472	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe
4472	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe
4472	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe
2500	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
2500	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
2500	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
2500	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe
Token: SeDebugPrivilege	2500	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3940	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4812	4472	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe	94
PID 4812 wrote to memory of 3776	4812	cmd.exe	96
PID 4472 wrote to memory of 3900	4472	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe	97
PID 3900 wrote to memory of 2968	3900	cmd.exe	99
PID 4472 wrote to memory of 4500	4472	2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe	100
PID 4500 wrote to memory of 4424	4500	cmd.exe	102
PID 2500 wrote to memory of 3472	2500	svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe	104
PID 3472 wrote to memory of 5044	3472	notepad.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_e2081f35c4741755dc8d41e8899d6285_darkgate_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCCAACACACCBACCCAAACBACBBCBCCBACABBABCABCACCBABCCCBBCACCBACACABCCACCCBABBBCACBBAAAACAABABCCBBAAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCCAACACACCBACCCAAACBACBBCBCCBACABBABCABCACCBABCCCBBCACCBACACABCCACCCBABBBCACBBAAAACAABABCCBBAAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCACBAAABBACBBABCACCABBABAABCCCAABBCBACBCBBBABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe" start= auto displayName= "UserDataSvc_CABCACBAAABBACBBABCACCABBABAABCCCAABBCBACBCBBBABCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCACBAAABBACBBABCACCABBABAABCCCAABBCBACBCBBBABCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe" start= auto displayName= "UserDataSvc_CABCACBAAABBACBBABCACCABBABAABCCCAABBCBACBCBBBABCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCACBAAABBACBBABCACCABBABAABCCCAABBCBACBCBBBABCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCACBAAABBACBBABCACCABBABAABCCCAABBCBACBCBBBABCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCCCBABBABABBBBACCBCBCBBBBBCBBCCCABCCBAAAABACBBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCCCBABBABABBBBACCBCBCBBBBBCBBCCCABCCBAAAABACBBBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1863a8f9c5d51c5cafb54309a6a32790b9de6594128332bd6f732de674be7bf9
MD5 e7ed2ad51bba5ba9b5d4b518061ab403
SHA1 65fbc16da5615698935f51210608e764ff7f2d95
SHA512 7575eb1a69b331d1b5e5c1a3f0c500987556575ed56734c707bd0f45b523f3ccc37c259c0a960cae5930dce0b3188ff179adbd202502a762b0d563cb006eb485
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84312654f65b5f8de3458b2cb7b7e3822ba1342527dd912730d2655871562c00
MD5 7efb12a05f8536e8c80cfc7b9fa5162c
SHA1 dbc0afda38991e7fd0f44c2221701e3a53af9322
SHA512 5a7776a02bc40058ce4c7a1ce59ab298618428770db10b476fa775c47e061362f73a91460679d462e69282329ef3fe184a82f1629e6128ef63bcf24a7c2dca69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ed44ba7296b6fe448c77411cbfb813e45059556fe35052944cd9e43ca2cf7292
MD5 97b567b484abf32eef72599ae69231cf
SHA1 2c35e297df0d402bf9bfb56357b25e337cc13296
SHA512 a22e9f1198cb770c463c3b75612e79cd5196044742eadc22727bb8b7faa3d34311961d853ea584b70d459f24b0d65ff4ca1d587ef391c6132b1c07f27f5faef9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ac05102866a1bae31a200b9c0ac907c3c38d443d1ed585119350ccaa53dc0c38
MD5 9be8a9c6ef971e7d861397c14942772c
SHA1 420f2fe773158725ed2eb1968a3b6e2d59c172c1
SHA512 5720a8e452f72201868ced9fd087c4fd1733ca8c9fe70fe77f45dcfad3480b08a6f4ec461210e3dc125d99a254a05559e39dc92e2a1dd1f8a661a41bf6ace61d
MD5 SHA1 SHA512

Submit Download

svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACBAAABACAABBBABBBCACCCAABCCBACBBACAABBAAABCCABAABB.exe
Size 17.9MB
SHA256 0af9135fa84df14f2fdd6e18deb445b1c0b8e58c68c8aaa7a508b0464c5d090a
MD5 e2081f35c4741755dc8d41e8899d6285
SHA1 5eed992da700686eb34c01da6677ee4b09f3346d
SHA512 875ca8e925e9e3074fe6c6e57b6b740cb9273930660722850127d2d372febb262cc8813dc195668d06a4866b5780e65a2a6fd5eab8ab7c3048a9d0f689e913ef
SSDEEP 49152:U+ES+EN+E2+ES+ES+ES+ESf+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+EF:Ap7ep7GKRuy5am
TLSH
T16C173C09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DC75BA933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2500-26-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/2500-39-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3472-68-0x0000000004C80000-0x0000000004C81000-memory.dmp

Download

memory/4432-75-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/4472-0-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/4472-7-0x0000000000560000-0x0000000000581000-memory.dmp

Download