Analysis
- max time kernel
112s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20251231-en - resource tags
arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system - submitted
19/01/2026, 00:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
Resource
win11-20251231-en
windows11-21h2-x64
29 signatures
150 seconds
General
- Target 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
- Size 256KB
- Sample260119-a63ayaby4f
- SHA256 e55056bfbfcc329ca02ed2d9231ce7552f7f5e95d99f98c8452b4069217c6ceb
- MD5 7b5438c4f65366c8ef457eef0b27a970
- SHA1 3b26745108896dc8f089be776f6bed4ebf5b9529
- SHA512 ebbf078f88203ddb9944a886206dd206349a034f4121e71c5a3929278d802c872c509c09899892687915714856d554d6a56ee5c5157d6f5a1a857377aa531304
- SSDEEP 6144:Q17+eW9Olanw/ZbCvVp64ZuVc3t/m+DmFIyQP3X0gh:Q89rwtCdVZz3c+Ddy6nFh
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\readme_for_unlock.txt
Ransom Note
- ATTENTION! Your network is hacked and files are encrypted. Including the encrypted data we also downloaded other confidential information: Data of your employees, customers, partners, as well as accounting and other internal documentation of your company. All data is stored until you will pay. After payment we will provide you the programs for decryption and we will delete your data. If you refuse to negotiate with us (for any reason) all your data will be put up for sale. What you will face if your data gets on the black market: 1) The personal information of your employees and customers may be used to obtain a loan or purchases in online stores. 2) You may be sued by clients of your company for leaking information that was confidential. 3) After other hackers obtain personal data about your employees, social engineering will be applied to your company and subsequent attacks will only intensify. 4) Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. 5) You will forever lose the reputation. 6) You will be subject to huge fines from the government. You can learn more about liability for data loss here: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://gdpr-info.eu/ Courts, fines and the inability to use important files will lead you to huge losses. The consequences of this will be irreversible for you. Contacting the police will not save you from these consequences, but will only make your situation worse. You can get out of this situation with minimal losses To do this you must strictly observe the following rules: DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files. Such actions may DAMAGE them and decryption will be impossible. DO NOT use any third party or public decryption software, it may also DAMAGE files. DO NOT Shutdown or Reboot the system this may DAMAGE files. DO NOT hire any third party negotiators (recovery/police, etc.) You need to contact us as soon as possible and start negotiations. Instructions for contacting our team: Download & Install TOR browser: https://torproject.org For contact us via LIVE CHAT open our >Website: http://nietk3nqpdtrzcm7pblreqtrqyxhud7qbmmdgn4ras2txibwgmmmz5qd.onion >Login: customer >Password: 5+x3ZIYfe329Qbf_plkL%?sEJxoQk& >Secret: e9chg%_JTRoMMHyWq-?r If Tor is restricted in your area, use VPN���������
URLs
-
https://gdpr-info.eu/
-
http://nietk3nqpdtrzcm7pblreqtrqyxhud7qbmmdgn4ras2txibwgmmmz5qd.onion
Signatures
- Cloak
Cloak is a ransomware that has been active since 2022.
