Overview

overview

7

Static

static

3

2026-11-01...er.exe

windows10-2004-x64

7

2026-11-01...er.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ol.dll

windows10-2004-x64

3

$PLUGINSDI...ol.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...eg.dll

windows10-2004-x64

3

$PLUGINSDI...eg.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ID.dll

windows10-2004-x64

3

$PLUGINSDI...ID.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rb.dll

windows10-2004-x64

3

$PLUGINSDI...rb.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ar.dll

windows10-2004-x64

3

$PLUGINSDI...ar.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...nk.dll

windows10-2004-x64

3

$PLUGINSDI...nk.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...lW.dll

windows10-2004-x64

3

$PLUGINSDI...lW.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 14:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_962b6fb7c6770aacdca629e5fa643e1a_amadey_cloudeye_elex_hijackloader_smoke-loader.exe
  • Size 1.0MB
  • Sample261102-rnbtpst1dw
  • SHA256 e44d67c364f04f8476f33bffcfe98b1c475fae2f767ba0f1a639e4e685e0b2a7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 23 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_962b6fb7c6770aacdca629e5fa643e1a_amadey_cloudeye_elex_hijackloader_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_962b6fb7c6770aacdca629e5fa643e1a_amadey_cloudeye_elex_hijackloader_smoke-loader.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Zen Twilight\AccessibleMarshal.dll"
      2⤵
        PID:1928

