Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe
- Size 1000KB
- Sample260424-fd4wysft2t
- SHA256 f897737d210106420a123400413ff6381421d7074ec8c7d522ea694cd77f7cbd
- MD5 dfaef3e6370392c3c42310fc1caa27de
- SHA1 1394650e92c7ec9071d3b12ff02d568303540961
- SHA512 f6179980b21d95512831e2243d7d42c4a31676a5045c0565a2c3a7531d16a124925d230a73dfa112dac76d6c01a3cefc91b17c16d33cde063b27e8868081c6ee
- SSDEEP 24576:6j7nJ7S8Bx4tSVuUXG4fM+hGIHyR1fnkGoe:CnJyO7U+hfHSfkGoe
- TLSH T1752538027A9DBCE5E47545301B7687F25B2CFC211A90D58F73D07B2A69382D3B928B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fc.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\psr.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\dpnsvr.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\sfc.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\UserAccountControlSettings.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\migwiz\mighost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\agentactivationruntimestarter.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\diskpart.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\GamePanel.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\MDEServer.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\netiougc.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\RecoveryDrive.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\net1.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\user.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\BitLockerWizardElev.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\dstokenclean.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\WFS.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\cacls.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\cipher.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\recover.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\Register-CimProvider.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\smartscreen.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\UevAgentPolicyGenerator.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\DmNotificationBroker.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\WUDFCompanionHost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\sort.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\fontview.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\ipconfig.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\Dism.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\waitfor.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\raserver.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\gpresult.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\mavinject.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\rdpclip.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\sxstrace.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\oobe\msoobe.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\Speech_OneCore\common\SpeechModelDownload.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\ApproveChildRequest.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\dasHost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\phoneactivate.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\PkgMgr.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\dfrgui.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\services.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\BitLockerWizard.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\RuntimeBroker.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\tzsync.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\tzutil.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\UserAccountBroker.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\WPDShextAutoplay.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\chkdsk.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\netbtugc.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\System32\taskhostw.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\ScreenSketch.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_10.0.22000.1_none_a28a13c3c2bf1e9c\pipanel.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.434_none_eef51ebf13d8d8a1\CertEnrollCtrl.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.22000.282_none_345ca27cf9ce36c0\r\MusNotifyIcon.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.434_none_e6157b76b496d682\refsutil.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.22000.1_none_3fc7d56a6d567d99\DataExchangeHost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.22000.1_none_f56d8a8144f77003\SystemPropertiesRemote.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.22000.1_none_4aa1c639c898ed19\comrepl.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.493_none_7f8453c6e0afd8f5\f\nvspinfo.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\f\FsIso.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.22000.1_none_ba1c45853a21e276\IMTCLNWZ.EXE 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\r\userinit.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\r\SystemSettings.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\f\SyncAppvPublishingServer.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.434_none_eb6ed0d1cadda675\r\dcdiag.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.22000.1_none_f7ed7304d1a0058b\WMIC.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.22000.1_none_2fcf8aa3ca0a349d\esentutl.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.434_none_bb381a0becef4d51\f\certutil.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15806.0_none_8ce2f3fe679c53cd\RegSvcs.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\Setup.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.22000.1_none_140b0d3e9e73ad81\wslhost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.22000.176_none_161fead9a85c45cd\f\GenValObj.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiFileFetcher.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.22000.282_none_3c5af3814be830ab\r\klist.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_a2e87bc198c20e5a\wevtutil.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\r\AppVShNotify.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_datasvcutil_b77a5c561934e089_4.0.15806.0_none_5b1bda6d9e3a1e5c\DataSvcUtil.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchFilterHost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.22000.1_none_dae01b2e9419ebcf\DpiScaling.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.22000.1_none_6dc8af5cc18b0564\auditpol.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\f\VSSVC.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_4902a165a673e741\f\mstsc.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_4cf7a08cff0239cf\r\explorer.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.22000.1_none_35b3f196fa600d12\NETFXSBS10.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.434_none_f949c91148399a9c\CertEnrollCtrl.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.22000.1_none_f29fe3d9ca66cdd6\CloudNotifications.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpshare.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.22000.318_none_8b633995ac1a50de\dsamain.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.22000.282_none_345ca27cf9ce36c0\f\MusNotifyIcon.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.434_none_8c8f05900e25e4d3\f\net1.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\logman.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\r\fsutil.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\change.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_f6a11a34378fa70f\r\StartMenuExperienceHost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\r\wmpconfig.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\r\hvax64.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regini_31bf3856ad364e35_10.0.22000.1_none_6cee8466f2fab8e9\regini.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.22000.1_none_5e2e482310a0f2c5\rekeywiz.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-timeout_31bf3856ad364e35_10.0.22000.1_none_ecfcb4b8ff6e86b8\timeout.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_aa4efcf84be1b89b\r\CheckNetIsolation.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.22000.1_none_6c7a140d3670631f\winrshost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.22000.1_none_46b096804233c6b5\ThumbnailExtractionHost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\RdpSaUacHelper.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\f\ShellAppRuntime.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.22000.1_none_35e61c6caa531fd3\ReAgentc.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.22000.1_none_a9a94a82b8b61616\XblGameSaveTask.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.22000.1_none_12ea1a72b4886bec\ssh-keygen.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\r\audiodg.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.22000.132_none_23ef129810e14356\f\RecoveryDrive.exe 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4244 notepad.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2552 wrote to memory of 4244 2552 2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_dfaef3e6370392c3c42310fc1caa27de_amadey_cobalt-strike_hellokitty_hijackloader_luca-steale.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WEL273A.tmp2⤵
- Opens file in notepad (likely ransom note)
PID:4244
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\WEL273A.tmp
- Size 52B
- SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
- MD5 17ddbb82a40e2ac704e1045da8fb1cf6
- SHA1 a570cdbc16483567fe1439903b212e33b15343b7
- SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
- TLSH T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCE.exe
- Size 2.5MB
- SHA256 b22c01b66a70b49128db66978d717626d7359ec968c3e1da8855434df16ad117
- MD5 a91930f0788f353b08413c5c40dff2b8
- SHA1 e44e03e1119833ae389e25fbdea7a56cea532b3c
- SHA512 f13abd57779a61df95097d79824363b139769b03c29f54df1b05546b7cadb72b7102edae0b2978da85954798e61d1627c65415822378aaccf11f045f0c1c3fdc
- SSDEEP 24576:6j7nJ7S8Bx4tSVuUXG4fM+hGIHyR1fnkGokJ58z2QSCyXFxVKfCCPuiA3XHsN2:CnJyO7U+hfHSfkGou5c8XFxYB
- TLSH T11EC5F705ACECAC9DC1BB4176093A80ADEE395E67075090CFBDEC63231F311E2657BA65
- MD5 SHA1 SHA512 SSDEEP TLSH