Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
- Size 18.0MB
- Sample260511-vfpmdafs2t
- SHA256 e5891d9b8974299f119c3fb5759384f9ad96a31508cd1bb34aeee7e51a259f35
- MD5 6bc4edfc1009885889caf08e26b2a661
- SHA1 3c3a6fcbcac014b1775dfb99f3b980b830046319
- SHA512 efc9fbb650fd114649631999beb24840a05eadc81b3a6c2c4a8b537fae9512f38ee840714135a1b32c818d9d6509a824b59f239b903df4a0dc8cb5c5e19cb944
- SSDEEP 393216:wZSIlwg2g6GEj7EhFjPK0Rti/48gmxlySngCbtuep:uStgqzEhNPfRsCCbtXp
- TLSH T1A917330166C4A0B7D172623182529606EF75BE630B2287DF728923AF2FB71C59E37771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msinfo32.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\clip.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tree.com- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cscript.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logagent.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\print.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tree.com 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\resmon.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\comp.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\comp.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\calc.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\DenyInvoke.bat 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_e4b70edd74d735f3\RMActivate_isv.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\r\RdpSaUacHelper.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\dtdump.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.22000.1_none_c5fd122e0036c04c\EdmGen.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-proquota_31bf3856ad364e35_10.0.22000.1_none_885f3fcfcb8efd54\proquota.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.22000.1_none_a1987ac693cecbd1\wbadmin.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_bb5cdd91d9f726ea\fsquirt.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.22000.1_none_d41670a1d239e747\dpapimig.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.22000.1_none_0a202c45353b204d\plasrv.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\MoNotificationUx.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.22000.282_none_31bc5b70e4490cff\f\vmms.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\quickassist.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.22000.348_none_571935de2408ae28\f\slui.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.318_none_95d72c738176ed2a\f\nltest.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.22000.1_none_04bf95b840a7a7c9\EdmGen.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15806.0_none_63e43513a2a96ff5\WsatConfig.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.22000.1_none_910b7a497567d369\SystemPropertiesComputerName.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3a8cfd7d7fe46760\f\wowreg32.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.493_none_2b6ddb5beae8ce90\f\hvix64.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.132_none_e66ce03b0132db6b\SysResetErr.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\r\MoNotificationUx.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.1_none_66a65c31902e1d37\WmiPrvSE.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.22000.1_none_e679ca0f4ee761e2\vmconnect.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sort_31bf3856ad364e35_10.0.22000.1_none_0c566b4b52acbfd1\sort.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_34cab29cacfab0ca\Pester.bat- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Boot\DVD\PCAT\etfsboot.com- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\r\splwow64.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.22000.1_none_2a83098f66602d2f\wsqmcons.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCE.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_0e8c117a0fb4af58\unregmp2.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\Microsoft.Uev.CscUnpinTool.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.22000.1_none_b5447a0b77a5213f\MdmDiagnosticsTool.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpshare.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseNdr.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.22000.1_none_65f380faa4e1a1c3\PhotoScreensaver.scr- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.22000.41_none_ea5a28018e2bb582\hvsirdpclient.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.318_none_b139c7be49b8cbb9\f\FsIso.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.22000.1_none_6c676f39acc16196\InspectVhdDialog.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.22000.1_none_54c6fd5d15027c02\regedit.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\r\AppVDllSurrogate.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.318_none_5cc755143bc62566\r\CustomInstallExec.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.22000.1_none_c29d51ccbc2353b7\CIDiag.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_10.0.22000.1_none_8c926432d7f125a8\baaupdate.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.318_none_15d95e5ea6111bc3\sppsvc.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_1c87d1fdc5c5037f\r\raserver.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.22000.1_none_2302091cdefe79c3\uwfmgr.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\MsSense.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_09c9ecffc9049dc0\PATHPING.EXE- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.22000.1_none_35e61c6caa531fd3\ReAgentc.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_72d931253b133480\f\msinfo32.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.22000.1_none_7710d645449f5d1b\edpnotify.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.22000.1_none_7aa2dd30d068973e\TsWpfWrp.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.3_31bf3856ad364e35_10.0.22000.1_none_1e1cb41b23f7b2cb\InspectVhdDialog6.3.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.22000.1_none_df03f8075654adaa\curl.exe- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\mode.com- 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_6bc4edfc1009885889caf08e26b2a661_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 18.5MB
- SHA256 c3b1fa8ee71dab02738d0d8a9ac3221f6e86874e2096d060f412f4fb14bdbb94
- MD5 f6a94a2da5b88ca2b596e87d3faf6b1f
- SHA1 708b81da01202d282696c8dfc8758de2a73395ea
- SHA512 538a7b3c8956162d3ae76047429903404b41655e0385c1bd91d79106633525a439e3ee38f162d53816302508941c8b0bc194d4c8f0289d354ebda7fc00e379c9
- SSDEEP 393216:wZSIlwg2g6GEj7EhFjPK0Rti/48gmxlySngCbtueW/:uStgqzEhNPfRsCCbtXW/
- TLSH T1C1172315B6E482B2D0739131C592964AEF3279520B3187CF3289977E2F772D68A3B731
- MD5 SHA1 SHA512 SSDEEP TLSH