ad297272111b46e5782fc85c13268f0b6000fbce6c8821133f231ddd48f15412

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
Size 267KB
Sample260721-sdadkabd28
SHA256 ad297272111b46e5782fc85c13268f0b6000fbce6c8821133f231ddd48f15412
MD5 92f4ff5e0580695e7ff2f25f42b9ba9b
SHA1 7f088e3504212b6f0610aa1fb62ce1c5cdd46559
SHA512 29898ded70f5c490fb3596ba1f3652bf44e2115e7c35325a559924b5aa150d811e6acb1e8769673154cddb64652cc3138f96c3b44db9695ebe1d906746be4555
SSDEEP 3072:QCSjGoLpWM6VsBEjxGZdwyUgc0FNYSIn5isiQwwJ/30FMgt3TfC0HsHvqRp9+xsY:mXqoE2nU90F6UsLJ/306Sj60Hv+KJai4
TLSH
T165445A2572CDB772D5F3483409ACF6B1AD3DBD310F2548DB73992B5E9A302C099396A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (254) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 2 IoCs

pid	Process
2084	Logo1_.exe
5816	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXF783.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXF782.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\RCX7A1.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXF6F2.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	Logo1_.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXF771.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXF7A3.tmp	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX529.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXF564.tmp	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe
File created	C:\Windows\uninstall\rundl132.exe	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3680	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe
2084	Logo1_.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 5312	2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe	86
PID 5312 wrote to memory of 4156	5312	net.exe	88
PID 2584 wrote to memory of 3680	2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe	89
PID 2584 wrote to memory of 2084	2584	2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe	90
PID 2084 wrote to memory of 5624	2084	Logo1_.exe	92
PID 5624 wrote to memory of 5648	5624	net.exe	94
PID 2084 wrote to memory of 6024	2084	Logo1_.exe	97
PID 6024 wrote to memory of 5272	6024	net.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a657B.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3680
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5648
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX98.tmp

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX98.tmp
Size 156KB
SHA256 85d1153885e798608e7be874dbf327886d29ef32b2b75ff000e113cbd6781c44
MD5 d608b6030ca18f668270642ddff5c3a0
SHA1 b4df50de5e23931446be15d1302dc0ed14c9c730
SHA512 259844347f10c3cdc6d4a8593aa0f0ffb402f0eea141ffd69a1a117d3c988bd31e389e69dc29e7124059e92f3ca9a05ecf0c1548ceae19ff477406127b9303a1
SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6fNz:hCSjGoLpWM6VsBEjx5ZdyZ
TLSH
T1BBF3B32EB18FB3F6D3E159BC8D1CF295ED28FE20CE19285B75993B0E9A760C35508191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe.Exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
Size 1.2MB
SHA256 9150219f0eace2ca8e21d8da4797a079c4c895fcda819c67038786346c933ec9
MD5 da32cc9ebcfbc79cfe266a23f9a1a5e9
SHA1 d50f82f3130ff344b02dcbbe22d5d7677e390d3a
SHA512 e31508cbd82c33a06998c6e83f2b01f8c8170e5a4e8e3acb9058259f21473046929175414bef0271774a0531900c6445810ef2e6739b5565db5c5291db963a13
SSDEEP 12288:X3Sgouvz0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+f:nSgouvz0ZRHkFfenxyQZXS7gZnQh2NIq
TLSH
T15155C40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX679.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX679.tmp
Size 103KB
SHA256 d2ce3e90885919f606f63d95271c3251720b3b0c9ca8a00e766f840fe23e4338
MD5 15e600768a9fba3a22680dac1b5175d5
SHA1 52fa7a4c5ed8e5c61182b30e714ee1559cd30f21
SHA512 53ff4187e57c895191e2f2ad6d7bbba0604feeb44e01b25dd0e7a669fa498c0f3a17d0c981425e92e02d72bc0a6caeb508afce89ef3a44bc52ee35c5a55dcb32
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHiaNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqju
TLSH
T1B4A36B59B68DB372D0E289BC8E0DF2E5BD387E300F1A185FB69E1F0D9A765C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6D9.tmp

