Overview

overview

8

Static

static

3

2026-08-19...di.exe

windows10-2004-x64

8

2026-08-19...di.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 01:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_dcc72e9f0e848177ef17778170b6272d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
  • Size 76.4MB
  • Sample260819-bs2b6atgpc
  • SHA256 b5847db9db28ce5d4d61cb33371a1b8b033af7ace6edc1afe08b81d2b2de8617
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_dcc72e9f0e848177ef17778170b6272d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_dcc72e9f0e848177ef17778170b6272d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2752
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5800
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 84C97821DBAD1E34035ED7F6A7343FF4
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5592
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /IM FWAInstallMonitor.exe /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:5068
      • C:\ProgramData\FWAInstallMonitor.exe
        "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 5592
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2516
  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_dcc72e9f0e848177ef17778170b6272d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_dcc72e9f0e848177ef17778170b6272d_akira_amadey_avoslocker_darkgate_elex_hijackloader_icedi.exe" -r
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5648
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:260

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CloudAgentCleanupHelper.LOG
        • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
        • Size 16KB
        • SHA256 af3e59bfc01c495eada685fdbdaae6a429485a77751e13c6b32534045d180d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CloudAgentCleanupHelper.LOG
        • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
        • Size 12KB
        • SHA256 3fe524a970787ee067cff2cda7b43c088eaef459feb1c7de27edfe6bbfcdd09c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CloudAgentCleanupHelper.LOG
        • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
        • Size 1KB
        • SHA256 af13574bb62dd9364589d34e6bffcf8207ca2d3c9e354a15ce8e8c6a01497917
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FWAInstallMonitor.exe
        • Path C:\ProgramData\FWAInstallMonitor.exe
        • Size 611KB
        • SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI9263b.LOG
        • Path C:\Users\Admin\AppData\Local\Temp\MSI9263b.LOG
        • Size 1KB
        • SHA256 f4669652aced281d79acd1b9c096b09f65383aa8571655a4ba13c63f1297b9af
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI93e09.LOG
        • Path C:\Users\Admin\AppData\Local\Temp\MSI93e09.LOG
        • Size 2KB
        • SHA256 01bc16bd5460b619cad5e5a49d544b835daaa97b6d84b12b9268d3ef524fbcd0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Cloud Agent_C64.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
        • Size 9.5MB
        • SHA256 2d9bbd80897478b69a2f1daa8499d5861036284f87cadebd80a35ef03dcf9462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Imaging Client_C64.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
        • Size 3.3MB
        • SHA256 4ce89db00092b5a640d801727d62f45b255a9110e1a4589d72d89dbdad8e2214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Software Updater_C64.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
        • Size 8.6MB
        • SHA256 36be6bf425c5734831196a380c39eeb47e22bc86676a53897c0ff2ab09b91578
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Usage Stats_C64.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
        • Size 4.3MB
        • SHA256 9d3886125289c8ee1d3f0b1b5e0ca25529a942b68d89c7de00dd304df80606c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI2BF8.tmp
        • Path C:\Windows\Installer\MSI2BF8.tmp
        • Size 57KB
        • SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI6AD7.tmp
        • Path C:\Windows\Installer\MSI6AD7.tmp
        • Size 138KB
        • SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI6B26.tmp
        • Path C:\Windows\Installer\MSI6B26.tmp
        • Size 1.1MB
        • SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Products.ini
        • Path C:\Windows\Products.ini
        • Size 380B
        • SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/5800-47-0x0000016FE9090000-0x0000016FE9A34000-memory.dmp
        Download