Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
- Size 76.4MB
- Sample260730-ejrcdasxbv
- SHA256 74d852ad168db96db41f80bfac63d3161f5dcd5651f0e5fc9d8bcb24446b4105
- MD5 06fb88fec63b1295f9ff7908371c639f
- SHA1 cb5f8fb38861724210ac972f9fd880afbc2306c0
- SHA512 49f0fc96b5614a1a7b7c5b0adfbfae071f9b15fda1735bfe4c4d766ae6bf714e86dc4f81f2773db4fe9b6436a0928697451821524593ffca257b2864bb1cab48
- SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpO:9iLVelepClAy6uw3W0BEROh2nvv4
- TLSH T1EF08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4924 FWAInstallMonitor.exe - Loads dropped DLL 6 IoCs
pid Process 4888 MsiExec.exe 4888 MsiExec.exe 4888 MsiExec.exe 4888 MsiExec.exe 4888 MsiExec.exe 4888 MsiExec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe\" -r" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe\" -r" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Msiexec.exe File opened (read-only) \??\Y: Msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: Msiexec.exe File opened (read-only) \??\Z: Msiexec.exe File opened (read-only) \??\B: Msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: Msiexec.exe File opened (read-only) \??\K: Msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: Msiexec.exe File opened (read-only) \??\J: Msiexec.exe File opened (read-only) \??\M: Msiexec.exe File opened (read-only) \??\S: Msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: Msiexec.exe File opened (read-only) \??\A: Msiexec.exe File opened (read-only) \??\E: Msiexec.exe File opened (read-only) \??\G: Msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: Msiexec.exe File opened (read-only) \??\V: Msiexec.exe File opened (read-only) \??\E: Msiexec.exe File opened (read-only) \??\G: Msiexec.exe File opened (read-only) \??\W: Msiexec.exe File opened (read-only) \??\X: Msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: Msiexec.exe File opened (read-only) \??\L: Msiexec.exe File opened (read-only) \??\Q: Msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: Msiexec.exe File opened (read-only) \??\K: Msiexec.exe File opened (read-only) \??\N: Msiexec.exe File opened (read-only) \??\Z: Msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: Msiexec.exe File opened (read-only) \??\U: Msiexec.exe File opened (read-only) \??\R: Msiexec.exe File opened (read-only) \??\H: Msiexec.exe File opened (read-only) \??\P: Msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: Msiexec.exe File opened (read-only) \??\M: Msiexec.exe File opened (read-only) \??\T: Msiexec.exe File opened (read-only) \??\W: Msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: Msiexec.exe File opened (read-only) \??\L: Msiexec.exe File opened (read-only) \??\O: Msiexec.exe File opened (read-only) \??\A: Msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI92E1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9301.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9340.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9516.tmp msiexec.exe File opened for modification C:\Windows\Products.ini 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe File created C:\Windows\Installer\e598f55.msi msiexec.exe File opened for modification C:\Windows\Installer\e598f55.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9536.tmp msiexec.exe File opened for modification C:\Windows\Products.ini 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe File opened for modification C:\Windows\Installer\MSI908E.tmp msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWAInstallMonitor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Msiexec.exe - Kills process with taskkill 1 IoCs
pid Process 2152 taskkill.exe - Modifies registry class 33 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "1" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "878F55A2C44B4559BA045875F21A6988" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "878F55A2C44B4559BA045875F21A6988" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA} 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "1" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true" 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 440 Msiexec.exe Token: SeIncreaseQuotaPrivilege 440 Msiexec.exe Token: SeSecurityPrivilege 1964 msiexec.exe Token: SeCreateTokenPrivilege 440 Msiexec.exe Token: SeAssignPrimaryTokenPrivilege 440 Msiexec.exe Token: SeLockMemoryPrivilege 440 Msiexec.exe Token: SeIncreaseQuotaPrivilege 440 Msiexec.exe Token: SeMachineAccountPrivilege 440 Msiexec.exe Token: SeTcbPrivilege 440 Msiexec.exe Token: SeSecurityPrivilege 440 Msiexec.exe Token: SeTakeOwnershipPrivilege 440 Msiexec.exe Token: SeLoadDriverPrivilege 440 Msiexec.exe Token: SeSystemProfilePrivilege 440 Msiexec.exe Token: SeSystemtimePrivilege 440 Msiexec.exe Token: SeProfSingleProcessPrivilege 440 Msiexec.exe Token: SeIncBasePriorityPrivilege 440 Msiexec.exe Token: SeCreatePagefilePrivilege 440 Msiexec.exe Token: SeCreatePermanentPrivilege 440 Msiexec.exe Token: SeBackupPrivilege 440 Msiexec.exe Token: SeRestorePrivilege 440 Msiexec.exe Token: SeShutdownPrivilege 440 Msiexec.exe Token: SeDebugPrivilege 440 Msiexec.exe Token: SeAuditPrivilege 440 Msiexec.exe Token: SeSystemEnvironmentPrivilege 440 Msiexec.exe Token: SeChangeNotifyPrivilege 440 Msiexec.exe Token: SeRemoteShutdownPrivilege 440 Msiexec.exe Token: SeUndockPrivilege 440 Msiexec.exe Token: SeSyncAgentPrivilege 440 Msiexec.exe Token: SeEnableDelegationPrivilege 440 Msiexec.exe Token: SeManageVolumePrivilege 440 Msiexec.exe Token: SeImpersonatePrivilege 440 Msiexec.exe Token: SeCreateGlobalPrivilege 440 Msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 4888 MsiExec.exe Token: SeSecurityPrivilege 4888 MsiExec.exe Token: SeTakeOwnershipPrivilege 4888 MsiExec.exe Token: SeLoadDriverPrivilege 4888 MsiExec.exe Token: SeSystemProfilePrivilege 4888 MsiExec.exe Token: SeSystemtimePrivilege 4888 MsiExec.exe Token: SeProfSingleProcessPrivilege 4888 MsiExec.exe Token: SeIncBasePriorityPrivilege 4888 MsiExec.exe Token: SeCreatePagefilePrivilege 4888 MsiExec.exe Token: SeBackupPrivilege 4888 MsiExec.exe Token: SeRestorePrivilege 4888 MsiExec.exe Token: SeShutdownPrivilege 4888 MsiExec.exe Token: SeDebugPrivilege 4888 MsiExec.exe Token: SeSystemEnvironmentPrivilege 4888 MsiExec.exe Token: SeRemoteShutdownPrivilege 4888 MsiExec.exe Token: SeUndockPrivilege 4888 MsiExec.exe Token: SeManageVolumePrivilege 4888 MsiExec.exe Token: 33 4888 MsiExec.exe Token: 34 4888 MsiExec.exe Token: 35 4888 MsiExec.exe Token: 36 4888 MsiExec.exe Token: SeRestorePrivilege 1964 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4924 FWAInstallMonitor.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1572 wrote to memory of 440 1572 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe 85 PID 1964 wrote to memory of 4888 1964 msiexec.exe 89 PID 4888 wrote to memory of 2152 4888 MsiExec.exe 92 PID 4472 wrote to memory of 452 4472 2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe 94 PID 4888 wrote to memory of 4924 4888 MsiExec.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AAB9FA023A1DD52F7B102DA88C558AA62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\taskkill.exetaskkill /IM FWAInstallMonitor.exe /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2152
