df4a29e01fea6126c442f5104c5e3f7cbbf4f154c0e868761fbaa10758bf67b2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 18.7MB
Sample260910-e7wxrsxgqg
SHA256 df4a29e01fea6126c442f5104c5e3f7cbbf4f154c0e868761fbaa10758bf67b2
MD5 802efd4d4d18759dfef29d3b932b6fcc
SHA1 7196e70fb11d19e532b45ad0e22df3ade734fe67
SHA512 1969a8577dc98c988872421fd14c57a8d5be27769b403cc9010f55e4db35d41f9c32d204981296693da0c761d90c24e4e6283def9e0657f572e2da6336042986
SSDEEP 98304:FKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5ad:Fq9q9q9q9q9q9q9q9qhFIF0wuU
TLSH
T17B178E06FA830071E977617049DFE3BE4978772147318DEFF74C8A3B5A32A90692875A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3388	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
4184	svchost_ACCABCBACBAAACAAABAACACACCABBBACCBBBBABCAACCCBBABCAACAB.exe
2540	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABABAACCAAACACBACABCCCCBBCCABBBAAAACABBCAACCACAABABBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe"	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABACABABBBCCBBBBBCACCABBACBAAACCCCBABBCCABCACBABAABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABCBACBAAACAAABAACACACCABBBACCBBBBABCAACCCBBABCAACAB.exe"	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3312	sc.exe
3456	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4656	cmd.exe
4624	cmd.exe
2488	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABCBACBAAACAAABAACACACCABBBACCBBBBABCAACCCBBABCAACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1036	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1036	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1036	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1036	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3388	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
3388	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
3388	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
3388	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	3388	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4804	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4656	1036	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	100
PID 4656 wrote to memory of 3624	4656	cmd.exe	102
PID 3388 wrote to memory of 1556	3388	svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe	104
PID 1556 wrote to memory of 4144	1556	notepad.exe	105
PID 1036 wrote to memory of 4624	1036	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	109
PID 4624 wrote to memory of 3456	4624	cmd.exe	111
PID 1036 wrote to memory of 2488	1036	2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	112
PID 2488 wrote to memory of 3312	2488	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_802efd4d4d18759dfef29d3b932b6fcc_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABAABCAAAAACCCCCCCBAAAACCBAABABBACBCBACBAACBACCBAABBBACCBACCABCBABBBBCCCAACABCACCABBBBACCAAACCCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABAABCAAAAACCCCCCCBAAAACCBAABABBACBCBACBAACBACCBAABBBACCBACCABCBABBBBCCCAACABCACCABBBBACCAAACCCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACACBCACCCBBBAAACBCBACAACBCACABACCBBCCCAABABBAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe" start= auto displayName= "UserDataSvc_CACACBCACCCBBBAAACBCBACAACBCACABACCBBCCCAABABBAAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACACBCACCCBBBAAACBCBACAACBCACABACCBBCCCAABABBAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe" start= auto displayName= "UserDataSvc_CACACBCACCCBBBAAACBCBACAACBCACABACCBBCCCAABABBAAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACACBCACCCBBBAAACBCBACAACBCACABACCBBCCCAABABBAAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACACBCACCCBBBAAACBCBACAACBCACABACCBBCCCAABABBAAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4144

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBACBAAACAAABAACACACCABBBACCBBBBABCAACCCBBABCAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCBACBAAACAAABAACACACCABBBACCBBBBABCAACCCBBABCAACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
1⤵
- Executes dropped EXE
PID:2540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcf8da0d0f7912a7dd3efae82526879fb887e005e5d2e4e954290c94d85ce988
MD5 9e3f08af26dc8bb3eff35a05f1eb5421
SHA1 de4342328692a141ab59cc098e9b6f28d8193685
SHA512 72fc96e2ddd05c8692822316fe3297c07ff7bca708e08ed80a6027dc13f661c7527f5bae842f350ea7220b479d01ef7e7137336a08c4e1586aea2738b66ad15d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e8045ef82b5df013ac22c09cf93ccd4fe56853a941fd3f607182e26790f0107
MD5 fc9d5f78b37717da28983341b3cc1252
SHA1 89ae79872179a93c884f3fde8765674f5349cc0f
SHA512 45d64b7fcef606feb3e5432031f96e0239e06b6f4ab6d656eb86d314ba9461bb126f1583b0e0dbc6b0dd864d41c69f4483bc3df69f8845d1fc52de1dc5a956ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 89c39e6129be9470dae27262cd50c7689f0904e31476ad21d01cb0ebacadffff
MD5 3a3d7b2b9c977f372d8b4022b31640da
SHA1 8757ce8530a813e7888f1af3a67c2e15f9b127da
SHA512 2f3dd2165f5e2b5820280c3d4b1287ec9608d5d009d2b4085caac87ea82fd0d8d19b3febdc8dabc6d50617810206d5fd6cd2ae070762c3edeebf04f8132e2edb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c90a031ec959d5ecaebad36b56c84e36111aeb30368f83ffb302dd33a97d53af
MD5 7f09cf85605417688b92330c52a4856b
SHA1 89e445779a5cd238c7085c4328dee60a1d3cab66
SHA512 7276e51c7ae58614e7a9a4e5d366c0ba18fef3107ec32b12b639cdb9c0462325e0fd66f6024433a8562dbad603e59d83c8830d98f5bf487ed4385aeb917ad5af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 56cdf695105e7eb0a305f75b9d26ce35d88aad348ae9051b45b44758b5596316
MD5 56edfdb74cd328b9280b08504589fcc6
SHA1 5c628c6038f9e44b8ce8c814f955b6d1bb48e4ac
SHA512 be09af9a3ae88b487b959fcb3edce05e8a2df6a431373bc4cede60f6c509c7598ee66a2410af89a243dd2add8a90bd376fde9b66d403b517529e2318697d542e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ed5f03f8fbca95cfb01d952b86ccdfe33640777b1f064530a80dfd7c4f49ee60
MD5 65979f68284b3b35c58ea1feb24cfce2
SHA1 5dfea6e8c61c50497a397f11ebfb130f7080919f
SHA512 fa43000e39a0e2a879b3562ad00dd38329da3650dc82396bab1bf340d61c9cc7edb5e545eefade724310a6da36cca9f0b613a348d1aba228f5c036abd835e286
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9d08316d5d6de62a64b94e7c9247252d5b6d221160fb377e3ab6400cfb75e385
MD5 381f323f54e2b2ddb9327c5f865b8eda
SHA1 a90e9ee871bc16f6c9a3d6da8e281bbd54404877
SHA512 b5ff6e0d64faaab01fe97541c39b22e7b21e26c3309381361452418a4fba29d9c252bc8ec075e053cc6c29b232262be8ac2a9e241d855a6482bf4e29fffa5b62
MD5 SHA1 SHA512

Submit Download

svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCCBCCCAABBBBBCBBBCCBCBCCABABCAAAACBAAACCCCACACAABA.exe
Size 18.7MB
SHA256 df4a29e01fea6126c442f5104c5e3f7cbbf4f154c0e868761fbaa10758bf67b2
MD5 802efd4d4d18759dfef29d3b932b6fcc
SHA1 7196e70fb11d19e532b45ad0e22df3ade734fe67
SHA512 1969a8577dc98c988872421fd14c57a8d5be27769b403cc9010f55e4db35d41f9c32d204981296693da0c761d90c24e4e6283def9e0657f572e2da6336042986
SSDEEP 98304:FKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5aWKRuy5ad:Fq9q9q9q9q9q9q9q9qhFIF0wuU
TLSH
T17B178E06FA830071E977617049DFE3BE4978772147318DEFF74C8A3B5A32A90692875A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-25-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/1036-51-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/1036-0-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/1036-75-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/1036-12-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/1556-78-0x0000000002C90000-0x0000000002C91000-memory.dmp

Download

memory/3388-37-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/3388-76-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/3388-52-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4184-95-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download