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX6D9.tmp
Size 91KB
SHA256 98add0db7c43b0ba137127b6ddb34ac1b12ebf974253924384b6d33ed556634c
MD5 dc1ce8a8316720190aa0fb637a928347
SHA1 5ed751b59815bfe8e33dc4141e8a4a77599c030e
SHA512 70805d4c9326af7043d408677b6adeab63db4e376ae57dc7b0a9a22c7972909c2c9822c96baeb07e41bedff9d0aad78df1a7e0aadc48c83e5d73ee0532989a61
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6/NT:YCSjGoLpWM6VsBEjxZZdy5
TLSH
T1F9935C5AB28DB376D0F299B88E0DF2E5BD397E301E19185FB59E2F0DDA760C1190C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX518.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX518.tmp
Size 118KB
SHA256 44286cb468b055d4eee9c011b68e9505dde1f87baebb90d9d005e50238868538
MD5 d1bffd92a5cfd05e786a18ff42b399a1
SHA1 678cd6d85522988dab11c63a47b10b72fed2e59f
SHA512 9022d9001badc5c376bc766264aa6c838d9c4429191817937beccaa8a0e9002291663f5c71c93e31cfd0bf4bfa0332adb5cd4be01841cd53e333199caa46ea37
SSDEEP 1536:Y7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6x4GZjzQwK5WW7VCnE:JCSjGoLpWM6VsBEjxZZdQe5BV0IH
TLSH
T1EFC3AE59B68CF377C0E299B84E0DF2E5BD697E300E19085FB59A2F0DCA7B5C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX803.tmp

Path C:\Program Files (x86)\Mozilla Maintenance Service\RCX803.tmp
Size 100KB
SHA256 b58042eb545761dea7c1aeacd827b52ea63ea54d8e8aa91893435c0a26a828ab
MD5 ce767b17879b7df460f690d75e99e052
SHA1 627b0a9378a5f4fc39d6743301613e91a25be00a
SHA512 a28b1d9ffc6509620e93641ad76d89cd2ccd111be996d650d42a1a76607717950d3adf88b5f88d692b101f1693425e444eaf2640f7e35eb47d56fa198f6a590e
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3nNj:oCSjGoLpWM6VsBEjxQZdJUnJ
TLSH
T1E3A35C5AB68CB3B2D0F189B89D0DF3E5BD397E300E59185FB2AD3B1D9A77081190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe.Exe

Path C:\Program Files\7-Zip\7z.exe.Exe
Size 642KB
SHA256 8a70473e9cf2264d61cc00784a1ba1ba96b98a2b53925aa181a0136a988359aa
MD5 93de92e42045ebd05d22faefd0077aa0
SHA1 061fbac29ae8c936e9a013fa7a4f76d671920dc4
SHA512 53d949988b6184c9288ee89d2cb5a1fcc257ed1048dc8817481dece7bbeb75625d9fa2085b8de463d186c36545f10db44ce0918e6c752402b5099c46cf7614eb
SSDEEP 6144:mXqoE2gXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:dXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T120E40715F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286976C6E276E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF4A5.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXF4A5.tmp
Size 92KB
SHA256 565eadc3a40b709ed7ab2015ebf30ca8e899e36c60da5fc28bbe0c7e38580cdb
MD5 9df2adfeae2375417f9ac0000143f227
SHA1 a22d92f9772a1fcec920c36e9e0d0c9c9a9575dc
SHA512 36b680d68839a162c5649c09a3ec8cea916299def8e7e45f53d92349c085114e99151faef4f0881b83c073e60e24f0e5637710412f1afe7d0e975350e46c5689
SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t66NL:gCSjGoLpWM6VsBEjxeZdnx
TLSH
T1C6935B5AB29CB376D0F259B88E0DF2E5BD297E300E19185FB1AE3F1DDA761C1190C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF805.tmp

