f29b1bd394d1945db07c74b49da72a3f9225bfde2afa42af04d29f6a5e6ff237

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-27_7bf0cb2a8863b7a17a069491cf8aa5b4_amadey_cloudeye_elex_hijackloader_smoke-loader.exe
Size 1.0MB
Sample260928-eqpr5atz4r
SHA256 f29b1bd394d1945db07c74b49da72a3f9225bfde2afa42af04d29f6a5e6ff237
MD5 7bf0cb2a8863b7a17a069491cf8aa5b4
SHA1 d7b69389bded3eaa41146ee2ff48dfa971f55258
SHA512 fa48da566c914894d8c9becc6fae26085972a01d19f90094db0a4fb0ff9587d5c61b83e269d2147ab960652f4916921fe41a91ed04fc38c5ab0f5510e18ba5f3
SSDEEP 12288:1T1UjD5cZ9euP+bnEPeqSjwSoFWKtsm45G:1Tv7hmbEPeqSjfoF1tT45G
TLSH
T19C253B41B790D822D4AF493078F4E7272B39BCD56E61C6B7332AB78C4E707509A6835B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
5588	2026-09-27_7bf0cb2a8863b7a17a069491cf8aa5b4_amadey_cloudeye_elex_hijackloader_smoke-loader.exe
5588	2026-09-27_7bf0cb2a8863b7a17a069491cf8aa5b4_amadey_cloudeye_elex_hijackloader_smoke-loader.exe
5588	2026-09-27_7bf0cb2a8863b7a17a069491cf8aa5b4_amadey_cloudeye_elex_hijackloader_smoke-loader.exe
5588	2026-09-27_7bf0cb2a8863b7a17a069491cf8aa5b4_amadey_cloudeye_elex_hijackloader_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-27_7bf0cb2a8863b7a17a069491cf8aa5b4_amadey_cloudeye_elex_hijackloader_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-27_7bf0cb2a8863b7a17a069491cf8aa5b4_amadey_cloudeye_elex_hijackloader_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_7bf0cb2a8863b7a17a069491cf8aa5b4_amadey_cloudeye_elex_hijackloader_smoke-loader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\InstallOptions.dll
Size 25KB
SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
MD5 fd249bc508706f04a18e0bc0afddec82
SHA1 b94efda9f41c89fc6120ed385867125d03f28bea
SHA512 c820c06ad5ae21101602d9e7864fed9b470b25fa9a0ee025d05e72697d88c7e03cbee7ad476f4e3d5b6e467248b8ad1fefa2710c76011e2156b85068961404ba
SSDEEP 384:EAC43tPegZ3eBaRwCPOYY7nNYXCA/YosaNvDGFtart8E9VFK4ivDGb:EdTgZ3eBTCmrnNAEYDGFo+EAy
TLSH
T19BC28DA2A7C06CB3E9A35E3575E0AA179FB1F7126881CD93C33789005A417827EBC395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\UAC.dll
Size 28KB
SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
MD5 d23b256e9c12fe37d984bae5017c5f8c
SHA1 fd698b58a563816b2260bbc50d7f864b33523121
SHA512 13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
SSDEEP 384:2lqVibvTh4qnFP+OPEzinclP++vDGFtart8E9VFK4iBSaXrwz1k:EqVavVfPkzhlmIDGFo+EAzrn
TLSH
T13CD28EA657D0467BE9731D3131E56A125F7AB9311E7184BF0A37C6842AA0B83BD7C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

components.ini

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\components.ini
Size 630B
SHA256 1ed4533f2865f5d907567cee949cafe6b3387934cb435089630c4aca11d163d8
MD5 ba4d76435a5a2895eae79b85d8044772
SHA1 c5cd1235bd57bb41294a99dd8da6b82bf52c2594
SHA512 bfb92f0afcb61bcfdbc5bb6fe5f0d3af1233558d72aa3b44e4336c9d9fa508f296d944cb8fade5f8b164731e16dc70f874b765350b03e5418b885caf6b8c5884
TLSH
T191F06D132AFA1114E9FBBB46EAB441758B3B7846183DC50E95D0090E0CE568085BBBFB
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.ini