- Cloak family
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (1971) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 7568 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1017923329-3442370593-12565554-1000\Control Panel\International\Geo\Nation Host Process for Windows Services - Deletes itself 1 IoCs
pid Process 7236 sichost.exe - Executes dropped EXE 4 IoCs
pid Process 7180 Host Process for Windows Services 7236 sichost.exe 644 A3R6C9.exe 4228 sichost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\ProgramData\\Host Process for Windows Services" Host Process for Windows Services - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Host Process for Windows Services - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Host Process for Windows Services File opened (read-only) \??\R: Host Process for Windows Services File opened (read-only) \??\S: Host Process for Windows Services File opened (read-only) \??\A: Host Process for Windows Services File opened (read-only) \??\V: Host Process for Windows Services File opened (read-only) \??\P: Host Process for Windows Services File opened (read-only) \??\T: Host Process for Windows Services File opened (read-only) \??\Q: Host Process for Windows Services File opened (read-only) \??\U: Host Process for Windows Services File opened (read-only) \??\Z: Host Process for Windows Services File opened (read-only) \??\G: Host Process for Windows Services File opened (read-only) \??\E: Host Process for Windows Services File opened (read-only) \??\I: Host Process for Windows Services File opened (read-only) \??\K: Host Process for Windows Services File opened (read-only) \??\W: Host Process for Windows Services File opened (read-only) \??\B: Host Process for Windows Services File opened (read-only) \??\Y: Host Process for Windows Services File opened (read-only) \??\J: Host Process for Windows Services File opened (read-only) \??\X: Host Process for Windows Services File opened (read-only) \??\M: Host Process for Windows Services File opened (read-only) \??\L: Host Process for Windows Services File opened (read-only) \??\O: Host Process for Windows Services File opened (read-only) \??\F: Host Process for Windows Services - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1017923329-3442370593-12565554-1000\Control Panel\Desktop\Wallpaper = "c:\\programdata\\wallpaper.bmp" Host Process for Windows Services -
resource yara_rule behavioral1/files/0x000d00000001e6b9-825.dat upx behavioral1/memory/7180-826-0x0000000000960000-0x0000000000997000-memory.dmp upx behavioral1/files/0x0011000000024175-835.dat upx behavioral1/memory/7236-836-0x0000000000F20000-0x0000000000F3F000-memory.dmp upx behavioral1/memory/7180-845-0x0000000000960000-0x0000000000997000-memory.dmp upx behavioral1/memory/7236-849-0x0000000000F20000-0x0000000000F3F000-memory.dmp upx behavioral1/memory/4228-865-0x0000000000950000-0x000000000096F000-memory.dmp upx behavioral1/memory/7180-3863-0x0000000000960000-0x0000000000997000-memory.dmp upx behavioral1/memory/7180-5369-0x0000000000960000-0x0000000000997000-memory.dmp upx behavioral1/memory/7180-5370-0x0000000000960000-0x0000000000997000-memory.dmp upx behavioral1/memory/7180-6786-0x0000000000960000-0x0000000000997000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui Host Process for Windows Services File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\7-Zip\Lang\fy.txt.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Java\jdk-1.8\README.html Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\7-Zip\Lang\de.txt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms Host Process for Windows Services File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\readme_for_unlock.txt Host Process for Windows Services File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\7-Zip\Lang\mn.txt Host Process for Windows Services File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\readme_for_unlock.txt Host Process for Windows Services File opened for modification C:\Program Files\Java\jre-1.8\lib\meta-index.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md Host Process for Windows Services File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui Host Process for Windows Services File opened for modification C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui Host Process for Windows Services File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.crYpt Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms Host Process for Windows Services File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.crYpt Host Process for Windows Services File created C:\Program Files\Common Files\System\ado\readme_for_unlock.txt Host Process for Windows Services - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language diskpart.