63d560ec59819e4cb292cc6f9974a7151659ac86dd7383854bbc10d298d89904

Analysis

max time kernel
152s
max time network
163s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Size 56.6MB
Sample260910-seq3psdp8v
SHA256 63d560ec59819e4cb292cc6f9974a7151659ac86dd7383854bbc10d298d89904
MD5 7901484832e24b28f694c01e5f071224
SHA1 7eba47b19678e4233ce22b6e69a67288f92f8457
SHA512 3cef2908ea4753f911091c1b7475ff6fc213d0b1350b61e0f07d8e2d9801bf46bd7a85451ad85d058938f51b5f49dbe295d23889aafddbd244c3fccc2beccdbb
SSDEEP 196608:SFIF0wuVFIF0wuVFIF0wuVFIF0wuVFIF0wupKWQc0gEYnvL/:EddddAcZEIvD
TLSH
T1FFD77D06F98340B1E96B11B04DDBD3BF8A70BF2186228DFBF78D871B6A32B915424755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1332	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe
3356	svchost_BCABACCCCCABCACABAAAABBACCCAAABBBAABBCCCBACABBAABCACBBC.exe
4532	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCAABACCCBBBBACAAABBCBBABBBABACACBCACABABCCAAACCBBBBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe"	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACABBCBCACCBBCACAACBBABCACACCABCCACABABBABBCCCABBCBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABACCCCCABCACABAAAABBACCCAAABBBAABBCCCBACABBAABCACBBC.exe"	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5984	sc.exe
3512	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
484	cmd.exe
3760	cmd.exe
1900	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABACCCCCABCACABAAAABBACCCAAABBBAABBCCCBACABBAABCACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5100	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
5100	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
5100	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
5100	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
1332	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe
1332	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe
1332	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe
1332	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
Token: SeDebugPrivilege	1332	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 484	5100	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	92
PID 484 wrote to memory of 5952	484	cmd.exe	94
PID 1332 wrote to memory of 2840	1332	svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe	95
PID 5100 wrote to memory of 3760	5100	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	98
PID 3760 wrote to memory of 3512	3760	cmd.exe	100
PID 5100 wrote to memory of 1900	5100	2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe	101
PID 1900 wrote to memory of 5984	1900	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_7901484832e24b28f694c01e5f071224_amadey_darkgate_elex_glassworm_hellokitty_hijackloader_l.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBBBABCACCBCCCACABACAACCBCABBCCBBCACABACCBACACBABACBBABBBBAACBCCCCBCBCCCBACBACACCACABBBABBBCCAABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBBBABCACCBCCCACABACAACCBCABBCCBBCACABACCBACACBABACBBABBBBAACBCCCCBCBCCCBACBACACCACABBBABBBCCAABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCBAAABBABCACBACBAACAACABAACBCAACBBCBCAAABAACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe" start= auto displayName= "UserDataSvc_AABCBAAABBABCACBACBAACAACABAACBCAACBBCBCAAABAACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCBAAABBABCACBACBAACAACABAACBCAACBBCBCAAABAACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe" start= auto displayName= "UserDataSvc_AABCBAAABBABCACBACBAACAACABAACBCAACBBCBCAAABAACACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCBAAABBABCACBACBAACAACABAACBCAACBBCBCAAABAACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCBAAABBABCACBACBAACAACABAACBCAACBBCBCAAABAACACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACCCCCABCACABAAAABBACCCAAABBBAABBCCCBACABBAABCACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACCCCCABCACABAAAABBACCCAAABBBAABBCCCBACABBAABCACBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABACACACBABCBABABCCABBACABBBCCBBBABCBAABCAABCCCACA.exe
1⤵
- Executes dropped EXE
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8150300b0e5a0ca5cb36e429fee2d35e7165445b9244f3fb23ab38eb9b125fce
MD5 47ebf82e1a91848640942a4027b517ba
SHA1 41bb04dd2a0afa5ef81840e0f1af045011c058ee
SHA512 a17306f10cd75dfb5c0d8cc2b9c41421f642d9dd31c5cb26c0e2e27297f13cd92ce9aa45a13db9d50a3b28fe67f88f1f5345ff54e5e1908b77264c9b79feac97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 df428da8bbd743def035b429a8b7b2f9a1d88ae5aecff7f307041ecf9b24d6fc
MD5 8a27544a5d5f695235154e2de9da9ea5
SHA1 c167e158052f1e10ecc3643898ea276b072f0844
SHA512 15f312a28d9a231f24ccaf31044487c05eecfafb8c0f7cd3f90a5e1f0348feb3df9b318444aeab62f18faa82d189831ae8fb82f6aeaf175ac2452c8dd3c7e605
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2bc819fa764034199a12fde0c511c9631a217672eee886942fa46ef96cf54594
MD5 fcbf91d13ebc76a312f46bc764e9e629
SHA1 004946f0b9533277b48ddb33224a1008c1fbbd40
SHA512 ab905c6f772cd0c40636613daed23d36767a653f6a9d4ba189feffdaeb9c12da0411ebeb0891e8e43936fe029e63a3a26571ee048b6ae75ff6b592257011baf1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e7990e45c715f7d5eec5cf3eda80724253b976c61bfe7c767511ccb866af59b
MD5 3c519b9b647913d3d7ecbb02b0e06c46
SHA1 37849c534073e2e2bb1ad8268433b4bfc510b871
SHA512 3a1bbdd915e00fdec7057edae56888f91fa21a706e671a4f929151eed03f7e7724496abca509e4356839f23b1209a4b00894e7ad1313f6ebfb11cd96f00ae795
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 039ae30367c5458ac4e9611321a02eb9bb4f1d95278b6304afb51ca52cc1f429
MD5 b3d07cd5e4619d90092943c302d66ec8
SHA1 bd4d9483457b0c4c146e7b095ded4c75a4ca4262
SHA512 e855f2eea2e774b3196a9002f12aa787046d4ced8d687ac4c0a519fc55e25258b4704d968bbb7326b2d193bd895912fe0f2aed3b379de4f22890868cc04d2334
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 30aebff2ebb365dfec67e53a439dca12c0cb834214ede2f6db69bbac8b8ca5a9
MD5 987189ce65090dc6ea1431a855db8cd4
SHA1 bb2fe4b586e5addda7955bea858e40cd7f39bc9c
SHA512 3abc3067631a1747f0a00a5cab2e389cb89e656238d6190a6c6bfa0c321f353c156fd1896269088b0dbc40d095a2585c09bca84f52af6c6b0acb587204b5cca0
MD5 SHA1 SHA512

Submit Download

memory/1332-54-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/1332-80-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/1332-105-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/3356-97-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/5100-63-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/5100-0-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/5100-89-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/5100-30-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/5100-16-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download