Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/05/2026, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
- Size 157KB
- Sample260505-cfvvaaew6s
- SHA256 198063262645d57383ff8434b23f2b81b90d33dc19d1b477b5160c891e2e9c92
- MD5 2e0b486c862ba849336266aea2f07dda
- SHA1 8265de8b3b47dd9d325839e14d561b499dc25f2e
- SHA512 35c974e43bd8add6dcbacb98b3f496ceb6bfdf6ec11b1243bd88845755205b5b24465896d686efbcd7d2ad226ff293975424443a1c630602df39af6ff1e58821
- SSDEEP 3072:cAkZdGIlWoZ94UbBsysfzBSE5mOPjPagm8ztYZF:csIrBsy+UKPhEF
- TLSH T118F34B0179C2C072E4B219318AA49AE14F7DFC332A756EEFA794423A4EB41C05975FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX60DF.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5580.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX556F.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX61CE.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX611F.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX647F.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5748.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX5778.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX64CF.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX56AA.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX56BA.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX60FF.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX6140.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX618F.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX64BE.tmp 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_2e0b486c862ba849336266aea2f07dda_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
- Size 7.1MB
- SHA256 cbad21ff52322edcb21272fefaee1995fd2affb95d44c48b6b61d7987557f9cc
- MD5 20a7d3d68f814c086f4846896b42ea40
- SHA1 5e6aae20cad6a194a02a22baf417e0c0bec8b80e
- SHA512 5303c0ade86f0ab35d14de33c003aa405819a939d6743a674df5100cb2cc3633068eaaa9577308f9b1ea0ddd3bd8e0609cbc9eac4f7a07c934c06c7875b50669
- SSDEEP 98304:56CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frX:ECZetaEMGIG5xVqzRdDX
- TLSH T15A766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.2MB
- SHA256 06fcb1fe78720b5395900d4a01d6902c76988901c9ebe6dd47363c7b1639a6e8
- MD5 61c23d09f3bcd51aa331b6eea822c80e
- SHA1 5ed3b22750e313ad2b726726e5d77b616b887a28
- SHA512 f8aabe5192b4d63f7a8e0ecdbc54328ed1f0f5d7ebef7bbe2c9e1617f8ea29931c1508f2281f03087d9df0828246de83a7e671cb56efe41887d5bbca00405f9a
- SSDEEP 49152:9b+632BuPkFKRrdE6oh2stBhuXjfS4LWxnM:D3q6DjBf
- TLSH T131B56B03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e5854d2.tmp
- Size 1.4MB
- SHA256 d3b78e7ed236350a7647030fcb7dfcef8a154aa67363741b13f53268a23ae01c
- MD5 8a74abcf6ab1f04e308431cd87cf3e98
- SHA1 edbcdf9a1ef1def591b6b51749a277f18519cace
- SHA512 c64c45f4943d88aad4ee274c2b0ad76096a92a8ea184fbabad0de3e52c0c93a9ad3848a7ace398193a95937949220a30234c31e92bcabc1ad07d1b83a2dfc25d
- SSDEEP 24576:YZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:jY2fF8FhmS86IUJWQn+6h27d6
- TLSH T1AE657B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e5854d2.tmp
- Size 32KB
- SHA256 f56907dd0ef7ad9b83f17665d5463ae7633baeeeaea62644c237e9b5bc98aefe
- MD5 22afe71747d5a3a7aae0eafed6d68420
- SHA1 5aa14cb5248ac801f35062f1157891dbf4ab6636
- SHA512 7d81bab148e1fc3bef0c4a344cb6736156feeb15d6e123b2c05b8ca8882319aebc262e68615c296b5e839d3efaf97d07262f1e0146859ba5b183a7ac1b9815d0
- SSDEEP 384:Wn9xD0sO20SeBcV5fxZ2/AGbzx4fbIot3qnd9ZOxaefMlN+DW6ps:WnLv0SpxeAidabHtydtZlNoS
- TLSH T156E2080EAC4BA613F4118D71D7D1A5E99FFE9C2739DB703FEF404A0169E1048849AEB6
- MD5 SHA1 SHA512 SSDEEP TLSH