18ff1ffa745ab495532910f9ef28d288d1d544a4b049290dc03faf9a564030d0

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 13.0MB
Sample260910-tskcradr3v
SHA256 18ff1ffa745ab495532910f9ef28d288d1d544a4b049290dc03faf9a564030d0
MD5 5f981279500ba945308447822e739987
SHA1 998b53133f7d4e3130c373d378ff9d2a77c32965
SHA512 c7f0056950ed2c38f04a39650446bf43f6cdb3dd6892658cc86804b8e05305d638b2c861bcf3537485570f72b5c34aaef4b9c219c451f18343f9c98d4fe292bb
SSDEEP 98304:MKRuy5abKRuy5abKRuy5abKRuy5abKRuy5abKRuy5abKRuy5abKRuy5a/OU/jIEy:MqAqAqAqAqAqAqAquFIF0wuC
TLSH
T16AD69D12F6C24071E9B73170099FE37A5979B721473589DBF74C4A2E5B32AC09A3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4924	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
60	svchost_BCACBCCACACAAACCABCCCAABCBCABABACBBCBABCAAABCABAABBBACB.exe
1520	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACBCCCAABBBAAABBBACBCACBBCAACABABAACCBCCAABCCCAABCCBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe"	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCACABCBBAABABCBBBCCCCCBBCCAACAAAACACAABCBCCBACCCCBACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBCCACACAAACCABCCCAABCBCABABACBBCBABCAAABCABAABBBACB.exe"	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2060	sc.exe
4236	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4124	cmd.exe
5096	cmd.exe
3708	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBCCACACAAACCABCCCAABCBCABABACBBCBABCAAABCABAABBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2096	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2096	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2096	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2096	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4924	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
4924	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
4924	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
4924	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
60	svchost_BCACBCCACACAAACCABCCCAABCBCABABACBBCBABCAAABCABAABBBACB.exe
60	svchost_BCACBCCACACAAACCABCCCAABCBCABABACBBCBABCAAABCABAABBBACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	4924	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
Token: SeDebugPrivilege	60	svchost_BCACBCCACACAAACCABCCCAABCBCABABACBBCBABCAAABCABAABBBACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 4124	2096	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	112
PID 4124 wrote to memory of 4132	4124	cmd.exe	114
PID 4924 wrote to memory of 1792	4924	svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe	115
PID 1792 wrote to memory of 332	1792	notepad.exe	116
PID 2096 wrote to memory of 5096	2096	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	120
PID 5096 wrote to memory of 2060	5096	cmd.exe	122
PID 2096 wrote to memory of 3708	2096	2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	123
PID 3708 wrote to memory of 4236	3708	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_5f981279500ba945308447822e739987_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCBCCABACCCCACBBCBCBAACCCAABACABCCBBCBBCABBCBCCACBBCACCACAAAABCCAAABBBCBCACABBBBACCCACACABBBCBBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCBCCABACCCCACBBCBCBAACCCAABACABCCBBCBBCABBCBCCACBBCACCACAAAABCCAAABBBCBCACABBBBACCCACACABBBCBBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAACBBAAACBAAAAABACBBBCAABCCBCBBACCCABBBCBBCCACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe" start= auto displayName= "UserDataSvc_ACAACBBAAACBAAAAABACBBBCAABCCBCBBACCCABBBCBBCCACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAACBBAAACBAAAAABACBBBCAABCCBCBBACCCABBBCBBCCACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe" start= auto displayName= "UserDataSvc_ACAACBBAAACBAAAAABACBBBCAABCCBCBBACCCABBBCBBCCACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAACBBAAACBAAAAABACBBBCAABCCBCBBACCCABBBCBBCCACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAACBBAAACBAAAAABACBBBCAABCCBCBBACCCABBBCBBCCACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBCCACACAAACCABCCCAABCBCABABACBBCBABCAAABCABAABBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBCCACACAAACCABCCCAABCBCABABACBBCBABCAAABCABAABBBACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
1⤵
- Executes dropped EXE
PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c304d6332a3b50b3a56af9eb5b79432aa608d2a9e2c3318b5686eec69dce2816
MD5 2713d4ffcf7e7ffa2fbcd18e5f785ef1
SHA1 8d051632ac6a7dda47681eb83e82abffa6a60e8e
SHA512 839fa3e77b16f35fc3bf795a8ccf4adf40dcf0b97f69fe559f4193a1799e4987e6dd7467fe42ecddd393ef403bec91eea43ea2778e5e796def857df699ea222f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e83aea16376938276b1b27402b33acc28afaba3aca270448ba986624077a18b7
MD5 cc30a568b74e24b6d91d83948c0c42be
SHA1 430c221d6d549f5e2236b924b8154e165a85f2c1
SHA512 d57ec81c1f7e03e922dcfbd8379f4f579d726d1bebdbea0c741bbd2b95dc003940acb7061ff0341ffef207c6f64379bdcd564d44d4ba19a6c4743c6dc59ea93c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 375a62122f241f1f9aa82b9cf691fe09ee62e11db3121a7b52bf8f5ee2ca3d97
MD5 024ebcdcd84cff311d37ad664d13e1e2
SHA1 5cd91cc7015fdf8612be2d77e5a1df343a415d06
SHA512 a327ad6126a1c4d882c4ced68f346bd838240ca951e4cefb42988a2248333153d7af0b4a6820a6138a7175e15118fdfb4eb6227f8e20f65222150479b3270399
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6b4bd9de6d1b5ff407ab49296c37420ae3189a9e0efb46696f87db4073b0ea54
MD5 c7943185d39f4d479a9f565bd3c9b8be
SHA1 c87e129613a31ffea5c44d781fc9aeb0318e983e
SHA512 2141da353565d018e2b3ef3870ade34e483f738da870b7893835153a83d50fc0410452de925328cd76966059bf470c95ae06b95bc6c6e8f0bc2147536ad531f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cda1fcde789c14e306b34f216221bfe345a9560104b4884accbab4931cb06034
MD5 c928d5e3a1ad380050d9c792e5601c3f
SHA1 856e235d61ca3b1c57d427173778013be87bf280
SHA512 1c9b724c1f97d9ee9f38521d55997231a56a36f72a90180fdaf7dec12d68b38909763a45d094ad8a99dcf00df04242c4ad461a76fd5b97f0f788999c8f454593
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cd61e1daa4693635cc1c6ad66d31d8951fb0827eaa13300ed20a048b1dea6314
MD5 14fa5e652625f8d5c81e9fe6f3b92524
SHA1 de62bf790a3b3c4c9b2db9eafd6ad322e4710c00
SHA512 653310dec220915f282a53fab445fe2cddbaedbe99b2c5a5e921e62af722785281321e8ecb464480177d251ac71c254bab7e6ebda8d4f1ee3803a72fd138458c
MD5 SHA1 SHA512

