Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/04/2026, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe
- Size 146KB
- Sample260418-ddvxyaft8y
- SHA256 ad90be59109d9121a8578e0ba327d604d0c207fae8064ff42e83adea05c14854
- MD5 a7343f2c8f4fba492d8c995371958cba
- SHA1 f4fcb462bb77692cea2922e1d6c5985829ef4764
- SHA512 0dd31a3f7b5e0bf873096f5a4250240f346fa8d973ef9aba288aff0dc3ddd0f75e831eb8a05fe7d31488f705694e7769b7a93d0f08af15a999b28150e5738161
- SSDEEP 3072:HCGZs3GM4xzExkMObe0DqjHYeb9nA9mgUlQl2IYmhnHYaLf/dlqxZvc:HfYGMs2hl7YedA9hgWsgYaLNlqxZvc
- TLSH T1D8E37C11B1C1C471E57726310870EBB28ABDF8340B609EDF67D41ABE4F242C19A36E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\GamePanel.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\baaupdate.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\fontview.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\icacls.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\WinBioPlugIns\FaceFodUninstaller.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\OpenWith.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\timeout.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\wsqmcons.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\ApplicationFrameHost.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\dfrgui.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\runas.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\SystemResetPlatform\SystemResetPlatform.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\dllhst3g.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\NDKPing.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\PasswordOnWakeSettingFlyout.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\WinRTNetMUAHostServer.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\wscript.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\vssadmin.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\at.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\CIDiag.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\TSTheme.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\DmNotificationBroker.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\sfc.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\Windows.Media.BackgroundPlayback.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\wlanext.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\ARP.EXE 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\PnPUnattend.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\tzutil.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\cliconfg.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\netbtugc.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\EduPrintProv.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\MBR2GPT.EXE 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\BitLockerDeviceEncryption.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\cipher.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\subst.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\appidtel.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\hvix64.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\rasdial.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\grpconv.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\plasrv.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\pwlauncher.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\spaceman.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\typeperf.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\migwiz\mighost.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\cacls.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Music.UI.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.22000.1_none_a115457b00f4576d\iediagcmd.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.282_none_fbdbe8fb711d9878\r\vfpctrl.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.22000.1_none_7317f7d3d7e53645\adamuninstall.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.22000.282_none_305eac6918e57702\f\rdpsign.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.22000.1_none_b3ddf74ed4239427\RegAsm.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.22000.434_none_17cb2e5ad35a58c9\ksetup.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.22000.1_none_32a80b6fd3f4f093\spaceutil.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.22000.120_none_05dfd9bc9f8bc6b6\f\Win32WebViewHost.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\r\TokenBrokerCookies.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.434_none_2ca09768f8a7e2e6\DiagnosticsHub.StandardCollector.Service.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.22000.318_none_7f5bff6941991869\r\vmsp.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.22000.1_none_934ce708df2406c6\icacls.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_bdd6ed7a5949f71c\FilePicker.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.22000.1_none_5a923992d494427e\dplaysvr.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15806.0_none_76ec1420387eb344\csc.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.22000.1_none_22b90aadc55bb953\dw20.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-upprinterinstaller_31bf3856ad364e35_10.0.22000.1_none_094f49d32c4abf9f\UPPrinterInstaller.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\f\mighost.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systray_31bf3856ad364e35_10.0.22000.1_none_53e9c4cb2f33e8c8\systray.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\tracerpt.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.22000.65_none_cf76e66c2463ea3d\convertvhd.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_0483b4854ca89ef9\TiFileFetcher.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.65_none_cc4646d618bda56e\r\SystemSettingsBroker.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.22000.1_none_0784f33527b40118\EduPrintProv.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.22000.1_none_fcd54e761151a365\PnPUnattend.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\r\audiodg.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchProtocolHost.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.318_none_67a8688739413b45\f\ntoskrnl.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.22000.1_none_e001e2e2fc49e1bc\ImeBroker.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fontview_31bf3856ad364e35_10.0.22000.1_none_a4fc5537efa0db6f\fontview.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_cbf7ec6fc0f80985\f\SndVol.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_0f97a0bb2461b363\unsecapp.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.22000.1_none_58ed24a5c85940dc\sapisvr.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.22000.1_none_63c1e7db07fabcb1\msoobe.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.22000.1_none_c29d51ccbc2353b7\CIDiag.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.22000.1_none_38378aefc68a365f\autochk.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15806.256_none_140bb56751c31463\ngentask.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.282_none_fbdbe8fb711d9878\f\vfpctrl.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.22000.1_none_2fcf8aa3ca0a349d\esentutl.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\r\WUDFCompanionHost.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_2a48e0773b83147e\f\appidtel.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_b4bd4664802eaae9\r\CheckNetIsolation.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.22000.1_none_3bc1e2973d0f3919\extrac32.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.22000.120_none_3fbde764cc71982b\ShellLauncherConfig.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\ScriptRunner.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.434_none_bb381a0becef4d51\f\certutil.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\rwinsta.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\r\wmpshare.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.493_none_fb990c63ce4d223c\tcblaunch.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\f\fsutil.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_0f97a0bb2461b363\mofcomp.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.22000.1_none_10af78bda18479ba\verifiergui.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.22000.1_none_c7367df86de3dff1\backgroundTaskHost.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\AppVShNotify.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\f\TokenBrokerCookies.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\f\cscript.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.22000.1_none_5131b7cb34740693\LinqWebConfig.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\r\wuauclt.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.22000.1_none_ae92c24e0a04e0bb\cacls.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.22000.282_none_30a5190270148358\r\directxdatabaseupdater.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.22000.282_none_3066e216e524ffb4\vmwp.exe 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.348_none_a52aaf9adfbcd9fc_fontdrvhost.exe_94bdc76d 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2888 notepad.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4052 wrote to memory of 2888 4052 2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_a7343f2c8f4fba492d8c995371958cba_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WELEC83.tmp2⤵
- Opens file in notepad (likely ransom note)
PID:2888
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\WELEC83.tmp
- Size 15B
- SHA256 03ff882cef93571c7f0eca068d6191dace39a4754f46c53819bcd2defdb541e6
- MD5 2bd72479b05608de54b22871a29b6f40
- SHA1 c5eb8cd3ad9bac7d7a5d64ecd6eeae6ef74b911b
- SHA512 c36c5fda782f8f4df3d2d591a44a8286d3a6261082000439083e9c94c9db7f5acab0bce0283f62fca725e9b23130df471c8bf28310c1858e60bdffa66e0dd0bf
- MD5 SHA1 SHA512
- Path C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCE.exe
- Size 1.6MB
- SHA256 8e532f40c3305438eb7a12a50e4af6acda987a422908d513cabc75d4b9960e95
- MD5 727a1d3329bf8187aaa4aa70fbd416f2
- SHA1 027a297bc5a6b68a813fcbe0be70e15590e5d832
- SHA512 bed22e276f8797d98337b217cc2f49a04bd88f52346e9fd4d56dbc463224e849c5133c95aa68c27de19ccbd9a00420fe2b551691d8187ef8b0ae351608a1477f
- SSDEEP 24576:mhCedosDtOJ58z2QSCyXFxVKfCCPuiA3XHsN2:JedFDtU5c8XFxYB
- TLSH T1FA859105ECE99C5DC2FB41BA4C2A806CFE39076B475590CABCAC43230F726F5497B9A5
- MD5 SHA1 SHA512 SSDEEP TLSH