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          shortcuts_log.ini
          • Path C:\Program Files\Zen Twilight\uninstall\shortcuts_log.ini
          • Size 228B
          • SHA256 be962853ed555f34e4430308d57f7aea9dde4a183d6622a42c537bb19e27e64e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          shortcuts_log.ini
          • Path C:\Program Files\Zen Twilight\uninstall\shortcuts_log.ini
          • Size 310B
          • SHA256 407ef60c32c62fcfa48612889f7cb56d640935295836117bdda681524b06e17f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Twilight Private Browsing.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Twilight Private Browsing.lnk
          • Size 1KB
          • SHA256 ad60fb6d9dcbcef313e797360ecf70bdf51e238d43def5d269ef2f3dac6d9c0f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Twilight.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Twilight.lnk
          • Size 641B
          • SHA256 f24acad1644652f082fefa444d309d1a4ad3757c8981ce2828d8d1c046b5b046
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ~wilight Private Browsing.tmp
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\~wilight Private Browsing.tmp
          • Size 1KB
          • SHA256 0574da302658c6887386cbda88479d2be0b5fab6e7af20010b4e93e99c684743
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ~wilight.tmp
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\~wilight.tmp
          • Size 751B
          • SHA256 90879ecdd9e1e59734d44cc6fd3bba8cea13e2e84ccec25972be4bf0eaac5837
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AccessControl.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\AccessControl.dll
          • Size 21KB
          • SHA256 ef4b548b27a6edab3bcb25cff0598918c645795850d62f232909dee851e04c6d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ApplicationID.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\ApplicationID.dll
          • Size 55KB
          • SHA256 a9dad9fdaae93d10dc2ee346b231913445e731049554b8bb1506827e46f8a44e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CityHash.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\CityHash.dll
          • Size 53KB
          • SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InstallOptions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\InstallOptions.dll
          • Size 25KB
          • SHA256 c34f095e200db420ce9af5489c3e392be285e43c3f4c9fbe34686b1f0a1531ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ServicesHelper.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\ServicesHelper.dll
          • Size 14KB
          • SHA256 d6f6758adac2c073bec481e8de762af3a5574789bce3f43de02356afc9911e0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ShellLink.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\ShellLink.dll
          • Size 14KB
          • SHA256 5f6f414b412c72b10f49eb92af1d368ede531b58fb200d539fd2b45e371612db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\System.dll
          • Size 22KB
          • SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UAC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\UAC.dll
          • Size 28KB
          • SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UserInfo.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\UserInfo.dll
          • Size 14KB
          • SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          components.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\components.ini
          • Size 612B
          • SHA256 7e31dc152f5b42aa9bc43cdf68f972db6a59130a96bd666d1e35ca482ee880ab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          extensions.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\extensions.ini
          • Size 630B
          • SHA256 0723b5d0c55354754b2084b712854c39ca089b1d883de067ac3c20935808397d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ioSpecial.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\ioSpecial.ini
          • Size 1KB
          • SHA256 86aa25c9ad331a8d280c7c888467a0e5bfc4d53a14d5d55a4cda54e534ef38ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ioSpecial.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\ioSpecial.ini
          • Size 1KB
          • SHA256 342a785d526633575bd9b331fbdf272f3d14d5a3efc2be34a987b5fee39729ff
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ioSpecial.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\ioSpecial.ini
          • Size 1KB
          • SHA256 d4f3991e6091de01610cd9630390cea5bde4c41787c21ccf0fa12f43e5a1f675
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          liteFirewallW.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\liteFirewallW.dll
          • Size 92KB
          • SHA256 c0a12e651085aa2488796b474a5ca3bc70c22f1fd98ef854049b8d72987e478d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modern-header.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\modern-header.bmp
          • Size 25KB
          • SHA256 689ea80105f4e61ffc73062516c7d7053f92bae0c700c0673c3a9b445345df1d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\modern-wizard.bmp
          • Size 201KB
          • SHA256 ceebe912c8d99573fea1cd2ac5750fd12973a81f6ad7999c22f37439201e3d41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\nsExec.dll
          • Size 17KB
          • SHA256 7fb626aa05bee1095633a75aeb7895ebd816a98e0aa1581a0154e4c196de5391
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsJSON.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\nsJSON.dll
          • Size 33KB
          • SHA256 705f4947fb94254c4e5084e6a962045f6a4e790dfc1ecf59cd0fc3feb38bcbbf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          options.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\options.ini
          • Size 1KB
          • SHA256 344361d2263c3c354b867efbd1a6f47ade0c00979ca4f9086b928b2795b76685
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          options.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\options.ini
          • Size 1KB
          • SHA256 532b144eba0d5465d6d03aefd9307d7902730333d4768e3f75c99fdee3982633
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          options.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\options.ini
          • Size 1KB
          • SHA256 5e61ddd1b588fa2e6ab00566db43797391c64ddf5c3d352a4c7630b68dd72056
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          shortcuts.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\shortcuts.ini
          • Size 44B
          • SHA256 775c85f3552754ad3794b88c0cb6d6fc43d412cd9a87a4b9e847386a5bd0a9c4
          • MD5 SHA1 SHA512
          Submit Download

          shortcuts.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\shortcuts.ini
          • Size 690B
          • SHA256 11fdefced5ba37128d987844d27c605f02cc6bdd6a058792ef4b414252efefde
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          summary.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\summary.ini
          • Size 744B
          • SHA256 c22fdead722bea462c4cf98e224f3dd9692066df1e7bc8cc1a9267237e81be97
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          summary.ini
          • Path C:\Users\Admin\AppData\Local\Temp\nshEFDA.tmp\summary.ini
          • Size 824B
          • SHA256 92327b5b46986b6b3a9dfceb4d1d6d4a8820b4f3cdb325d156fa86bd186c1baa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Twilight.lnk
          • Path C:\Users\Public\Desktop\Twilight.lnk
          • Size 629B
          • SHA256 b655d519948b0305862e041ee8964dd9fd78646101bbd4b6b8b994efbd2209cd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ~wilight.tmp
          • Path C:\Users\Public\Desktop\~wilight.tmp
          • Size 739B
          • SHA256 2b92ab1ec174c125087980de14e0293eaf86b17b52486e1ff80064746d03bdde
          • MD5 SHA1 SHA512 TLSH
          Submit Download