2703897bd64357b067dcf53d90c9e032c725bed47b1767c504a27dcaec34e71c

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 04:49

Target
2026-04-20_1e808ba9498db5b03b923e60d48697ad_amadey_darkgate_fabookie_glassworm_hawkeye_manuscrypt_rh.exe
Size 2.3MB
Sample260420-ffslpsdt2s
SHA256 2703897bd64357b067dcf53d90c9e032c725bed47b1767c504a27dcaec34e71c
MD5 1e808ba9498db5b03b923e60d48697ad
SHA1 7bb5f44fb1deeb1b60597b499bc414a5e9465375
SHA512 9e6be886c37b054662d5447d101391af1e2ba26ff03ff15c65ed3e520fbef63c4e372dc6b60a280a7d0665883aaf0e93eba4c59faf31d44c2f965b6bfeaa5905
SSDEEP 24576:WvxN3stbB3UJH8b5vxN3stbB3u5vPOTNRc+lPYk0sDOFaewsAj+:WvxWJYIvxWJ5u5HOTv8sDOAlj
TLSH
T1A5B5D211AA548071DC1E0E304651A639F9246C5FFE1F3D8B6E507EEEBBF32C12A25276
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Device Association Framework\Store	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Device Association Framework\Store\	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-20_1e808ba9498db5b03b923e60d48697ad_amadey_darkgate_fabookie_glassworm_hawkeye_manuscrypt_rh.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_1e808ba9498db5b03b923e60d48697ad_amadey_darkgate_fabookie_glassworm_hawkeye_manuscrypt_rh.exe"
1⤵
PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Modifies data under HKEY_USERS
PID:2284