Path C:\Program Files\Mozilla Firefox\RCXF805.tmp
Size 91KB
SHA256 3568434773f17e9232d6736021d3fb73be45a6d566f1b618949150aa59eac2aa
MD5 c8737d20a3b1481127db89066598a373
SHA1 501c2272e969ffd0204284b842526b767304b2c8
SHA512 d34e65bcf6979e0aae5c907938d24f23f40453f2803637bddfa13811b837fd9e5033bb3f3ce4ed6ffad3b95caf2b24b449952c782dad711cdf041b440c49b604
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t6NNL:YCSjGoLpWM6VsBEjxmZdEx
TLSH
T1C7935C59B28CB376D0F259B88D0DF2E5BD297E300E1A185FB5EE2F0DDA7A1C11A0C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF848.tmp

Path C:\Program Files\VideoLAN\VLC\RCXF848.tmp
Size 92KB
SHA256 130118005bac068bedf5cc67869402ef667bb502140989e417390e0502a7c5df
MD5 2be34bf676c07dfbcebc8a2662687524
SHA1 dfeaec4d1d8c04e8d93d4e1ffdf432c2e17f6829
SHA512 3ff18540f377ad032455b6c0d55f495a9565b8b1e8129ae6362468584190e15ca1e065289f130aaed2c0b7cac8a3ed763d1167d035db48ff9ef153c788870e32
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6tND:YCSjGoLpWM6VsBEjx+ZdIp
TLSH
T165934C65B28CB376D0EE59BC8E0DF2E5BD297E300E19185B759E2F0DDA761C1190C18E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a657B.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a657B.bat
Size 932B
SHA256 826190d3fae78564f2b814ab001a1a9cb75544b43a1ef810b5f1f37f21c258b3
MD5 3f7239bc8993b14ebd1ceab1f21dc2ee
SHA1 973c8bfbd3bd355821969adced644325cb4a2bbd
SHA512 937f1eef44f919134fb842032f0caa80325f256832264658dde4f737042cd3973db6baee491343acf451ec389749fa3d5aaf55d9ca0697fa340f7a25264d9207
TLSH
T143113A125176E75A16CE700F02B22DCEC041EE6E2A81378113C4C6DD12E886DA5E23C1
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-21_92f4ff5e0580695e7ff2f25f42b9ba9b_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe.exe
Size 174KB
SHA256 c721f2d76b04ab76385bfc146e1342f0923b262cf7685c7cc950fd48f4c12e58
MD5 e94db89780c8153aaf422d34f74f7996
SHA1 74f9f37948a910ced91985bc51e0283178d8edd4
SHA512 b098da5ff6689553d281f8fa00588cda22540ea118039de1a6541297d3a16c21d1d70dea372c7f8fe35471cd58e7da6e7638a12b32657830c24401ac1d229c85
SSDEEP 3072:+Ugc0FNYSIn5isiQwwJ/30FMgt3TfC0HsHvqRp9+xsJP+FTiFe:+U90F6UsLJ/306Sj60Hv+KJai4
TLSH
T14C048D3176C084B2EAB3083119F8D6719A7DFD724F6049EF639457AA5E302C09A397B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 133494a8a5b91cd27720a6e25110c2eab9b3b6b92b8466efd6568eee4596f16d
MD5 4c05fbdb10622c6f60451970ec120e21
SHA1 64f4e3483ff5397a4f93dff32182acd580c097fb
SHA512 0a81ffe659d09306ec18e8020edc19dae5b757ae97c9b8161011bb5b0505b4aadae17638d7d284c81b89c50614001b08606fc570e09b50008d1ec37afdefbb9e
SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6VNh:QCSjGoLpWM6VsBEjxGZdwb
TLSH
T1D9934B5AB28DB376D0E289B88E0DF2E5BD397E301F19186FB59E3B0DDA761C1190C191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2084-768-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2084-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2084-13-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2084-1253-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2584-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2584-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5816-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5816-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download