74d852ad168db96db41f80bfac63d3161f5dcd5651f0e5fc9d8bcb24446b4105

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Size 76.4MB
Sample260730-ejrcdasxbv
SHA256 74d852ad168db96db41f80bfac63d3161f5dcd5651f0e5fc9d8bcb24446b4105
MD5 06fb88fec63b1295f9ff7908371c639f
SHA1 cb5f8fb38861724210ac972f9fd880afbc2306c0
SHA512 49f0fc96b5614a1a7b7c5b0adfbfae071f9b15fda1735bfe4c4d766ae6bf714e86dc4f81f2773db4fe9b6436a0928697451821524593ffca257b2864bb1cab48
SSDEEP 1572864:9qnRKucBo8QYoex4GNpojnhK6x4lAy6I35do0lolLW0BEROoexIVPylcHGovpO:9iLVelepClAy6uw3W0BEROh2nvv4
TLSH
T1EF08011377948131E1AB5230692E9739D67ABCB14B3092CB738C7A2D1F377D09A36726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3884	FWAInstallMonitor.exe

Loads dropped DLL 6 IoCs

pid	Process
1904	MsiExec.exe
1904	MsiExec.exe
1904	MsiExec.exe
1904	MsiExec.exe
1904	MsiExec.exe
1904	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe\" -r"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\FaronicsOfflineInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe\" -r"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\O:	Msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	Msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\R:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	Msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\D:	Msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	Msiexec.exe
File opened (read-only)	\??\I:	Msiexec.exe
File opened (read-only)	\??\J:	Msiexec.exe
File opened (read-only)	\??\Y:	Msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\S:	Msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe
File opened (read-only)	\??\T:	Msiexec.exe
File opened (read-only)	\??\X:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	Msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	Msiexec.exe
File opened (read-only)	\??\G:	Msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	Msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	Msiexec.exe
File opened (read-only)	\??\K:	Msiexec.exe
File opened (read-only)	\??\Q:	Msiexec.exe
File opened (read-only)	\??\K:	Msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	Msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe
File opened (read-only)	\??\W:	Msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	Msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	Msiexec.exe
File opened (read-only)	\??\D:	Msiexec.exe
File opened (read-only)	\??\Z:	Msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	Msiexec.exe
File opened (read-only)	\??\V:	Msiexec.exe
File opened (read-only)	\??\A:	Msiexec.exe
File opened (read-only)	\??\V:	Msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Products.ini	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
File created	C:\Windows\Installer\e597248.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI747A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI793E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI797E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79BD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A7A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e597248.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7AD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Products.ini	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FWAInstallMonitor.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5592	taskkill.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "1"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\WID	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Name	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "878F55A2C44B4559BA045875F21A6988"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\MobileSupportEnabled = "true"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Version	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Policy	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\GroupId = "2"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CK = "878F55A2C44B4559BA045875F21A6988"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CanActAsSA = "true"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\CoreInfoVersion = "1"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Group	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PayloadInfo	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\PolicyId = "1"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Status	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\OsInfo	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent\Server = "https://deploy.faronics.com/"	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4284	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	4284	Msiexec.exe
Token: SeSecurityPrivilege	108	msiexec.exe
Token: SeCreateTokenPrivilege	4284	Msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4284	Msiexec.exe
Token: SeLockMemoryPrivilege	4284	Msiexec.exe
Token: SeIncreaseQuotaPrivilege	4284	Msiexec.exe
Token: SeMachineAccountPrivilege	4284	Msiexec.exe
Token: SeTcbPrivilege	4284	Msiexec.exe
Token: SeSecurityPrivilege	4284	Msiexec.exe
Token: SeTakeOwnershipPrivilege	4284	Msiexec.exe
Token: SeLoadDriverPrivilege	4284	Msiexec.exe
Token: SeSystemProfilePrivilege	4284	Msiexec.exe
Token: SeSystemtimePrivilege	4284	Msiexec.exe
Token: SeProfSingleProcessPrivilege	4284	Msiexec.exe
Token: SeIncBasePriorityPrivilege	4284	Msiexec.exe
Token: SeCreatePagefilePrivilege	4284	Msiexec.exe
Token: SeCreatePermanentPrivilege	4284	Msiexec.exe
Token: SeBackupPrivilege	4284	Msiexec.exe
Token: SeRestorePrivilege	4284	Msiexec.exe
Token: SeShutdownPrivilege	4284	Msiexec.exe
Token: SeDebugPrivilege	4284	Msiexec.exe
Token: SeAuditPrivilege	4284	Msiexec.exe
Token: SeSystemEnvironmentPrivilege	4284	Msiexec.exe
Token: SeChangeNotifyPrivilege	4284	Msiexec.exe
Token: SeRemoteShutdownPrivilege	4284	Msiexec.exe
Token: SeUndockPrivilege	4284	Msiexec.exe
Token: SeSyncAgentPrivilege	4284	Msiexec.exe
Token: SeEnableDelegationPrivilege	4284	Msiexec.exe
Token: SeManageVolumePrivilege	4284	Msiexec.exe
Token: SeImpersonatePrivilege	4284	Msiexec.exe
Token: SeCreateGlobalPrivilege	4284	Msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1904	MsiExec.exe
Token: SeSecurityPrivilege	1904	MsiExec.exe
Token: SeTakeOwnershipPrivilege	1904	MsiExec.exe
Token: SeLoadDriverPrivilege	1904	MsiExec.exe
Token: SeSystemProfilePrivilege	1904	MsiExec.exe
Token: SeSystemtimePrivilege	1904	MsiExec.exe
Token: SeProfSingleProcessPrivilege	1904	MsiExec.exe
Token: SeIncBasePriorityPrivilege	1904	MsiExec.exe
Token: SeCreatePagefilePrivilege	1904	MsiExec.exe
Token: SeBackupPrivilege	1904	MsiExec.exe
Token: SeRestorePrivilege	1904	MsiExec.exe
Token: SeShutdownPrivilege	1904	MsiExec.exe
Token: SeDebugPrivilege	1904	MsiExec.exe
Token: SeSystemEnvironmentPrivilege	1904	MsiExec.exe
Token: SeRemoteShutdownPrivilege	1904	MsiExec.exe
Token: SeUndockPrivilege	1904	MsiExec.exe
Token: SeManageVolumePrivilege	1904	MsiExec.exe
Token: 33	1904	MsiExec.exe
Token: 34	1904	MsiExec.exe
Token: 35	1904	MsiExec.exe
Token: 36	1904	MsiExec.exe
Token: SeRestorePrivilege	108	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4284	Msiexec.exe
108	msiexec.exe
1904	MsiExec.exe
2468	Msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 4284	5972	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe	91
PID 108 wrote to memory of 1904	108	msiexec.exe	95
PID 1904 wrote to memory of 5592	1904	MsiExec.exe	96
PID 3928 wrote to memory of 2468	3928	2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe	98
PID 1904 wrote to memory of 3884	1904	MsiExec.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4284

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D8719DDD99598541315F8745E82D3EDC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM FWAInstallMonitor.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5592
- - C:\ProgramData\FWAInstallMonitor.exe
    "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 1904
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3884

C:\Users\Admin\AppData\Local\Temp\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_06fb88fec63b1295f9ff7908371c639f_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe" -r
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\Msiexec.exe
  Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CloudAgentCleanupHelper.LOG

Path C:\ProgramData\CloudAgentCleanupHelper.LOG
Size 16KB
SHA256 14ece01eb830f87ea7bee7214c6671b26bd5a22cad0e33fd2a8c709ee75f3b9a
MD5 a162115a4e8e640cfe524492ac4f5281
SHA1 b7a3695040adee58624e548a5fb8d84d0d5387ff
SHA512 a68e2af1c55d6efa8b7d9781affea2a7dc0a68cc0c201190b615c191054be400f4152c21428647e0143df7081bd1da6d54f523c6980651ed100191b53ce9f237
SSDEEP 384:T6Uh3DtgNS7NXTShQ5SUYHSUYnS0AlSyivS+SeSHqTSmyfS0ydSkynSQo/dSqdaT:NgNS7NXTShQ5SUYHSUYnS0AlSyivS+SF
TLSH
T13C723B0179D5306D2E3F6A814AFB19CD7FB98AD422D432B4B9BE7103916B84EC47CB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudAgentCleanupHelper.LOG

Path C:\ProgramData\CloudAgentCleanupHelper.LOG
Size 3KB
SHA256 de7876f6d525ab60a89afa626cfd8f40352b97134bd3d256cc92854b2669880c
MD5 ddb1cc8eb843593a411c49a5e766f5a4
SHA1 b59299d836d22adbe3df6c25559223910123b85b
SHA512 4e1c94bb7ad0de3ce1128f1586accc1d869234a3fdd85172b97eaeaf08c2a937b0f4cc5c8336041c808589583455bbb22dd9f69d966f985c590e66b17edc43bb
TLSH
T109811B023AD5205E2D3F6A8147F719CE6FFA4DE832C832B5B77A7213506A85ED42C746
MD5 SHA1 SHA512 TLSH