-
-
C:\ProgramData\FWAInstallMonitor.exe"C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 48883⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4924
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe" -r1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\Msiexec.exeMsiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:452
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\CloudAgentCleanupHelper.LOG
- Size 4KB
- SHA256 2c4f8a2947afba1e521c3eb1e3d727a0fa2cfddf65e4ee8aff66998df092787d
- MD5 4c22ddc08b6e7ac51250e4ae111a3c6a
- SHA1 3b4286be4cd55ef4eb0c4d6dacef0cc58c4023a0
- SHA512 9a6441901de42d4659cbe06a87b55feb69c16fa7605e42b8aebd589437da8cbf554074751e8428aa51b7b6d1bde530d94d4f128f25ca91f09fca6f4b92d99f3e
- SSDEEP 96:QZqtHvZR8NjgGHKH9gy+SgYy+vA9J+Sgx+vA9K+Sgy+vA9A+Sgo+pu9g+Sgo+pua:QZqtHvZbGHKH9gy+S7y+vA9J+Sk+vA9l
- TLSH T1E591E61277D4246C7D3F668174F718CF6FB64EE432CA1234BB6A6203A46A45EC62D707
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\CloudAgentCleanupHelper.LOG
- Size 6KB
- SHA256 4383e666b000fa59096acce8c8509eab65eb129a82b2128c7760ea20cef2dc5d
- MD5 e55ec275a5a8b45023178886b48fdf71
- SHA1 0d69da3f00e26ee7c92da1e67e7176c3c9b8c24a
- SHA512 872389df0060c789e4e14930740601166b8263a1cd2000614ca629827417ec5e442bc064e09612013882fb774a11c429f7bbe809b49bd667ab5cd49c71050c8b
- SSDEEP 192:QZqtHvZbGHKH9gy+S7y+vA9J+Sk+vA9K+Sf+vA9A+Sv+pu9g+S9+pu9t+Se+499E:hgXS7X8cS18PSW8BSGEhSAEQSTexSwE1
- TLSH T107D1F71277D5246C7D3F668174FB18CF6FBA4AE432DA1234BB6A6203A46B44EC12D707
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI98d42.LOG
- Size 1KB
- SHA256 d4910d97535aa4d459af8ddaa431f9a93d003c6892c33f1708def8e06da9b67b
- MD5 a191a036aecb0cbe128dc744d614d8d5
- SHA1 c186a21ecda4eb194a614052e3c789cd2714b6d1
- SHA512 e33fc75c94e0f6a122a6227734e61148c3f773cce2b6c23b818eea27bdddc1cdeb68ed0ead353599d46578395fbb81759623474b053824d2a05c17f5ce515bc2
- TLSH T1363106601AE50848F1B75B07EAF7C0626A73BCD1BC75DB0C234A8359066BD09996C3BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9a2ce.LOG
- Size 2KB
- SHA256 af52a531cc1c9b68939ed6aeb1a06fe6bc8a038afed192d729aa8dd4b78ec9b2
- MD5 7e2b6992e56014473d46916b2557b9d9
- SHA1 84cced78c4c58d6fa38e436ed508ecb619d37fb1
- SHA512 430f92526ef585ad57a5bdcfaf249f8c58a8a4c6a0b5c95f696e05b0f76bc1435f17a5ca536a17854d8fef389c32ffad97131001a26c7957eb1df13950fb1693
- TLSH T11351E9441FE4090AF2B75B87D9F3815299B3FCE1683ADB1C2246825D066AD089D7C7AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
- Size 9.5MB
- SHA256 e3a5ef9bb1bbe8e73b19a9bd44c94a40e3c3f24ade4266759f32c68f3b2442cd
- MD5 40db4f6f5948bf3b403c27c9d60ffd5f
- SHA1 4012f00f697e3199f06a2e8e984f2b75aa767344
- SHA512 40bbb0445b87ae4eeba9ddc0d2472f0a3b1cb79b84aa43043272e463cbad378755373ea63ec490e26627edc7df95a1730e23eb4b1b1866987b2bcea5ce060744
- SSDEEP 196608:aisGNpFZNtHRXNJBVh0Y+XyjwBXyGJhqc09u0kuAgJ0+V/oxYuK1V:CGNpFZzHRd9n+X1BXy6hqc0g0kuAgJ1B
- TLSH T104A6011177E9C136E5AFC6B0BE3E8769C53AB8700B3183CBA394791D5E706D19A32316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
- Size 3.3MB
- SHA256 33c3b17c95b55c61031a3495cd65112002446672b3c1ccf1b85bcc9188b1b42a
- MD5 508ce23fb4ac51adbded667716ee9784
- SHA1 caed7cc6efe1e3c3cb5de19483edd5b7a71d7150
- SHA512 cea1c65de6b32b04e9620d14ad00dbef7e07007d09d2cc9cf8803eac8a7245c0e6073d5c731b569217469d9dfea5a1ea40c3d851a72d1387108a97a82edf6f5b
- SSDEEP 98304:JxW6YyxN+L1S6MQm8wGmK7/7dIYPm12cwuW3lPOaD:jIL3Bm8yYdS12plWa
- TLSH T10EF5F0117790C13AE0AE06B268689375452DFC314B38E5CBF3C99A6E2DB16D29F31B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