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language diskpart.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Host Process for Windows Services Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sichost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language diskpart.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3R6C9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language diskpart.exe - Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\ConfigFlags vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_MSFT&PROD_VIRTUAL_DISK\2&1F4ADFFE&0&000003 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000003\FriendlyName vds.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 7816 vssadmin.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1017923329-3442370593-12565554-1000\Control Panel\Desktop\WallpaperStyle = "Center" Host Process for Windows Services Set value (str) \REGISTRY\USER\S-1-5-21-1017923329-3442370593-12565554-1000\Control Panel\Desktop\TileWallpaper = "0" Host Process for Windows Services - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services 7180 Host Process for Windows Services - Suspicious behavior: LoadsDriver 1 IoCs
pid 4 - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe Token: SeIncBasePriorityPrivilege 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe Token: SeManageVolumePrivilege 5100 vds.exe Token: SeManageVolumePrivilege 5100 vds.exe Token: SeIncBasePriorityPrivilege 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe Token: SeIncBasePriorityPrivilege 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe Token: SeIncBasePriorityPrivilege 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe Token: SeDebugPrivilege 7180 Host Process for Windows Services Token: SeBackupPrivilege 7852 vssvc.exe Token: SeRestorePrivilege 7852 vssvc.exe Token: SeAuditPrivilege 7852 vssvc.exe Token: SeIncBasePriorityPrivilege 644 A3R6C9.exe Token: SeIncBasePriorityPrivilege 644 A3R6C9.exe Token: SeIncBasePriorityPrivilege 644 A3R6C9.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5252 wrote to memory of 2448 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe 85 PID 5252 wrote to memory of 2068 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe 96 PID 5252 wrote to memory of 7180 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe 103 PID 5252 wrote to memory of 7236 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe 104 PID 5252 wrote to memory of 7252 5252 2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe 105 PID 7180 wrote to memory of 7444 7180 Host Process for Windows Services 109 PID 7180 wrote to memory of 7568 7180 Host Process for Windows Services 111 PID 7444 wrote to memory of 7816 7444 cmd.exe 114 PID 644 wrote to memory of 4228 644 A3R6C9.exe 122 PID 644 wrote to memory of 4212 644 A3R6C9.exe 123 - System policy modification 1 TTPs 16 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideFastUserSwitching = "1" Host Process for Windows Services Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SYSTEM Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoLogoff = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoClose = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" Host Process for Windows Services Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\EXPLORER Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableChangePassword = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\StartMenuLogOff = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableSwitchUser = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableSwitchUser = "1" Host Process for Windows Services Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableTaskMgr = "1" Host Process for Windows Services - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\diskpart.exediskpart /s C:\ProgramData\kD1aE.tmp2⤵
- System Location Discovery: System Language Discovery
PID:2448
-
-
C:\Windows\SysWOW64\diskpart.exediskpart /s C:\ProgramData\kD1aE.tmp2⤵
- System Location Discovery: System Language Discovery
PID:2068
-
-
C:\ProgramData\Host Process for Windows Services"C:\ProgramData\Host Process for Windows Services"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:7180 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet3⤵
- Suspicious use of WriteProcessMemory
PID:7444 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:7816
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:7568
-
-
-