Submit Download

FWAInstallMonitor.exe

Path C:\ProgramData\FWAInstallMonitor.exe
Size 611KB
SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
MD5 b3157f7d3822d40038f4db3ee31dba3d
SHA1 d64d7163ed661aa841d8e67568040c5123dc3da2
SHA512 2b63a3f9f417c17487fba27d83e6cd4f272ccca4d55bca0e3568d46d7a34f8b9659e268523478c9906f1f81f454f9653cf690625810eea6ec8b0896e234a4197
SSDEEP 12288:ACm6OKpNV4Rj4hGv6ABG2LvvVIcEjmi/zq9+FAC3cKiv44Piy:ACrGKGvS2Lv3ESi/m9+FA8cKivDPiy
TLSH
T1BED48E2177F5C136E4A611B19E7E8769443AF8605F3252CBA3C84A2D5F706C2EB36336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI96f0c.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI96f0c.LOG
Size 1KB
SHA256 5d6f796c1eac68b15831cf413aa4e48602090bbc6450aa19e66c8511cba6aa6e
MD5 79d058977f83195ce54ffca2597cb9cf
SHA1 311321770db51f4c7711d090cac2294b97048818
SHA512 dcbf79707a4699c6507fbafc93494f60422bf483978f26b7c6ac4a21b4b870c6af12462e29b3f8b725e58e3f8427450fc0f549ecfc266d5b11dbf8485c865fb6
TLSH
T19031C6516EE5080AB2F75B87EDF3C0A24A73FCEA6C75C70D23498359066BD058D6C366
MD5 SHA1 SHA512 TLSH

Submit Download

MSI98052.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI98052.LOG
Size 3KB
SHA256 827d1d36a3cf56e39a0be456282ffc751505f05fd46d97a6b6f522b5bc95d140
MD5 1fa29b4c7d657bb45b64b4b3b6c33ddc
SHA1 83a7408ab457635cce868d7ff20afffde02042ac
SHA512 b54a7277558ce26c2a7d3666dfa6299b4a8d67fec9e9329aa9fc3722e9ccf9cd2e2f16efc3743099a254166be854a063a1c396d2494d94d1f8309d808433f1c8
TLSH
T12A8106141FF4050AB2B75B479EF381119A33BDA96839D64C2196939D06B2D099C3D3BF
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud Agent_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
Size 9.5MB
SHA256 1a54449e2f5cd4e96afe36992e04425494018f8a41061e0df9e8b313c0aabe82
MD5 ff9feff0e2e8f96fc9195ffeb0f2c79c
SHA1 3b75f09699d00e7949d4c81eda15311f8dee6261
SHA512 61192d39beeef91222d9de8bfd03dbbe3791943db540a54add6ba4dfc01f91b356ae8f5b5d31cc20af8ec530d3a6b10081d726b5e485d6206f7fa14462f1a5b7
SSDEEP 196608:LisGNpFZNtHRXNJBVh0Y+XyjwBXyGJhqc09u0kuAgJ0+V/oxYuK1V:dGNpFZzHRd9n+X1BXy6hqc0g0kuAgJ1B
TLSH
T140A6011177E9C136E5AFC6B0BE3E8769C53AB8700B3183CBA394791D5E706D19A32316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imaging Client_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
Size 3.3MB
SHA256 65549ece7b43b5def299b039ae97174c2508e979f5cdcdc6900cd6d5566f5514
MD5 50abbf8dd255e028889901ab9d16d872
SHA1 7ec370128d0129660719a0f55024f7d2e5f9e07b
SHA512 e13adbe99776cc5c1500c99e826280b5cdb99ab30202197b6c278c1c870c9282166f697d640c6f433c79f6466d7534edfeefad85cbecb9658eb404c79bd44eb7
SSDEEP 98304:txW6YyxN+L1S6MQm8wGmK7/7dIYPm12cwuW3lPOaD:/IL3Bm8yYdS12plWa
TLSH
T1AAF5F0117790C13AE0AE06B268689375452DFC314B38E5CBF3C99A6E2DB16D29F31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Software Updater_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
Size 8.6MB
SHA256 094a1208ed2b435289921335278dc28a916572953a095cda99318a204bc0f7c3
MD5 3d49c8b822eef55bbe3bc312f407bfa6
SHA1 4c513cc14457fc2a949f508e91f21716725daa41
SHA512 bc77e5cf681a31799c70bc6f9482fd377b03ca592e4cfeaeb9eaf76986bc5cb29c477a3e0bc38f6d5a608aa8c9671c126836da542236dc17311b98da26a4397d
SSDEEP 196608:66NEsCIMXI7Vd5RfT+AHYfhKlU8T+CoFeO:nbn5tTl8hKlaCC
TLSH
T10796E10136FC8A34D3B742359ABE9A52DA79BC61473192DB33DCA52E1F33690C936B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Usage Stats_C64.msi

Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
Size 4.3MB
SHA256 d47922b96c62453a8eac94310fe1e9d117e18972d50f5c3151d04b98a2cfad66
MD5 2b4192694be3b123bbc1c90edc201826
SHA1 4b891c08239c278f673d174c0c16f893a6c04530
SHA512 a883f06c98bf292928d52cec880a38735bf20b7de9920b1a63457120d6194eb420d68cab6301210db485ca33454592ce2137085bdb5fefd8f52eccee2458601d
SSDEEP 98304:0SbMYy7DKHEk61+7nZBENxBYhe2qJXQ2Tkn7J2LPD:XFf61+zZBENjYM2qXAns
TLSH
T155260212B3908276D5EB4238896B43959772BC618B30C7CF63D4862E6F33BD19E36356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI747A.tmp

Path C:\Windows\Installer\MSI747A.tmp
Size 57KB
SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
MD5 d480853146cffda8e468cc4d2751b405
SHA1 e0b9de6eb4e0f5a92411dfe12a2e498a39eb102b
SHA512 c22fe3996ea0eeaed9dc4f90e107a5e4b9c5e56fe1bf33b09db2bdc6ae52fc57fee70ca7d4b02d8f446257b2c46c5927a1961146588b7dbc0af4e6104a481f2f
SSDEEP 768:i0J8+QCTqaHxKkUmrVSarTJym3OZESrcvFKuSL5bCC1q:ACTq2ttpDJT+lc9SVCUq
TLSH
T16A436C127AD200B7D78A4B3165E79F279E3F7A441FE114839FB1499A2D367E0533A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI793E.tmp

Path C:\Windows\Installer\MSI793E.tmp
Size 138KB
SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
MD5 b96cc173298220d17aa0932bf3047727
SHA1 38b81f2f69916d52d5d8c95185150c20586fe0ea
SHA512 7357ea0a95b77c2bb51283e7859b2ac000804bed4aeedeea22b7e6b261a7fece110c13f244bc3458ddaaa6d9f94ebb0098ffb37c7b5d733db49aea17e04040ca
SSDEEP 3072:rqNFBYkgRKygZ8P/5TZ5mMMRkNBorzgSLgG5y25Jj+d:ySkgUy+IdZ5MCIrziI0d
TLSH
T198D34A11B7E0C032E0AA2A35593AD7616A3BB8709F74C9CB77744A6E4E707D0AE35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI797E.tmp

Path C:\Windows\Installer\MSI797E.tmp
Size 1.1MB
SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
MD5 4cd4d7ccba93300d456b696e8ec502c5
SHA1 a524ec31e03a1be01a8bc9642798b9ac01a37769
SHA512 cdf9a789f71119aff8e346d19768be6a35351e3d3b8300b6dbd45e95333cc3c671a5b3344498ed72d6f631e7c62fbaab3844bef650a1a8451ed8d93e48e8e10e
SSDEEP 24576:3WseR7GnW/+lcje7pIssCNbcbO12P0SSGgqbLcgO3x5Pi1:3W7GnW/+Ee7pINUcbO0sSwqbLcgO3Li1
TLSH
T183356C2177ECC236FAEF16B0AE39566A047EB9710F3081CBE384994D6D706D29A31717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Products.ini

Path C:\Windows\Products.ini
Size 380B
SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
MD5 6c310b6e27c949b929a3843d57c8ba37
SHA1 cc64ec1df32a85b0e49f1eb169e2d39cee5fb8bb
SHA512 1cd167fc8fdf41d0c414c9dd85e1a12f8f9c7e0dd55ade21cf9279e6bbd54d4bf54775cfefddc725e6a24a533ed23908b56acd2ff6064268c2fe9d69cca2b6fa
TLSH
T1E9E09B858246C77D7948325F4773B7FE9891290C3A19F7315759580D1381109F3F7116
MD5 SHA1 SHA512 TLSH

Submit Download

memory/108-72-0x0000029E80310000-0x0000029E80CB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads