Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/04/2026, 02:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe
- Size 146KB
- Sample260418-df8a2sfv6t
- SHA256 741b55c8ee9fd62353647300aa50f6e10ca9589207cf9eb12f608ec97f4bdfe1
- MD5 c0edf17b199a72f6388b42f0fffa971e
- SHA1 2306694df313c0f2a018eb4ee707d549b2278d2d
- SHA512 9ced2183604f1854e815849749af7afb9f553530d473fbc87722152013f96e9d7cbba39fa25c4987501eab1cd8048ab491bbaf7c70c8a53c546a4982e945350b
- SSDEEP 3072:HCGZs3GM4xzExkMObe0DqjHYeb9nA9mgUlQl2IYmhnHYaLf/dlqxZvc:HfYGMs2hl7YedA9hgWsgYaLNlqxZvc
- TLSH T17EE37C11B1D1C471E57726310870EBB28ABDF8341B609EDF67D41ABE4F242C19A36E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\FXSSVC.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\wbem\scrcons.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\agentactivationruntimestarter.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\dfrgui.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\sdiagnhost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\cacls.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\CertEnrollCtrl.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\esentutl.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\ie4ushowIE.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\MicrosoftEdgeBCHost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\label.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\ARP.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\autochk.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\lpremove.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\SearchProtocolHost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\smss.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\whoami.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\unlodctr.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\convertvhd.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\gpresult.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\sxstrace.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\osk.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\xjumug.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\OpenSSH\scp.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\label.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\tcblaunch.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\timeout.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\TokenBrokerCookies.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\SystemPropertiesPerformance.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\calc.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\replace.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\xwizard.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\recover.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\backgroundTaskHost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\bdeunlock.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\lpkinstall.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\SndVol.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\UserAccountBroker.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\UsoClient.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\chkntfs.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\dispdiag.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Windows\System32\pfryrhqdg3nw6.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\sihost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\securekernel.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\sppsvc.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\wuapihost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\System32\Taskmgr.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Music.UI.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\javaws.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.22000.1_none_489d5b04a9243a58\charmap.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\Microsoft.Uev.SyncController.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\SyncAppvPublishingServer.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.22000.120_none_4a072e86b7c9806c\Microsoft.AsyncTextService.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_20c655d14680f9cf\f\SearchProtocolHost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.22000.1_none_dbea4e9985e12d2f\RdpSa.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\TextInputHost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.22000.348_none_e313cfb919daa6b1\securekernel.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.318_none_f32072a930d121b3\f\vmcompute.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_cbf7ec6fc0f80985\f\SndVol.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.22000.1_none_16b2561948e7dd92\ieinstal.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.22000.1_none_0f7f7612eae8630f\SecEdit.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.22000.1_none_724d8db15095b32c\SpeechUXWiz.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.22000.1_none_909c5510a5987a0e\colorcpl.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\AppVNice.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.120_none_68fb744ea962915c\r\conhost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.22000.1_none_e1b91bffeb2fd335\InetMgr6.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_4d19d7f0fee9ee87\r\explorer.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\f\audiodg.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.22000.120_none_fc8d986a0ba4c584\AppResolverUX.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.22000.1_none_872834aeb30e11cf\aitstatic.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.22000.1_none_861646fd953a616a\taskkill.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_ef0bb92fa937f7ee\r\RMActivate_isv.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\SearchFilterHost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\n\SenseCM.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15806.0_none_cd062650b14ec503\ServiceModelReg.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.22000.1_none_0af1ba5c97d13826\rpcinfo.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.22000.1_none_394d6561ecf74d41\mqsvc.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.22000.1_none_de173b06bfe08f32\InetMgr.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_c66bd96c36769493\f\wevtutil.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3a8cfd7d7fe46760_wowreg32.exe_94fc2d06 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.22000.1_none_70698255615a88a2\sdiagnhost.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.22000.469_none_403fa699a3654657\f\MDMAgent.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.22000.120_none_aad7a0687fb44b43\DeviceCensus.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.22000.1_none_59c3860dc8ae77d0\dpnsvr.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\cmimageworker.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\r\CapturePicker.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\relog.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.22000.318_none_2c6abfb5896ecf7f\wininit.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\r\rdpshell.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.22000.1_none_011628217859daa6\w3wp.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.22000.1_none_72d0f19d01454ec8\ieinstal.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.22000.1_none_afc79b3305c1207b\IMTCPROP.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.22000.71_none_eba5201bcfa1aa33\licensingdiag.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpshell.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.22000.1_none_434034434c78bcbd\dsacls.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_eb1a21d23daf2030\r\NcsiUwpApp.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.22000.1_none_3b4f9cda237a17ee\ChsIME.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.22000.1_none_08a07eacae7dfd9c\CasPol.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.22000.1_none_720e934c89d2ed1e\newdev.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.282_none_81f8a77609cf735a\f\MoUsoCoreWorker.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\f\Robocopy.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\WerFault.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.22000.120_none_a5bf55f88f23c8b5\f\FaceFodUninstaller.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\f\ScriptRunner.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_aa4efcf84be1b89b\f\CheckNetIsolation.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.22000.1_none_1b48dc6a75b19686\ComSvcConfig.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.22000.1_none_b98d3baff0bf243b\Register-CimProvider.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.22000.1_none_16e170d778007420\wmprph.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.22000.1_none_4374dc8b76e3bd2c\IMJPDCT.EXE 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.22000.1_none_b2bfe436fa0c3b50\CCG.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\tcblaunch.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_3353a48da9fe01a4\r\AssignedAccessLockApp.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.22000.1_none_6de3b97f02b362b7\aspnet_compiler.exe 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 752 notepad.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5020 wrote to memory of 752 5020 2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_c0edf17b199a72f6388b42f0fffa971e_amadey_cobalt-strike_darkgate_hellokitty_luca-stealer_njrat_satacom.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WEL3776.tmp2⤵
- Opens file in notepad (likely ransom note)
PID:752
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\WEL3776.tmp
- Size 15B
- SHA256 03ff882cef93571c7f0eca068d6191dace39a4754f46c53819bcd2defdb541e6
- MD5 2bd72479b05608de54b22871a29b6f40
- SHA1 c5eb8cd3ad9bac7d7a5d64ecd6eeae6ef74b911b
- SHA512 c36c5fda782f8f4df3d2d591a44a8286d3a6261082000439083e9c94c9db7f5acab0bce0283f62fca725e9b23130df471c8bf28310c1858e60bdffa66e0dd0bf
- MD5 SHA1 SHA512
- Path C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCE.exe
- Size 1.6MB
- SHA256 0c5518f068331b1a9822544103991a3b0bc9098ce33c76aaf3766e9c21f4f2c4
- MD5 a48d5f13bd5edcb745ce7d315c36bc57
- SHA1 e94ed8172f98fbbb7ecf35c8593f120825ef3c66
- SHA512 ff9704b58f3039d973c4dfb9725ccb73e84310447a0dcc1a1f99e275d39139e222bb2175211eba1e520daeec2b0e0f6679c9f5fa7bef239407cd77003eca4151
- SSDEEP 24576:mhCedosDtOJ58z2QSCyXFxVKfCCPuiA3XHsN2:JedFDtU5c8XFxYB
- TLSH T160859105ECE99C5DC2FB41BA4C2A806CFE39076B475590CABCAC43230F726F5497B9A5
- MD5 SHA1 SHA512 SSDEEP TLSH