C:\ProgramData\sichost.exeC:\ProgramData\sichost.exe C:\Users\Admin\AppData\Local\Temp\2026-01-19_7b5438c4f65366c8ef457eef0b27a970_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7236
-
-
C:\Windows\SysWOW64\diskpart.exediskpart /s C:\ProgramData\kD1aE.tmp2⤵
- System Location Discovery: System Language Discovery
PID:7252
-
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3140
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4696
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1192
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:7324
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7852
-
C:\ProgramData\A3R6C9.exeC:\ProgramData\A3R6C9.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644 -
C:\ProgramData\sichost.exeC:\ProgramData\sichost.exe C:\ProgramData\A3R6C9.exe2⤵
- Executes dropped EXE
PID:4228
-
-
C:\Windows\SysWOW64\diskpart.exediskpart /s C:\ProgramData\kD1aE.tmp2⤵
- System Location Discovery: System Language Discovery
PID:4212
-
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4364
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1900
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\readme_for_unlock.txt
- Size 2KB
- SHA256 2407f9f7af8d8b7da127ddaf61beb6057b0add8b3d45cfc1819a5441210f2cc9
- MD5 3fe973e26252e457f5e4d3914110d2ea
- SHA1 aca6d0ef3b0a776817bad61b6a45fb5743d9b23a
- SHA512 07b10322f0a3268db00bd42f54d96897d70b053967197ea996822a31f455b0b9ed30877bf9d3cf3686e51a26c56996d94ab1db205cb1c7001fb467ff9765d64c
- TLSH T1B151895FBB0A41162D4232D3753DA6917617A41C333F191B3CF6801C33699AF2B3B299
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\A3R6C9.exe
- Size 256KB
- SHA256 e55056bfbfcc329ca02ed2d9231ce7552f7f5e95d99f98c8452b4069217c6ceb
- MD5 7b5438c4f65366c8ef457eef0b27a970
- SHA1 3b26745108896dc8f089be776f6bed4ebf5b9529
- SHA512 ebbf078f88203ddb9944a886206dd206349a034f4121e71c5a3929278d802c872c509c09899892687915714856d554d6a56ee5c5157d6f5a1a857377aa531304
- SSDEEP 6144:Q17+eW9Olanw/ZbCvVp64ZuVc3t/m+DmFIyQP3X0gh:Q89rwtCdVZz3c+Ddy6nFh
- TLSH T14144D011B1C194BBD97219302660EEB2852DF9301B5468EFB7CE4F795F702E29239E63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Host Process for Windows Services
- Size 69KB
- SHA256 1748a26b0fedb7a35218d087d17d99c15c74517cf80d1798375b621559a0f2e2
- MD5 7c40a760e7b4b61ab1aa537f8d9c880f
- SHA1 c963bd5aa1fd6758083a67a529d0c98c11d5461b
- SHA512 fe88ca5b42d86a2fb87c9598c31975c74b4b6efdc193c709f46a524e64fc233c4c63bd90b312c36c8951a6f8fc8cd834ff6acccd4f34c9103071857f2c0b7362
- SSDEEP 1536:DkLPmz3hNW4fyN8o+6R8Idtf76R7W1F866YLo4nDc6GC2n0PSjnouy8:Yb8RNBfyN8/SfmoF8wL9GC9PSbout
- TLSH T1F56302DBF7D2985EC798873D21ED353D7C0017182AC148B6E67834AA9D637597E231C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Q9acAd3.vhd
- Size 16.0MB
- SHA256 c902ce599db4134b17ac52a817c04b5a60cc587f983b3517b97c58634c13cc18
- MD5 449a62bf153f4fb72e2ee7a86c774b45
- SHA1 efe19f472d460d7210e568e3443e164fd1f51855
- SHA512 c7198185e0f2bd2502cb3c24fc870fb621b8d421c5f00397f180b145035292ccb4900b17948cd5a166be39e5dc584bc9f22216ae050c20e87d44da485e820d18
- SSDEEP 24:cdmOETuYmjvKPSa3q5wEtGsx/Cz0hPXR9GiRMvYgqvq5wKaZH:cSiYgvKPSa3raj/tFhsYHrKax
- TLSH T15FF68622334C9B0CEDD6997141A7FD301B72782D9A34905772526B0C3B717147FA1F95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\kD1aE.tmp
- Size 34B
- SHA256 0977e976a701e82d9d4f1f1b1eaf8a495e1bd92cc33a86a398d0bd536d86a73a
- MD5 4eb9ba2b74923cfdd5bf1b7d361916c8
- SHA1 38bb5cd2e7c48a369d7e73852749bac403165519
- SHA512 be4227c1d478476813f164b8e5389d46be10877839530e85e0ab51f744f6006810823751e5ec08ad345298c966082f48a36f0aa6ba12d47522bde95176cf203d
- MD5 SHA1 SHA512
- Path C:\ProgramData\kD1aE.tmp
- Size 132B
- SHA256 82350eee2b0b078b4dd06fee1242d227cb9bc4a5a61d01ee42161d8c8e1efc80
- MD5 40525e4d5526164ffeeefb2e335c869e
- SHA1 855aea5785873f5b13605de8765d94edf62143f7
- SHA512 b5334c2d1f8713f4316673754f112ae59d2b8854aada64380888cb40323927862b753ba40691f0923c8e70c7b624cf3cd315be7e84bf8202c293f2f71c02afcf
- TLSH T193C0222EB3020B0CF002A0F08B3CAC0F8302E0C8228F800CC08002028008B388280383
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\sichost.exe
- Size 43KB
- SHA256 092d4fe86aec6c3a44499e7539e88e50a31b451250e53847d0ab23d116a7cd8e
- MD5 e6a8f3973380e37f13fc76a9d27e79ca
- SHA1 24bd0e0662f0dca89698c1323268f15d30d36d96
- SHA512 b5afbc690962fdfb9469a4bc96404e629c097b5bb60627f830e2a00879625e75590e3f3c2bbff7765d701d0d61481c49769c0d36fe74182027555444ae2f2534
- SSDEEP 768:PW1wBW6mR0DadKA0KKwFe2iVw0AYkGzeUlZ8Rv5mo7bsm2GhoINlFnbcuyD7U:PIwBjlaEA0zsKw0ADGzeUlZkMQ8GuINJ
- TLSH T14713F219A1DFE6F9C86800357C3AFF442871DA89ADA807DF8DD02573C7C17A8A761359
- MD5 SHA1 SHA512 SSDEEP TLSH