68686069654d4b62e271c1b902a630ab1790c4e78d25da16bdaac46b0372177e

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_edee962040d466b9910e8426ea40b94a_darkgate_elex_emotet_mafia.exe
Size 2.2MB
Sample260910-cat1ssv1fv
SHA256 68686069654d4b62e271c1b902a630ab1790c4e78d25da16bdaac46b0372177e
MD5 edee962040d466b9910e8426ea40b94a
SHA1 cb81f7f3322269e477ddfa0a5cd8a1e227e67e2c
SHA512 b3d35ba8a130d2d49b3cb856827b5eeeb96260509657a8fcdc42d3e7a39f50247b64ebe86c192f3ed3dc841695f82c6311351c2ae31c86542dd864225e9f95c1
SSDEEP 49152:IT3Aj0CZ3AJNLy4IJnsyRgPr5qfPHR0eh//lQgXMOhQXNWKWnhHzlVd2PtUjRaW6:Zj0CZ3CLyzJLRgPr5qfPHR0e5/SgmgKL
TLSH
T136B5BF32769180BAC233F1708A4EA3FDF3EA96704975524756901F3D2E745A3992C3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4568	hpqhvind.exe
1608	hpqhvind.exe

Loads dropped DLL 2 IoCs

pid	Process
4568	hpqhvind.exe
1608	hpqhvind.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\hpqhvsei = "C:\\ProgramData\\BaiduNetdisk\\hpqhvind.exe"	hpqhvind.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpqhvind.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_edee962040d466b9910e8426ea40b94a_darkgate_elex_emotet_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpqhvind.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4080	1588	2026-09-08_edee962040d466b9910e8426ea40b94a_darkgate_elex_emotet_mafia.exe	89
PID 1588 wrote to memory of 4568	1588	2026-09-08_edee962040d466b9910e8426ea40b94a_darkgate_elex_emotet_mafia.exe	92
PID 1588 wrote to memory of 4660	1588	2026-09-08_edee962040d466b9910e8426ea40b94a_darkgate_elex_emotet_mafia.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-09-08_edee962040d466b9910e8426ea40b94a_darkgate_elex_emotet_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_edee962040d466b9910e8426ea40b94a_darkgate_elex_emotet_mafia.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\expand.exe
  "C:\Windows\System32\expand.exe" C:\ProgramData\BaiduNetdiskXCE58F6DE -F:*.* C:\ProgramData\BaiduNetdisk
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4080
- C:\ProgramData\BaiduNetdisk\hpqhvind.exe
  C:\ProgramData\BaiduNetdisk\hpqhvind.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4568
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Users\Admin\AppData\Local\Temp\240713046.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4660

C:\ProgramData\BaiduNetdisk\hpqhvind.exe
C:\ProgramData\BaiduNetdisk\hpqhvind.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.ldf

Path C:\ProgramData\BaiduNetdisk\1.ldf
Size 114KB
SHA256 943343ed466b6af506540f654371a2bcbf11689966de3c21298b6b74939b4ddc
MD5 ebc584c804707990e5c1f441ed501cc8
SHA1 7958cdc7f49ba50c5c355f03e8f80f7f421c96f3
SHA512 7f06a53fad8cbf6eacadf166f86b2fc0967982de263fbb5dc2504506565a687163fc2ea070afcb202fcfc70c598d02aa32ce6e0c0fc74d1fc1d9f9846140aefa
SSDEEP 1536:m3G4H33uOJhbREkEYCgcahN3J+9x4exxZS2tLxMtmz18XvPgIt9xARV5Em:m3NH33hJhboahJJ+tXULUz18/Yx5B
TLSH
T11BB3F1F1EB471DBFE1AA049807A9BB40EFE4E1A8E611E09553A0B704F6EB3D05F5E501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.mdf

Path C:\ProgramData\BaiduNetdisk\1.mdf
Size 6KB
SHA256 ddfa41046ae454e3c8fc98bedb3d16c7b82aff6de9529b94ca581611ca4709db
MD5 70b46d7cf176bc214e74aabdd276a5f2
SHA1 78c00e1fffb6d0b0c8580a18628e4759a03871ac
SHA512 487a84882f03e84c09ef2459a01edacd0361fb97d69c25f30c1e9cb81ac480937817374b13d3d1a780ba5babadb9bdff4f5326b227ea302baa1398db47cbea54
SSDEEP 192:D4hNzluP2diCUVWOM1YmWsPjei8J7CIj+vKtlukGDOK:DSNzUPrV/PmdTOvj5tlukk1
TLSH
T190D18EA1AFAEC29321FC262A09F6C3F00C6C6727FD33781D66474407A5A705D892D68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.ndf

