Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/05/2026, 07:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe
- Size 940KB
- Sample260507-jreqrsdt2n
- SHA256 57ffff3298de52747defb1657f888778fcfed7c09f29fa63959c9d71d89637d5
- MD5 b6aa8219e4454b1dea2078b6d8466298
- SHA1 755b6d845c2bc7dcd7b8371566b347c42c19be01
- SHA512 70871d8c70cbdfaff78e1602366d63f6d05c43ee7cc1850f5c57150f2eb45cfbb4550bc581a1bdc0920683ead2a201a8e4a8ab762605218b0fdb015b43ed905c
- SSDEEP 12288:DG8LjBTqKObM/lj1FBghDXZEUAFQl7P7qZytzSKSU66b5zhVymA/XSRhf:DGw8KH/B1FBgDXZU/yhr5zhM1XS3f
- TLSH T1AD257C8571D4C1A0D425A13D6AF1AED596B1B88043717ECBFB947A992A337C1FC3B328
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4944 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.sho - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Shohdi.hdi 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created C:\Windows\SysWOW64\Shohdi.hdi 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Mozilla Firefox\firefox.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\uninstall\helper.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.sho 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4696 wrote to memory of 4944 4696 2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.shoC:\Users\Admin\AppData\Local\Temp\2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.sho2⤵
- Executes dropped EXE
PID:4944
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.sho
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-07_b6aa8219e4454b1dea2078b6d8466298_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.sho
- Size 335KB
- SHA256 482c4c1562490e164d5f17990253373691aa5eab55a81c7f890fe9583a9ea916
- MD5 40ac62c087648ccc2c58dae066d34c98
- SHA1 0e87efb6ddfe59e534ea9e829cad35be8563e5f7
- SHA512 0c1ff13ff88409d54fee2ceb07fe65135ce2a9aa6f8da51ac0158abb2cfbb3a898ef26f476931986f1367622f21a7c0b0e742d0f4de8be6e215596b0d88c518f
- SSDEEP 6144:EzU66bkWmchVySqkvAH3qo0wWJC6G/SMT4FWqC:MU66b5zhVymA/XSRh
- TLSH T134742C46E2B404D4D13AE13FA5969347F2B2BC144361ABCB1364E26D6F336C6A93F361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Shohdi.hdi
- Size 940KB
- SHA256 5e9c90f9c673371fcb8371ab00a23222f8bd1c004718be764fa95a2f8a1b0330
- MD5 06c877d051b615bde86b6248a775368b
- SHA1 0a6e4535db2f0906ceaed715d5f0a10359b7ef4a
- SHA512 a9141893344790d9774c7db07e1ba2bc56213175acdb82097b8267a4aed1637a203b5a9edd541ee6a6dce035fa283fe50b4bf49d6cec62d9f115f9b28541acb1
- SSDEEP 12288:pG8LjBTqKObM/lj1FBghDXZEUAFQl7P7qZytzSKSU66b5zhVymA/XSRhf:pGw8KH/B1FBgDXZU/yhr5zhM1XS3f
- TLSH T1F5257C8571D4C1A0D425A13D6AF1AED596B1B88443717ECBFB947A982A337C1FC3B328
- MD5 SHA1 SHA512 SSDEEP TLSH