Submit Download

svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABCABCCBBBCCACACBCCBAABCACCCCCABBCBACABCCBCBABACB.exe
Size 13.0MB
SHA256 18ff1ffa745ab495532910f9ef28d288d1d544a4b049290dc03faf9a564030d0
MD5 5f981279500ba945308447822e739987
SHA1 998b53133f7d4e3130c373d378ff9d2a77c32965
SHA512 c7f0056950ed2c38f04a39650446bf43f6cdb3dd6892658cc86804b8e05305d638b2c861bcf3537485570f72b5c34aaef4b9c219c451f18343f9c98d4fe292bb
SSDEEP 98304:MKRuy5abKRuy5abKRuy5abKRuy5abKRuy5abKRuy5abKRuy5abKRuy5a/OU/jIEy:MqAqAqAqAqAqAqAquFIF0wuC
TLSH
T16AD69D12F6C24071E9B73170099FE37A5979B721473589DBF74C4A2E5B32AC09A3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 4ec1bcf111906fc048960ded66df41079b1c034dc97126e6ac6ddbab0bdba5d7
MD5 d8f551a4e58e657eefdd96b7b662f2b4
SHA1 4d90313d870741c47c7b80c0df9ad14b462fa591
SHA512 430b1e350de78b80db4b50f382413b7b208f388a6bfc4932b9be0c50edde354a6e48ecbed3d4c05616fa1f8456e9cb2e058790c6aeb43d8cca4c8d7e686de0da
TLSH
T11011299170E6DC13E07128C7A215CB8709F237EBA85C9BA0130D9128F709936DD024E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/60-77-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/1520-80-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/1792-57-0x0000000005860000-0x0000000005861000-memory.dmp

Download

memory/2096-6-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/4924-36-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/4924-26-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download