d614813f1b3c9b27767b9c5131877e894a09a20732c529cf43894d2be6ddb851

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 19.6MB
Sample260910-fpjedsyelg
SHA256 d614813f1b3c9b27767b9c5131877e894a09a20732c529cf43894d2be6ddb851
MD5 6dee08d52ca47b755313ac6125bc132e
SHA1 01e9b8605e45bd9a411efafe635c82646b085677
SHA512 8b72672ce006e03378b8f1ef5f2b474bf966c49dcb2d6185e3d904ae50a102bc6b2bf02586845daeb18fa218959f23174c5c2c9d4e82454a11348f4ce33af0c3
SSDEEP 98304:AKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aAKjKWQc7:AqWqWqWqWqWqWqWq6KWQc0gEYnvLd
TLSH
T16B277D02FADA40B5F8B726704DBBD27A5935BA204B21C9EFE244475E5932FD09E34327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4500	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
1840	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
728	svchost_ABCBCACBBACAABCBABAABACBBCCCAACBCBBACCAABABABCBACCAABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCAACAACBBBCCCCCBACBBABBAABACCAACACAACACBCABAABBBACCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBCACBBACAABCBABAABACBBCCCAACBCBBACCAABABABCBACCAABAA.exe"	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAAABCACACBBBBABCCCBBACACACCACBAAACBCBCAABBABBCBBBBCBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe"	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1188	sc.exe
904	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4904	cmd.exe
2716	cmd.exe
868	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBCACBBACAABCBABAABACBBCCCAACBCBBACCAABABABCBACCAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3896	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3896	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3896	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3896	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4500	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
4500	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
4500	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
4500	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3896	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4500	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 4904	3896	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	104
PID 4904 wrote to memory of 1332	4904	cmd.exe	106
PID 3896 wrote to memory of 2716	3896	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	110
PID 2716 wrote to memory of 904	2716	cmd.exe	112
PID 3896 wrote to memory of 868	3896	2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	113
PID 868 wrote to memory of 1188	868	cmd.exe	115
PID 4500 wrote to memory of 2984	4500	svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe	117
PID 2984 wrote to memory of 1992	2984	notepad.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_6dee08d52ca47b755313ac6125bc132e_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCBACACBACCBACBCBABBCACBBCABCBABAACBBCACCBBCBACAACCBBBBCCACABCACCCCABCBCCAABCCBCAACAACAABACCBCAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCBACACBACCBACBCBABBCACBBCABCBABAACBBCACCBBCBACAACCBBBBCCACABCACCCCABCBCCAABCCBCAACAACAABACCBCAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABACCAACAACBACACACCAABAABCAABBCACACAABCBCACAAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe" start= auto displayName= "UserDataSvc_AAABACCAACAACBACACACCAABAABCAABBCACACAABCBCACAAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABACCAACAACBACACACCAABAABCAABBCACACAABCBCACAAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe" start= auto displayName= "UserDataSvc_AAABACCAACAACBACACACCAABAABCAABBCACACAABCBCACAAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABACCAACAACBACACACCAABAABCAABBCACACAABCBCACAAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABACCAACAACBACACACCAABAABCAABBCACACAABCBCACAAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
1⤵
- Executes dropped EXE
PID:1840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCACBBACAABCBABAABACBBCCCAACBCBBACCAABABABCBACCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCACBBACAABCBABAABACBBCCCAACBCBBACCAABABABCBACCAABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e75b4935a2ede4063ea9b434eb6e34a06bbe85f300d0efea346f5473e25d11c
MD5 2c1475c782fbb830efc540f4bd74490c
SHA1 b2c800193733dbdcc4fef245f0fe108d8a454f32
SHA512 9a269d41363a7a1a58cdca90fa4a1f9c84477e415aded290dd99d5e123f0715de82bce44d914a99f61feb689b6fad1c521db3ad3928e5bd8e50b29c03b284f1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ebd5f754575dc01a783e5beb6540740788ee2161c1d5170d72093c37cfe3433
MD5 42c33e360517a8944d1199ee734c945d
SHA1 8173ede71ad05f552aaf211d284820a300b5fcd2
SHA512 2028865119a3a157c1e9acbd16801f313585dcdadd9119b6049473222d8111d4ff198d687d3ec8deff237c4c7173a2602fb0fa82890281f3786d9a4301788a3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 021fbc767a4fab5962d403a0e4116444bcbd36fee63c7e681dd790c8169237fb
MD5 f2a564155ea048e952da6ec6a9890038
SHA1 942a764c101f58df7f05cff474645b0a9c59be35
SHA512 f4118ee6299b6e0c584808855134fc6e3f6fd97badd02f3ea55cd44741ec645b5b801448103084c3e63c86bce3c6eba6d7fdb139db73d9f874f55da10d9b371e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad3a0d4fb9aced55e64c6f7acae5e6b61dba1345ab8e44766092075b7bbd7e1d
MD5 1f5d2dcfc84b9c8c7ee27f1aee78f3e3
SHA1 f5d1111228ae72134e65bc843565c09f27e76e57
SHA512 5c14c3bb790d290c95bcc2a0761e55f163c8c4f3023d8c9d21a4a13559977a75dd2a7eebc60ee99162858452930f6da16fdb1c6c53c64af0d1955b4ddc9c9ff4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7b79ec99d2c5cca37d33c28a181af4ba46733ec5dae89cdecf3db3db718e166f
MD5 536f048e7633d4f5bc1d2ca7cc3efbcc
SHA1 91e63e5d442838429c2c595f3dc9997ea7ea60a8
SHA512 61a5d4db7a53905d2922b5b4e6a36f4d7fac4ed5efbc7c59e6fcd31c50d8edd02189957b778b8616419c50d365c2489c88db871190e7399109290170cf2fe43d
MD5 SHA1 SHA512

Submit Download

svchost_ABCBCACBBACAABCBABAABACBBCCCAACBCBBACCAABABABCBACCAABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCACBBACAABCBABAABACBBCCCAACBCBBACCAABABABCBACCAABAA.exe
Size 12.6MB
SHA256 a0ced3025ee60faa56aa58dc5df67ed4dc8b273e771bba431b356356d82d8705
MD5 3809835fd1cd4d2e7d284b2082e44b51
SHA1 678855cc63a7192a30f6e858deb8f6551c183c54
SHA512 6f11c08d93d2ad3612e1943c52421cfa8b8a833b71d241e380a4554b766b170ed625f8537034d037c017f958e22d341975cbc7b4f0dd847e39120403ba159f53
SSDEEP 98304:AKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5ac:AqWqWqWqWqr
TLSH
T122D66D02FAD940B5F4B726704DABD27A5935BA208B21C9EFF244875E5932FD09D34327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ABCBCACBBACAABCBABAABACBBCCCAACBCBBACCAABABABCBACCAABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCACBBACAABCBABAABACBBCCCAACBCBBACCAABABABCBACCAABAA.exe
Size 12.9MB
SHA256 4d97f8d86b217a52de29aa2f7d47dd95b114b4c6881623ee80e3e45a1615dfc3
MD5 90d808d85e7833e96de59c5ee715a808
SHA1 a14926a221be24a7cc08b2e28044fdecdaa23256
SHA512 f76a6039723bb055a3523a48e59252221cfee8646dca91b2c765b41578701cb521572c3f1cd926557ebc467e274dd8a4185f7b3aed5323bb1aa73df10c6d3a07
SSDEEP 98304:AKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aY:AqWqWqWqWq3
TLSH
T117D65D02FAD940B5F8B726704DABD27A5935BA208B21C9EFF244875E5932FD09D34327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBAAABBCAAABCCCCCCAAABBACCCCBCACBAABABCCCABACCBCBCBA.exe
Size 19.6MB
SHA256 d614813f1b3c9b27767b9c5131877e894a09a20732c529cf43894d2be6ddb851
MD5 6dee08d52ca47b755313ac6125bc132e
SHA1 01e9b8605e45bd9a411efafe635c82646b085677
SHA512 8b72672ce006e03378b8f1ef5f2b474bf966c49dcb2d6185e3d904ae50a102bc6b2bf02586845daeb18fa218959f23174c5c2c9d4e82454a11348f4ce33af0c3
SSDEEP 98304:AKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aTKRuy5aAKjKWQc7:AqWqWqWqWqWqWqWq6KWQc0gEYnvLd
TLSH
T16B277D02FADA40B5F8B726704DBBD27A5935BA204B21C9EFE244475E5932FD09E34327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-80-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/1840-74-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/2984-67-0x0000000005700000-0x0000000005701000-memory.dmp

Download

memory/3896-6-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/4500-38-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/4500-25-0x0000000000560000-0x0000000000581000-memory.dmp

Download