878e77316ea676913e9e7293cddd0542a24dbd5306376cfaae56e8d325b81bd0

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop.exe
Size 797KB
Sample261023-x9rpyade27
SHA256 878e77316ea676913e9e7293cddd0542a24dbd5306376cfaae56e8d325b81bd0
MD5 d173d0b880346867f07e773172bac9fa
SHA1 e0a0d17cfe25198366cc5a85f24c7f2a2a8f87da
SHA512 a60f82a770afefad4354685e19e051bc83b5e39127140841ffaff3832272e15c5b16d83151cbc4b52ca9334132f9dd56a04d30d10341c4f32e32f3561015d2dd
SSDEEP 12288:o6/QmQbHLnEiDwmAjtGs2YezJsdjkwy64sxxCvPvIoM/qc9T0E8YO:TQmQPAjtGvV4py+CvooM/79TN8F
TLSH
T1E2054A21FA83803AEDB3147D4C7D826A5465BD321B74C8C7B3C42E6E19F95D26A3172B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4412	2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop.exe
4412	2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop.ini

Path C:\Users\Admin\AppData\Local\Temp\2026-10-22_d173d0b880346867f07e773172bac9fa_amadey_elex_icedid_smoke-loader_stop.ini
Size 79B
SHA256 1d3d4e5a170bd23f07e5a04602c7511b293ea831e9432af7521f0ef56dffa189
MD5 1398e98302e08dc3d061fa3de2743c25
SHA1 ec0fa81812018aeff8082cbe5d26733061ac452a
SHA512 0f206724d3fc5bfbd3891da1d554d7c9b6af57a0275216f63e158d9a6418c3b6e3c7c4667b9d37de96c4f60be627150b629d22da105a3fee3e77bec4adaf31db
TLSH
T1DCA0110022028AAB002F02020EA32288A8AB8C2002BA00008020008F0EAF0A0EB8E00C
MD5 SHA1 SHA512 TLSH

Submit Download