2c0995a3ddacf93919daddd474cd075077e092373125f8a37eb685946e586880

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 12:37

Target
2026-04-15_25b3a1e6797bdd41544e01bd2c71fe44_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_smoke-loader.exe
Size 872KB
Sample260415-ptre8set8l
SHA256 2c0995a3ddacf93919daddd474cd075077e092373125f8a37eb685946e586880
MD5 25b3a1e6797bdd41544e01bd2c71fe44
SHA1 a5a7bb4f8e1254dfa3c34bbb0f7e7d339330672e
SHA512 17866ecd09ac2e2a6ff8f758217c2bacb1f3364b54dc6ec06025231a765e1ed6c5c13c432412ab4f5ec104820c467a2559dbaf54354e173c693bb3c680dc057f
SSDEEP 12288:WzDxTBWzfday0rUjkxAwSfxL/2Dc3jDLLmt0LDQewsAjR7wWBw4:Wvxsz1ay0rUPaewsAjJw4
TLSH
T1B3155D23F968C422C56A1A700B69D605D938FE150F505A87A3FCBFED18347F17A3D62A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework\Store	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Device Association Framework\Store\	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_25b3a1e6797bdd41544e01bd2c71fe44_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_25b3a1e6797bdd41544e01bd2c71fe44_amadey_cobalt-strike_darkgate_fabookie_glassworm_hawkeye_smoke-loader.exe"
1⤵
PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Modifies data under HKEY_USERS
PID:1872

memory/3852-0-0x0000000002CB0000-0x0000000002D5E000-memory.dmp

Download