e2e57ced23d136f60d2efd7d5e9c14719a7e8f7eeebad44ef46504c90b7116b9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 13:59

Target
2026-04-19_ca867fcc6f27898b2735cc0766d194c3_amadey_coinminer_darkgate_fabookie_glassworm_smoke-loader_stop.exe
Size 4.2MB
Sample260419-ranlcact8r
SHA256 e2e57ced23d136f60d2efd7d5e9c14719a7e8f7eeebad44ef46504c90b7116b9
MD5 ca867fcc6f27898b2735cc0766d194c3
SHA1 54ee3db4c02abfe7bdc7cc3de57c9385eea7c6af
SHA512 81d5f53d6e099ac8f9b6ebbe3dc18c11d608e03a76f9652e0e8227729604e8cce2f3d86e6a30e817970d29da552317556d484376cab242f041bc4fbc8b4b235c
SSDEEP 49152:WvxXvxCv9MSrG/akOElMaFLkLbtL2tLzEp6XoJdXN0BMOwLloBrug1hKPgssSt2g:c5S9yak7cV2VgpvJdXN0B7+sPhv7StN
TLSH
T170165A1AFEE48C75E1B356718AB5A31C96767C304B31828B6280360EDDB1FE19E35727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Device Association Framework\Store\	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework\Store	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-19_ca867fcc6f27898b2735cc0766d194c3_amadey_coinminer_darkgate_fabookie_glassworm_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_ca867fcc6f27898b2735cc0766d194c3_amadey_coinminer_darkgate_fabookie_glassworm_smoke-loader_stop.exe"
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Modifies data under HKEY_USERS
PID:2444

memory/1396-0-0x0000000002D20000-0x0000000002DBE000-memory.dmp

Download

memory/1396-3-0x0000000002D20000-0x0000000002DBE000-memory.dmp

Download

memory/2444-1-0x000001EBAF280000-0x000001EBAF31E000-memory.dmp

Download

memory/2444-16-0x000001EBAF280000-0x000001EBAF31E000-memory.dmp

Download