- Size 8.6MB
- SHA256 93086fd06785cf7e458f4798cf86f598e7e47dbe0e3248a2e94af2f26edc2935
- MD5 587d75e54fb87e91c058cde80a7454f8
- SHA1 5019e07547d219c7c8ffc644d376785766f1dea4
- SHA512 d41aeec92a07ae55a5f5ccb7e271bb031fc0a4da2725d7139b3d930f8b4ef564309af42ef7d4440c05bac48af3faa97c2a71b9f89e132d8ab2fed4272c7ca556
- SSDEEP 196608:66NEsCIMXI7Vd5RfT+AHYfhKlU8T+CoFeO:nbn5tTl8hKlaCC
- TLSH T18896E10136FC8A34D3B742359ABE9A52DA79BC61473192DB33DCA52E1F33690C936B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
- Size 4.3MB
- SHA256 fa6c682d61e6187bf400f7b208c3ff0cbeda5a31f67e47c4233d8f0036b70831
- MD5 295562bcdd024ee90f0acdfcf76c949a
- SHA1 6db1150e865de30a50d529da93b6f93c80c719a0
- SHA512 e72237e74e751c411196f175ac38119d25f60aafe15a1f6351114c3077596ffa772d030425ed145244a17c1d7a9035fd582911524d364b30fe3d2fa3453d7f78
- SSDEEP 98304:7SbMYy7DKHEk61+7nZBENxBYhe2qJXQ2Tkn7J2LPD:2Ff61+zZBENjYM2qXAns
- TLSH T15E260212B3908276D5EB4238896B43959772BC618B30C7CF63D4862E6F33BD19E36356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{0D326B4C-1102-4C69-8266-7323C701B45C}\FWACleanupHelper.exe
- Size 611KB
- SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
- MD5 b3157f7d3822d40038f4db3ee31dba3d
- SHA1 d64d7163ed661aa841d8e67568040c5123dc3da2
- SHA512 2b63a3f9f417c17487fba27d83e6cd4f272ccca4d55bca0e3568d46d7a34f8b9659e268523478c9906f1f81f454f9653cf690625810eea6ec8b0896e234a4197
- SSDEEP 12288:ACm6OKpNV4Rj4hGv6ABG2LvvVIcEjmi/zq9+FAC3cKiv44Piy:ACrGKGvS2Lv3ESi/m9+FA8cKivDPiy
- TLSH T1BED48E2177F5C136E4A611B19E7E8769443AF8605F3252CBA3C84A2D5F706C2EB36336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI908E.tmp
- Size 57KB
- SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
- MD5 d480853146cffda8e468cc4d2751b405
- SHA1 e0b9de6eb4e0f5a92411dfe12a2e498a39eb102b
- SHA512 c22fe3996ea0eeaed9dc4f90e107a5e4b9c5e56fe1bf33b09db2bdc6ae52fc57fee70ca7d4b02d8f446257b2c46c5927a1961146588b7dbc0af4e6104a481f2f
- SSDEEP 768:i0J8+QCTqaHxKkUmrVSarTJym3OZESrcvFKuSL5bCC1q:ACTq2ttpDJT+lc9SVCUq
- TLSH T16A436C127AD200B7D78A4B3165E79F279E3F7A441FE114839FB1499A2D367E0533A20B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI92E1.tmp
- Size 138KB
- SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
- MD5 b96cc173298220d17aa0932bf3047727
- SHA1 38b81f2f69916d52d5d8c95185150c20586fe0ea
- SHA512 7357ea0a95b77c2bb51283e7859b2ac000804bed4aeedeea22b7e6b261a7fece110c13f244bc3458ddaaa6d9f94ebb0098ffb37c7b5d733db49aea17e04040ca
- SSDEEP 3072:rqNFBYkgRKygZ8P/5TZ5mMMRkNBorzgSLgG5y25Jj+d:ySkgUy+IdZ5MCIrziI0d
- TLSH T198D34A11B7E0C032E0AA2A35593AD7616A3BB8709F74C9CB77744A6E4E707D0AE35347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9301.tmp
- Size 1.1MB
- SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
- MD5 4cd4d7ccba93300d456b696e8ec502c5
- SHA1 a524ec31e03a1be01a8bc9642798b9ac01a37769
- SHA512 cdf9a789f71119aff8e346d19768be6a35351e3d3b8300b6dbd45e95333cc3c671a5b3344498ed72d6f631e7c62fbaab3844bef650a1a8451ed8d93e48e8e10e
- SSDEEP 24576:3WseR7GnW/+lcje7pIssCNbcbO12P0SSGgqbLcgO3x5Pi1:3W7GnW/+Ee7pINUcbO0sSwqbLcgO3Li1
- TLSH T183356C2177ECC236FAEF16B0AE39566A047EB9710F3081CBE384994D6D706D29A31717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Products.ini
- Size 380B
- SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
- MD5 6c310b6e27c949b929a3843d57c8ba37
- SHA1 cc64ec1df32a85b0e49f1eb169e2d39cee5fb8bb
- SHA512 1cd167fc8fdf41d0c414c9dd85e1a12f8f9c7e0dd55ade21cf9279e6bbd54d4bf54775cfefddc725e6a24a533ed23908b56acd2ff6064268c2fe9d69cca2b6fa
- TLSH T1E9E09B858246C77D7948325F4773B7FE9891290C3A19F7315759580D1381109F3F7116
- MD5 SHA1 SHA512 TLSH