8c40634a275e2f0cd5bc56e5a50db854556d8ba2815b2e3005ed54fb559c53f9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 14.4MB
Sample260910-c265fadk4y
SHA256 8c40634a275e2f0cd5bc56e5a50db854556d8ba2815b2e3005ed54fb559c53f9
MD5 d09de24040359f5b50c57589a547b95f
SHA1 957b0e18a0d3ed5e57d4e966875ef92d5259fb4a
SHA512 d76ca396e2a9f3f3b7a306c975c872ebb460bfe0793b64c4ed94f92272f971670200422e4a135985c9c5d598a60799b8c2b2c325e4b6a43f1c7ec89e0cf6b54b
SSDEEP 98304:3KRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5aG:3qUqUqUqUqUqUqUqUqxKWQc0gEYnvL1
TLSH
T1E4E6B012F6C20071EAB7357009AFE37A5D7D772146358D9EE7884A3F5E32E80692835B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3888	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
4912	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
1184	svchost_ABBBCBACBBCACCABBACABACCCABBACCBBAACBBCAABBBBABBCACAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABBBBABAAAAACCCCCCBCCCACABCCCCBACACBCAACCBBBAACCABBABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe"	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABAACACABCABBCBBBCBACAACACABACBABBBCBCBBCCBCBCCCCCABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCBACBBCACCABBACABACCCABBACCBBAACBBCAABBBBABBCACAAAB.exe"	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4956	sc.exe
2896	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2064	cmd.exe
2744	cmd.exe
1988	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCBACBBCACCABBACABACCCABBACCBBAACBBCAABBBBABBCACAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4608	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4608	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4608	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4608	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3888	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
3888	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
3888	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
3888	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3888	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3720	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 1988	4608	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	95
PID 1988 wrote to memory of 2376	1988	cmd.exe	97
PID 3888 wrote to memory of 1528	3888	svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe	100
PID 4608 wrote to memory of 2064	4608	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 2064 wrote to memory of 4956	2064	cmd.exe	103
PID 4608 wrote to memory of 2744	4608	2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	104
PID 2744 wrote to memory of 2896	2744	cmd.exe	106
PID 1528 wrote to memory of 516	1528	notepad.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_d09de24040359f5b50c57589a547b95f_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBCABBCACABCBCBCBAABBCABBACABAACACCAABCBBACAAACBBCAAACBBAAACCBAABACABBBBAABAACBCACBCCACCCCACBACBAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBCABBCACABCBCBCBAABBCABBACABAACACCAABCBBACAAACBBCAAACBBAAACCBAABACABBBBAABAACBCACBCCACCCCACBACBAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCCAABBCACBCACACBCABBABACCBCCACABBACBABBAAAABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe" start= auto displayName= "UserDataSvc_CCABCCAABBCACBCACACBCABBABACCBCCACABBACBABBAAAABCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCCAABBCACBCACACBCABBABACCBCCACABBACBABBAAAABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe" start= auto displayName= "UserDataSvc_CCABCCAABBCACBCACACBCABBABACCBCCACABBACBABBAAAABCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCCAABBCACBCACACBCABBABACCBCCACABBACBABBAAAABCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCCAABBCACBCACACBCABBABACCBCCACABBACBABBAAAABCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBACBBCACCABBACABACCCABBACCBBAACBBCAABBBBABBCACAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBACBBCACCABBACABACCCABBACCBBAACBBCAABBBBABBCACAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9a3d7b556dac236f6b8647b4375d1286764860efe166facad8f25b138339f179
MD5 5f9a54e5738c7044257389102241ef1c
SHA1 da29afe1c67295856151ad572cd9a71354f8a4c0
SHA512 b1f686958b9ac037bf31b8eb78097c84a255564948d78993615c3054a0624a920b3c2c2be1e7abdfbfbb081f008a2e2c0279ec144b7b00e700c84d0c50c90a39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5da0ed78515d47b213d55558814310a3a560bea1371e23efa37a5fa648f14db
MD5 80c589a1a2ee7c5a7c52094f589ca8cb
SHA1 8bda539090812d4e3ca53f88f6ea70f40887f8ad
SHA512 66d5542ad97055d15b3850c505588e18c2532ae7cc04c655c8be508e6e6b0b79888df0f2c7cce9d6334a5c45c59c5c6e5c256a59f136eb2d8f9dcc7794c3308e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8ab819d83440d135d6f13f850c8c377c5223c5a071f6039fbe91429403b2c998
MD5 5dd9ddd5277751deb2e0cc70606f17f3
SHA1 6c811a871dbdc520223da8f737f1e18712c2eb18
SHA512 8868b156babf3cb29e1b36b98fc7fd8b07614624b08f11a8c30e7af6bb52a4b3e1325bf80269282536a04b1bf940ad2bfb39a996e9251f236b41a97f03c95637
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e2ecd8c666443f2a5cdf5cd9f4ddd0a74c527327e8eb2cf476d227828a374e8c
MD5 333ee72aa45dcc28dddc58c889d38457
SHA1 2b9c2304483b3494f8a333ad2b4933c298da563e
SHA512 86b451decba89c6bec768f99234dd069931cd1ff35dcee01b27e76dfab0ef142294fd63ce9d26fdd92b47a0974e0d13c826ed8ec8c2890231ea0e6cee72d6181
MD5 SHA1 SHA512

Submit Download

svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACACCABCACCAABCCCBBCCCBBABACBCABCACABABACACAACACACCB.exe
Size 14.4MB
SHA256 8c40634a275e2f0cd5bc56e5a50db854556d8ba2815b2e3005ed54fb559c53f9
MD5 d09de24040359f5b50c57589a547b95f
SHA1 957b0e18a0d3ed5e57d4e966875ef92d5259fb4a
SHA512 d76ca396e2a9f3f3b7a306c975c872ebb460bfe0793b64c4ed94f92272f971670200422e4a135985c9c5d598a60799b8c2b2c325e4b6a43f1c7ec89e0cf6b54b
SSDEEP 98304:3KRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5axKRuy5aG:3qUqUqUqUqUqUqUqUqxKWQc0gEYnvL1
TLSH
T1E4E6B012F6C20071EAB7357009AFE37A5D7D772146358D9EE7884A3F5E32E80692835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1528-67-0x0000000002D50000-0x0000000002D51000-memory.dmp

Download

memory/3888-27-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/3888-40-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/4608-0-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/4608-7-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download