abefbb56730ed41f01575c80a117c2ca108e8a8fd8c85c4b2b80a51d7e681f60

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_6939f94e37767ed4f504eb478a8bce3c_darkgate_elex_emotet_mafia.exe
Size 2.2MB
Sample260910-ft3zlaff86
SHA256 abefbb56730ed41f01575c80a117c2ca108e8a8fd8c85c4b2b80a51d7e681f60
MD5 6939f94e37767ed4f504eb478a8bce3c
SHA1 95953bfe246fc6db685e74338ab9dd816a1b457c
SHA512 90cc266d5dd41b3192c26ed960ea79632af2fc94265d7fc081eb2e13a1e5f86616bcba590182854be8a301de3e02f7aac6927cc05163bfbf99f12a8ef867f2c8
SSDEEP 49152:IT3Aj0CZ3AJNLy4IJnsyRgPr5qfPHR0eh//lQgXMOhQXNWKWnhHzlVd2PtUjRaWG:Zj0CZ3CLyzJLRgPr5qfPHR0e5/SgmgK7
TLSH
T127B5BF32769180BAC233F1708A4EA3FDF3EA96704975524756901F3D2E745A3992C3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-09-08_6939f94e37767ed4f504eb478a8bce3c_darkgate_elex_emotet_mafia.exe

Executes dropped EXE 2 IoCs

pid	Process
4312	hpqhvind.exe
9176	hpqhvind.exe

Loads dropped DLL 2 IoCs

pid	Process
4312	hpqhvind.exe
9176	hpqhvind.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hpqhvsei = "C:\\ProgramData\\BaiduNetdisk\\hpqhvind.exe"	hpqhvind.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpqhvind.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_6939f94e37767ed4f504eb478a8bce3c_darkgate_elex_emotet_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpqhvind.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2488	4004	2026-09-08_6939f94e37767ed4f504eb478a8bce3c_darkgate_elex_emotet_mafia.exe	85
PID 4004 wrote to memory of 4312	4004	2026-09-08_6939f94e37767ed4f504eb478a8bce3c_darkgate_elex_emotet_mafia.exe	88
PID 4004 wrote to memory of 1808	4004	2026-09-08_6939f94e37767ed4f504eb478a8bce3c_darkgate_elex_emotet_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-08_6939f94e37767ed4f504eb478a8bce3c_darkgate_elex_emotet_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_6939f94e37767ed4f504eb478a8bce3c_darkgate_elex_emotet_mafia.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\expand.exe
  "C:\Windows\System32\expand.exe" C:\ProgramData\BaiduNetdiskXCE580CFB -F:*.* C:\ProgramData\BaiduNetdisk
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2488
- C:\ProgramData\BaiduNetdisk\hpqhvind.exe
  C:\ProgramData\BaiduNetdisk\hpqhvind.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4312
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Users\Admin\AppData\Local\Temp\240652640.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1808

C:\ProgramData\BaiduNetdisk\hpqhvind.exe
C:\ProgramData\BaiduNetdisk\hpqhvind.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:9176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.ldf

Path C:\ProgramData\BaiduNetdisk\1.ldf
Size 114KB
SHA256 943343ed466b6af506540f654371a2bcbf11689966de3c21298b6b74939b4ddc
MD5 ebc584c804707990e5c1f441ed501cc8
SHA1 7958cdc7f49ba50c5c355f03e8f80f7f421c96f3
SHA512 7f06a53fad8cbf6eacadf166f86b2fc0967982de263fbb5dc2504506565a687163fc2ea070afcb202fcfc70c598d02aa32ce6e0c0fc74d1fc1d9f9846140aefa
SSDEEP 1536:m3G4H33uOJhbREkEYCgcahN3J+9x4exxZS2tLxMtmz18XvPgIt9xARV5Em:m3NH33hJhboahJJ+tXULUz18/Yx5B
TLSH
T11BB3F1F1EB471DBFE1AA049807A9BB40EFE4E1A8E611E09553A0B704F6EB3D05F5E501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.mdf

Path C:\ProgramData\BaiduNetdisk\1.mdf
Size 6KB
SHA256 ddfa41046ae454e3c8fc98bedb3d16c7b82aff6de9529b94ca581611ca4709db
MD5 70b46d7cf176bc214e74aabdd276a5f2
SHA1 78c00e1fffb6d0b0c8580a18628e4759a03871ac
SHA512 487a84882f03e84c09ef2459a01edacd0361fb97d69c25f30c1e9cb81ac480937817374b13d3d1a780ba5babadb9bdff4f5326b227ea302baa1398db47cbea54
SSDEEP 192:D4hNzluP2diCUVWOM1YmWsPjei8J7CIj+vKtlukGDOK:DSNzUPrV/PmdTOvj5tlukk1
TLSH
T190D18EA1AFAEC29321FC262A09F6C3F00C6C6727FD33781D66474407A5A705D892D68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.ndf