Path C:\ProgramData\BaiduNetdisk\1.ndf
Size 5KB
SHA256 80f23e2822a020a584c2e0981ad5a69cb8f2dee5c2e5e0ef83b615429f342cd5
MD5 64410a692a4816f1d505db0090b82a2a
SHA1 70f9e83c4fbd63ff21d195231876b0d7a30cf83b
SHA512 0fcf63ebdafb13bab5379cc9985f5b2ff655f0cafa2735ab0ba99f0153bc9bf5311029d3b7d7cc0e10ebea34dc54f63c1cea53a2e0d9e20c45fcb583d80eb03d
SSDEEP 96:Irov8LQfaBoyTSPu+N22gAFz81wf5SVPDBycM66qjm75rrc2GDpaplgqQ:5HaBopTN2QzWwxUPFycr6qqFrrKFbF
TLSH
T173C18F23FCB31052006ED05D2002D753DFE385F9E869625D249AEBCAB64F74E799036C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fszwd.dat

Path C:\ProgramData\BaiduNetdisk\fszwd.dat
Size 67KB
SHA256 1823aafa35a6bbdefa50b1002436c9bfe4ec74b103d5583c54f55c0a7db5f046
MD5 0c02abb8329f845dadb47a444d17baff
SHA1 5a0fd5816c3be8a112b9186bd25fdeda66005f57
SHA512 1bb4931c83cc0651fc88874bcc281e5a3960cc23635d78f37bd8fc880306b553cd4e1c06d9991d8ababfd98102996c5ca1f766e8a4430a61ff936fb8cd60c6bc
SSDEEP 768:sPlzAM7SQ4tjheXp2r7Ih034XohyaSStP6i22A5RDGEnBsngSYEDdGVneAhf/GQC:SzhSep2r7IhIHyFOPlA5RDLnOng1xm
TLSH
T1A6637E227290D872D09B153468B497727E7E7C222AF540CB7FA9173E5F703D0AA78356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hpqhvind.exe

Path C:\ProgramData\BaiduNetdisk\hpqhvind.exe
Size 810KB
SHA256 1dc5d8ba74d2ff1cdfe7b857b6fa9e3c02a38c758a597fbaca546c8bd6063521
MD5 ca9e7dccb0a9ffd5e6247096e863461b
SHA1 c2c47222f21526796294aa4a6b460f567270e2a7
SHA512 4db9606a254e21b799cfdc1ed100cbd907578f717fb857246dd9850cbe254770c3c05ac2e544f6438c1a52423dfa6d075287a3a23b530ee277a7272fa62cce16
SSDEEP 12288:WcCDI+4dKxxZuxIu2Xlei/gkrE1bfrUF3y6Y5PlBBG4H8nzRG9O9MOSFY7MIIFH7:WtQOEv2Xu/fReecnBQ
TLSH
T1B8057C348D02E99CE74A1BFB6C24B2B51C15AC252A989387C7F27FE409F42D3E581B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240713046.bat

Path C:\Users\Admin\AppData\Local\Temp\240713046.bat
Size 191B
SHA256 a90129385d15bbebb35493f7db26714829c1e00dab459ec78f90c7914a60161d
MD5 7c4bf3568529528650540c185eaa0e98
SHA1 493e9c3604459766fdc229ee5eee80274e98422a
SHA512 134610de56e07245ffcc8af54d6e4bf553fd8d9091a7f0a994ea2bd65dabf319b408f0168f8896f1c5db85b969016b90305ae1c395bdd6be0f983d2bc9ec2aea
TLSH
T16BC02201A08ECA890C0462270AE5588CC03868BC3F8D37206321C14C5AE340CF993302
MD5 SHA1 SHA512 TLSH

Submit Download

baidunetdiskxce58f6de

Path \??\c:\programdata\baidunetdiskxce58f6de
Size 531KB
SHA256 defba502da53a12bd057707d31fa62be5c1788ad3f8d1aa8b4bc594957b0cb9b
MD5 e08f7a031657a446af0a496a1747857f
SHA1 b66144c6ba971ae8b82cf50991782ac790801fb4
SHA512 93cd518af37f1a3d4384df7098e5bbf2bda195795f90cf686233d6b3429229aac8811825913dbd3a36edb7e4dc6f949a4d8b762aad4675ec38e3a3992ab5a93e
SSDEEP 12288:5ZZWVeS4UHLktpktWDMPp1cShKUM4uTu+Fi2/+x3:DZWVeS4UHepnqpKU/uTuu1m
TLSH
T10AC42341BE81A1F2CEE908BF7544BD34EC3EBD6E6CB3C4A155CA4551BB1498ABC2DC44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4568-38-0x0000000074C90000-0x0000000074CA5000-memory.dmp

Download

memory/4568-34-0x0000000074C9F000-0x0000000074CA0000-memory.dmp

Download

memory/4568-29-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/4568-98-0x0000000074C90000-0x0000000074CA5000-memory.dmp

Download

memory/4568-97-0x0000000074C9F000-0x0000000074CA0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads