7bc749bea2394f28bb9c0d8d371c499015dd66856bafb2620ec7f46930050a93

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe
Size 449KB
Sample260727-d9b5psgn51
SHA256 7bc749bea2394f28bb9c0d8d371c499015dd66856bafb2620ec7f46930050a93
MD5 d886c2bae873529a11df42d4fd11e977
SHA1 9d4a10da4284734688659afdbb048bb11ba5ea1a
SHA512 73c7874a831465763ab86b04de8f5ffc51a1cf713351a91ed45459b94572760017fb9fcf0b62f6d992ef05a2914a71e1e0f3950a6cf3cb3e07be9832870d0168
SSDEEP 6144:NhxXYNt45SvibADn0ofR7JxNwqdfNqWVqQfIcbXr1VJCIA6srTZbRO:NhxCL0QJTEWVqQfISxVJCIApO
TLSH
T155A43A027790D036D16235764E97DEB566AABD235E23534B7BD07F3FBE301918A2830A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1116	2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1116	2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe
1116	2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 1116	5724	2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Users\Admin\AppData\Local\Temp\2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-27_d886c2bae873529a11df42d4fd11e977_amadey_elex_icedid_smoke-loader_stop.exe
Size 353KB
SHA256 98dc2c1e340c6da6a9ff619f368e9b27b12a2853cd06b229fc0739837c538cf6
MD5 be89e1c81ae44f01b77c1c1be9486faa
SHA1 cb317468b340a8c6eada7e9d16079c3aa9ac5b31
SHA512 9eeda0cf6e7b968c7bf8cd33d02388e69d47610cc44cd51a955baf743ef89f9f52ee7f8737b23694678e11c7113bc8e70fd121e0c7e1516267a27fb38a59b657
SSDEEP 6144:7xXYNt45SvibADn0ofR7JxNwqdfNqWVqQfIcbXr1VJCIA6srTZbRO:7xCL0QJTEWVqQfISxVJCIApO
TLSH
T12A743A127790C436C26235764A57DEB5A6AEBD235E2353477BD03F3FBE301919A2830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7A09.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7A09.tmp
Size 96KB
SHA256 99a67842537d0a92c9374a2032cfbdbdd649a2f9459ffcb0129d6613b006aff3
MD5 50baf9d53e0267d10f5ed3bb74dc1813
SHA1 52cf34f405e0daee49302253ceb5588798ec3d4a
SHA512 28c7af4c579f2b740b8d4ebcc742ac6f5a5561564cdbd3cf60212d048a540f653c726bedf580982e12a8a124a6e79bd06e09a4d668c111e3eba9b59ad376d50c
SSDEEP 384:Wu9xD0sO20SeBcV5fxZ2/AGbzx4fbIot3qnd9ZOxaefMlN+DW6dM72VlLkKmX:WuLv0SpxeAidabHtydtZlNoJY2VFTI
TLSH
T18AA3B58DA9C6F156E02049BE2FFAEEA547667C272743732FA7C0BD1B7B715810D46202
MD5 SHA1 SHA512 SSDEEP TLSH