Path C:\ProgramData\BaiduNetdisk\1.ndf
Size 5KB
SHA256 80f23e2822a020a584c2e0981ad5a69cb8f2dee5c2e5e0ef83b615429f342cd5
MD5 64410a692a4816f1d505db0090b82a2a
SHA1 70f9e83c4fbd63ff21d195231876b0d7a30cf83b
SHA512 0fcf63ebdafb13bab5379cc9985f5b2ff655f0cafa2735ab0ba99f0153bc9bf5311029d3b7d7cc0e10ebea34dc54f63c1cea53a2e0d9e20c45fcb583d80eb03d
SSDEEP 96:Irov8LQfaBoyTSPu+N22gAFz81wf5SVPDBycM66qjm75rrc2GDpaplgqQ:5HaBopTN2QzWwxUPFycr6qqFrrKFbF
TLSH
T173C18F23FCB31052006ED05D2002D753DFE385F9E869625D249AEBCAB64F74E799036C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fszwd.dat

Path C:\ProgramData\BaiduNetdisk\fszwd.dat
Size 67KB
SHA256 1823aafa35a6bbdefa50b1002436c9bfe4ec74b103d5583c54f55c0a7db5f046
MD5 0c02abb8329f845dadb47a444d17baff
SHA1 5a0fd5816c3be8a112b9186bd25fdeda66005f57
SHA512 1bb4931c83cc0651fc88874bcc281e5a3960cc23635d78f37bd8fc880306b553cd4e1c06d9991d8ababfd98102996c5ca1f766e8a4430a61ff936fb8cd60c6bc
SSDEEP 768:sPlzAM7SQ4tjheXp2r7Ih034XohyaSStP6i22A5RDGEnBsngSYEDdGVneAhf/GQC:SzhSep2r7IhIHyFOPlA5RDLnOng1xm
TLSH
T1A6637E227290D872D09B153468B497727E7E7C222AF540CB7FA9173E5F703D0AA78356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hpqhvind.exe

Path C:\ProgramData\BaiduNetdisk\hpqhvind.exe
Size 810KB
SHA256 1dc5d8ba74d2ff1cdfe7b857b6fa9e3c02a38c758a597fbaca546c8bd6063521
MD5 ca9e7dccb0a9ffd5e6247096e863461b
SHA1 c2c47222f21526796294aa4a6b460f567270e2a7
SHA512 4db9606a254e21b799cfdc1ed100cbd907578f717fb857246dd9850cbe254770c3c05ac2e544f6438c1a52423dfa6d075287a3a23b530ee277a7272fa62cce16
SSDEEP 12288:WcCDI+4dKxxZuxIu2Xlei/gkrE1bfrUF3y6Y5PlBBG4H8nzRG9O9MOSFY7MIIFH7:WtQOEv2Xu/fReecnBQ
TLSH
T1B8057C348D02E99CE74A1BFB6C24B2B51C15AC252A989387C7F27FE409F42D3E581B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240652640.bat

Path C:\Users\Admin\AppData\Local\Temp\240652640.bat
Size 191B
SHA256 6d9001062a0971a1585d3d42bbdbfeedc353119b4bbcf3a80e518006347a2ba4
MD5 2ee8ca396f9afc47dee9b4d046b89cb1
SHA1 7f79fca932d7bf1df0797c09f8519d0fc05cae79
SHA512 c8a611e1405167f58bf8b109b7f8ab9791f887c8ab6e4a6b6682e707e99c61d0a1c3dacfbe735ccd3e3337ccf2be808d3629d897053c460258aea775ef43db16
TLSH
T12DC01212918E975A0C08626B46F5598CD068697C3F8D27206721D54C56E345DF993342
MD5 SHA1 SHA512 TLSH

Submit Download

baidunetdiskxce580cfb

Path \??\c:\programdata\baidunetdiskxce580cfb
Size 531KB
SHA256 defba502da53a12bd057707d31fa62be5c1788ad3f8d1aa8b4bc594957b0cb9b
MD5 e08f7a031657a446af0a496a1747857f
SHA1 b66144c6ba971ae8b82cf50991782ac790801fb4
SHA512 93cd518af37f1a3d4384df7098e5bbf2bda195795f90cf686233d6b3429229aac8811825913dbd3a36edb7e4dc6f949a4d8b762aad4675ec38e3a3992ab5a93e
SSDEEP 12288:5ZZWVeS4UHLktpktWDMPp1cShKUM4uTu+Fi2/+x3:DZWVeS4UHepnqpKU/uTuu1m
TLSH
T10AC42341BE81A1F2CEE908BF7544BD34EC3EBD6E6CB3C4A155CA4551BB1498ABC2DC44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4312-38-0x0000000075A00000-0x0000000075A15000-memory.dmp

Download

memory/4312-30-0x0000000010000000-0x0000000010023000-memory.dmp

Download

memory/4312-29-0x0000000075A0F000-0x0000000075A10000-memory.dmp

Download

memory/4312-997-0x0000000075A00000-0x0000000075A15000-memory.dmp

Download

memory/4312-996-0x0000000075A0F000-0x0000000075A10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads