Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
30/06/2026, 12:13
General
- Target 2026-06-29_1e5457b9b57e5eada591e1f83a1152c0_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
- Size 7.7MB
- Sample260630-pd7saaev6x
- SHA256 b8a81c9dbcafee3e1043b169033f91191bd4b7f6c5d03957b192141efb1b0449
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 24 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_1e5457b9b57e5eada591e1f83a1152c0_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_1e5457b9b57e5eada591e1f83a1152c0_amadey_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\PbsClientConnection\app-1.0.111\PBS.Client.Connection.exe"C:\Users\Admin\AppData\Local\PbsClientConnection\app-1.0.111\PBS.Client.Connection.exe" --squirrel-firstrun3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PBS.Client.Connection.exe
ControlzEx.dll
Csla.Xaml.dll
Csla.dll
MahApps.Metro.IconPacks.Core.dll
MahApps.Metro.IconPacks.Material.dll
MahApps.Metro.dll
Newtonsoft.Json.dll
NuGet.Squirrel.dll
PBS.Client.Connection.XmlSerializers.dll
PBS.Client.Connection.exe
PBS.Client.Connection.exe.config
Splat.dll
Squirrel.dll
System.Windows.Interactivity.dll
app.ico
PbsClientConnection-1.0.111-full.nupkg
RELEASES
Update.exe
memory/1196-180-0x0000000007F90000-0x0000000007FA8000-memory.dmp
memory/1196-166-0x0000000007ED0000-0x0000000007F62000-memory.dmp
memory/1196-125-0x00000000008C0000-0x00000000009A4000-memory.dmp
memory/1196-203-0x0000000073ED2000-0x0000000073ED3000-memory.dmp
memory/1196-132-0x0000000005560000-0x00000000055FC000-memory.dmp
memory/1196-202-0x0000000008A10000-0x0000000008A1E000-memory.dmp
memory/1196-136-0x0000000005720000-0x0000000005832000-memory.dmp
memory/1196-201-0x000000000B2F0000-0x000000000B32E000-memory.dmp
memory/1196-199-0x0000000008990000-0x0000000008998000-memory.dmp
memory/1196-200-0x00000000089A0000-0x00000000089A8000-memory.dmp
memory/1196-194-0x0000000008A30000-0x0000000008EE8000-memory.dmp
memory/1196-198-0x0000000007FE0000-0x0000000007FEC000-memory.dmp
memory/1196-144-0x0000000006500000-0x0000000006580000-memory.dmp
memory/1196-190-0x0000000008200000-0x0000000008266000-memory.dmp
memory/1196-189-0x0000000008000000-0x0000000008010000-memory.dmp
memory/1196-152-0x00000000064A0000-0x00000000064B2000-memory.dmp
memory/1196-148-0x00000000064C0000-0x0000000006500000-memory.dmp
memory/1196-185-0x0000000008150000-0x0000000008182000-memory.dmp
memory/1196-157-0x0000000006AA0000-0x0000000006B50000-memory.dmp
memory/1196-181-0x0000000008110000-0x000000000814C000-memory.dmp
memory/1196-161-0x0000000006B50000-0x0000000006BD4000-memory.dmp
memory/1196-164-0x0000000007110000-0x000000000763C000-memory.dmp
memory/1196-165-0x0000000073ED2000-0x0000000073ED3000-memory.dmp
memory/1196-173-0x0000000008040000-0x000000000810E000-memory.dmp
memory/1196-167-0x0000000007E50000-0x0000000007E70000-memory.dmp
memory/1196-172-0x0000000007E90000-0x0000000007EA2000-memory.dmp
memory/4108-98-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-113-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-176-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-15-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-13-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-12-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-36-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-57-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-97-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-11-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-102-0x000000001B2B0000-0x000000001B2D0000-memory.dmp
memory/4108-10-0x0000000000390000-0x0000000000566000-memory.dmp
memory/4108-17-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-9-0x00007FFDE6A4F000-0x00007FFDE6A50000-memory.dmp
memory/4108-137-0x000000001BB80000-0x000000001BB88000-memory.dmp
memory/4108-138-0x000000001F6A0000-0x000000001F6DE000-memory.dmp
memory/4108-139-0x000000001F670000-0x000000001F67E000-memory.dmp
memory/4108-140-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-105-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp
memory/4108-112-0x00007FFDE68C0000-0x00007FFDE7264000-memory.dmp