233a0ec276f3218f28371b80eb7ad30378504fc23aa30035b18c2d2519b5d26d

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
Size 21.1MB
Sample260910-a498rsed98
SHA256 233a0ec276f3218f28371b80eb7ad30378504fc23aa30035b18c2d2519b5d26d
MD5 074f1b05a8f2bcba47df34ce31ec5aa8
SHA1 7548fb55a01a089a53aa93b26b10c7f4bb1eae4d
SHA512 e994deb9a40baa6557d37b22d061afd3c7d7f025c5a11c27c1aabe64fa9473c12ac49661489a68bc22aad5d98c56fc23c01ccbb155097e66a4ac6a0928b76c70
SSDEEP 196608:lqNqNqNqNqCgOvjleqNqNqNqNqCgOvjlA:QooooCgOLl/ooooCgOLlA
TLSH
T126278D06FA8340B1D97B31B009DFE3BF4979772185318DAAF74D8B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
204	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
1892	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
3312	svchost_ACCABACACAAABBABCCCACCCCABCBCABCCAAAACBCCBCABCABAACCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCABAACCACBABCBCBCABCABBCCBCACCCABABCBABCAAABBACBCCAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe"	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCACBACACBCBBACBBAABBBCCBBCCCACCBCBBCCCABBCAABCACBCCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABACACAAABBABCCCACCCCABCBCABCCAAAACBCCBCABCABAACCCCB.exe"	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4612	sc.exe
4524	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4020	cmd.exe
1976	cmd.exe
1212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABACACAAABBABCCCACCCCABCBCABCCAAAACBCCBCABCABAACCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4704	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
4704	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
4704	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
4704	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
204	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
204	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
204	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
204	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
Token: SeDebugPrivilege	204	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4468	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4020	4704	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe	97
PID 4020 wrote to memory of 1344	4020	cmd.exe	99
PID 4704 wrote to memory of 1976	4704	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe	100
PID 1976 wrote to memory of 4612	1976	cmd.exe	102
PID 4704 wrote to memory of 1212	4704	2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe	103
PID 1212 wrote to memory of 4524	1212	cmd.exe	105
PID 204 wrote to memory of 3660	204	svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe	107
PID 3660 wrote to memory of 3952	3660	notepad.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_074f1b05a8f2bcba47df34ce31ec5aa8_amadey_darkgate_elex_rhadamanthys_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACCABBABABAACACBBCBBCCCCBBCACBCABACCBBABCCABCCCACCCACCAABBBCBABCCACABAACAABCAABABBCBABAAABCCCABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACCABBABABAACACBBCBBCCCCBBCACBCABACCBBABCCABCCCACCCACCAABBBCBABCCACABAACAABCAABABBCBABAAABCCCABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACACABBACABACAACABACABAACBCCBBAABBACCCACCBCBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe" start= auto displayName= "UserDataSvc_CBACACABBACABACAACABACABAACBCCBBAABBACCCACCBCBBCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACACABBACABACAACABACABAACBCCBBAABBACCCACCBCBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe" start= auto displayName= "UserDataSvc_CBACACABBACABACAACABACABAACBCCBBAABBACCCACCBCBBCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACACABBACABACAACABACABAACBCCBBAABBACCCACCBCBBCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACACABBACABACAACABACABAACBCCBBAABBACCCACCBCBBCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:204
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACACAAABBABCCCACCCCABCBCABCCAAAACBCCBCABCABAACCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABACACAAABBABCCCACCCCABCBCABCCAAAACBCCBCABCABAACCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0017d75cb8ee4d5054f80ac026fc7e3cfa1ddf112c955e8f0132fe8d70cded0c
MD5 aba276f1b7d43786489c03f4341459d5
SHA1 80f9ba32d8212370234209e54a79d3be7b739e4e
SHA512 f44adfd6f0ae9c15cfe7cfbe28c1d7b06a41d1653a33aa5ffce1c460f0a2c293ea8921f6e45ce21ad2539124f08512e4a46988c8ee1b0cf4255f98719ad074e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3fdead9e106c52990e83b4dd756f4f3a23014178ca4e7bf015c8a674fc71cc6
MD5 37cf33675f081a71260caaa1ed68aab6
SHA1 122c8c95bdb86c168458a574fd8b447bb74eda99
SHA512 4e7bbaff315632d7a60ae31c7b9dedbd52089400c714e664456d3ad0de76dccaa8e12a7aa4904d3438fa05e4fbb6e237caa14c6cab595fc8bd35c057f2996213
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dab6af1e8c7abf8cbfd57b7bc265f540fb18dbc171e69f09a275039e6f7f21e9
MD5 a5391a64b6f9fea465069da41e13a694
SHA1 2dd0b8a03a273093d9448ee57264df34b09dda84
SHA512 6ca02332a59a9e1fd8b20360bfc14686702465cc6446bcf5757b71f5d6ae2d14dabc7de986494e8a000c2c9bdf129a9485f98100872d756540fd10df9c909416
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4699babc86ee872c8f9d3b593e0c199b85d637b7e8053b6d1d2453878d81e106
MD5 12c3ef45425f1f0920035594e72910d6
SHA1 c4e3d01c4993100c652f1f85402ea387fe688ec6
SHA512 ae26ce5efbfbaabec3b1e09a92be1bfc91e61a3dbde0fbf5b1967e977eaf50210f1aa8602d532df8675facb5bd0b74d4bdb4180c291417776495860ad59d2875
MD5 SHA1 SHA512

Submit Download

svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBACACCBCABAAABBABAACCBCBBBCACCACAAAACACCACAACBCBBAC.exe
Size 21.1MB
SHA256 233a0ec276f3218f28371b80eb7ad30378504fc23aa30035b18c2d2519b5d26d
MD5 074f1b05a8f2bcba47df34ce31ec5aa8
SHA1 7548fb55a01a089a53aa93b26b10c7f4bb1eae4d
SHA512 e994deb9a40baa6557d37b22d061afd3c7d7f025c5a11c27c1aabe64fa9473c12ac49661489a68bc22aad5d98c56fc23c01ccbb155097e66a4ac6a0928b76c70
SSDEEP 196608:lqNqNqNqNqCgOvjleqNqNqNqNqCgOvjlA:QooooCgOLl/ooooCgOLlA
TLSH
T126278D06FA8340B1D97B31B009DFE3BF4979772185318DAAF74D8B2B6933B51582835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-26-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/204-39-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/1892-75-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/3660-68-0x0000000005420000-0x0000000005421000-memory.dmp

Download

memory/4704-0-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/4704-7-0x0000000000930000-0x0000000000951000-memory.dmp

Download