6afaa01991fce6215f2092d4820304b598a9337ea8f172d493e3e5f28384c914

Analysis

max time kernel
149s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 14:55

Target
2026-04-16_c6c4dbb169ca17bc5d58e07d3fd23bb6_amadey_darkgate_fabookie_smoke-loader_stop.exe
Size 1.7MB
Sample260416-sapdbaex4y
SHA256 6afaa01991fce6215f2092d4820304b598a9337ea8f172d493e3e5f28384c914
MD5 c6c4dbb169ca17bc5d58e07d3fd23bb6
SHA1 999ba69352360306ef5cde577d40d0bc25ac0ce4
SHA512 875df45dde229b94c6ef6e8f126a856898ab5e6bf6964e3b29c4e194317807bbb3281cababf30f6e78534610af23f7650c3f91a7fe19eec5257033d8f8029999
SSDEEP 49152:WvxvOhKPgssSt2gRsNBk9/fw2BwfmM0fV:cmhv7St3sNi9Xwgwfot
TLSH
T1D1856C12B3F45035F2B367709EB9A365667ABD706E39E20F73D4264E1DB0AC09621723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Device Association Framework\Store\	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework\Store	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-16_c6c4dbb169ca17bc5d58e07d3fd23bb6_amadey_darkgate_fabookie_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_c6c4dbb169ca17bc5d58e07d3fd23bb6_amadey_darkgate_fabookie_smoke-loader_stop.exe"
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Modifies data under HKEY_USERS
PID:656

memory/2148-0-0x0000000002740000-0x000000000282A000-memory.dmp

Download

memory/2148-2-0x0000000002740000-0x000000000282A000-memory.dmp

Download