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\extensions.ini
Size 402B
SHA256 4e3f2413784c7e3666c667eb2c35084154536edf9335d96f24d18a1d17590066
MD5 2ed482117f3148d08f92e22bed69f5ed
SHA1 2ac31eb3b05d73d23bd946d6b7c9a7a461d1bdf4
SHA512 3b84ec3c4aa29e70b428535d9f34577d69d6373772d96ebae71b27a73cbe6d7a82de1163c71280e7b0ca906f4fc3b995f3626988776b6116a2d81a5e82153d93
TLSH
T10EE046072AF94018A59AF608EBF480B1D7387009180EC80ED0E14E0F8CE9681422BFDF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\ioSpecial.ini
Size 1KB
SHA256 8969889f6df892c973c1cdb44fff9d87ebed64489420866aa46dc1721469dbb0
MD5 1ba2dc837e6ffaa8f6e5e32eda838f21
SHA1 c266d56a4293b98bf96fdffb3e687f5e232c1e80
SHA512 5720a1070cb32ab3e8cbe452ced99dbca329ed083dc663a108c6e25f5edc0f98798c3722ad42fe5fd2b2d5d73314c0e2a0f7793e4eb1db9b98287ab0d759c871
TLSH
T150319A436AFD4514F2F7BF04EAB0513A8B3A7C559C3DC50E51D00A5E49F2A80C972BAB
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\modern-wizard.bmp
Size 150KB
SHA256 76da716588b8e51e36ee7a674cd873a8069e27fef73851d1e190face5a67fc66
MD5 49ff8ad8f51875597f3e919e8770c24c
SHA1 1e840ce0f68281e312317bcbdbc10fdfcd3959c3
SHA512 dcf29bbef46b1bd8d9f6c6221955ab06da23bc6661c603c188ce34fed80984a3b6d2006ab38b49aa9d1908d714cc0f40e63b6230244e4d4a0c9baebbbda1ddb1
SSDEEP 1536:KnltLBhSpBSMNmYkeEzAppt87b50m8lEamLwPbP81d4u9DOMkQTkWFdfCoUxZpg:mltLBWmreEcZOb50mKEaUwTM
TLSH
T177E396C549548EA91CAAEC8079BBA55B9F0C1EF8E270DAF1E7FFFD078551EB24016210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\options.ini
Size 1KB
SHA256 1825456240ef7acc3a29b3e96f4543cf2c1a862a97abf9291ed9ced77d69e248
MD5 21ff84168193f4f63e56efdcc3878ec8
SHA1 3efb4fd0b73b8e6b84c3e657acf118521d06556b
SHA512 68b91e8b029f63c1c755755d5a419b871eaf7b199817fce50490b223e5f82cb670d8037ae30a06586a943f9c649bb1b75bf3d30a8a40957a56ccbcaf03051da6
TLSH
T1F0216A136AF84215E4FBBA09EBF54131973A38055C3DC50E91E14D1E4DE5B80857BBEB
MD5 SHA1 SHA512 TLSH

Submit Download

shortcuts.ini

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\shortcuts.ini
Size 714B
SHA256 ba44c9c4a7afce69083ae742926a646c37b78ac0c20caf8a5eddbc609134388c
MD5 160dcf971655ed494ff4170deb2736f1
SHA1 cf31b59fda93d5183ecd61ca61bc097a4ef7a300
SHA512 8ba9e30359a0cc2b3d6377149355738e65a36b6f95f5b88b7d004c78d3d5494041ee2f3ae3a0299143c80fd00feb8f0b5ee3aa41f7476d7f33d223b8600f82d6
TLSH
T111013C432AF90054F4BBB61DEBF58076973AB405182EC91EC0E10A0E8DF56808927BDF
MD5 SHA1 SHA512 TLSH

Submit Download

summary.ini

Path C:\Users\Admin\AppData\Local\Temp\nsg6CAB.tmp\summary.ini
Size 44B
SHA256 775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4
MD5 c9b5d86a9a0f014293b24a0922837564
SHA1 3cc73b4a30a1a0bfdc6812bbd17994f53eb5db2a
SHA512 790f365afbe4c5a37dbb56443d38f0c439eadca002e4001d373d6db8c1d80c4adacf3749e9d210cd0316381682fbbc46616a3fa36581c7ea6f5ce69119944b62
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads