Overview

overview

7

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

7

2026-08-10...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 01:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_f70392aef431b0364658f52c3a84e367_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
  • Size 18.4MB
  • Sample260810-b5b8ssgr4x
  • SHA256 8718f345973a79f5452c6931f9221ea0a62f7cc2d9bed169701c7b36166fce73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_f70392aef431b0364658f52c3a84e367_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_f70392aef431b0364658f52c3a84e367_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBACCAACBABBCABAABCCBBBABCBACBABBBBAAAABBBAABABCBBCBBAABBACABCBBABACBAACCABCCCBBCBBBACBCCCACBAABAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBACCAACBABBCABAABCCBBBABCBACBABBBBAAAABBBAABABCBBCBBAABBACABCBBABACBAACCABCCCBBCBBBACBCCCACBAABAACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3504
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCABBBCBAABBBCACACBBCBCCCAAACCBCBAABABCCCCAABCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe" start= auto displayName= "UserDataSvc_CCBCABBBCBAABBBCACACBBCBCCCAAACCBCBAABABCCCCAABCCAB"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CCBCABBBCBAABBBCACACBBCBCCCAAACCBCBAABABCCCCAABCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe" start= auto displayName= "UserDataSvc_CCBCABBBCBAABBBCACACBBCBCCCAAACCBCBAABABCCCCAABCCAB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2844
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCABBBCBAABBBCACACBBCBCCCAAACCBCBAABABCCCCAABCCAB"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_CCBCABBBCBAABBBCACACBBCBCCCAAACCBCBAABABCCCCAABCCAB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3704
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Windows\SysWOW64\notepad.exe
      "notepad.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Windows\SysWOW64\calc.exe
        calc.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:2228
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCAACCAAACACACBBACABCCBBCBACCABCAABCAACCCBCBABAABCACCBCCBCABAACBCBBBACBCBBAABCACAAACBAAABAACABABBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCCAAAACBBBBAABAABCACBBAACBAABBAAAAAACABBACBBACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1260
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCAACCAAACACACBBACABCCBBCBACCABCAABCAACCCBCBABAABCACCBCCBCABAACBCBBBACBCBBAABCACAAACBAAABAACABABBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCCAAAACBBBBAABAABCACBBAACBAABBAAAAAACABBACBBACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:660
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1000
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCCAAAACBBBBAABAABCACBBAACBAABBAAAAAACABBACBBACCBA.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCCAAAACBBBBAABAABCACBBAACBAABBAAAAAACABBACBBACCBA.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4396
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3924

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        2
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        qap`g`v~dtlq
        • Path C:\PerfLogs\qap`g`v~dtlq
        • Size 10B
        • SHA256 e9b91974516fb2397990b81bb49c40f3a3f22662694076b03e89967753b2d642
        • MD5 SHA1 SHA512
        Submit Download

        setup.exe
        • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
        • Size 18.9MB
        • SHA256 fe87b5d6a4e88d527ee173bcb7e4aca8cf698a6c87bffeaa23b90305f57609b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qap`g`v~dtlq
        • Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
        • Size 10B
        • SHA256 7a9cf2322fb8394fec85881760493d1ec60461432e4f0209ee37bb1f149f1e5e
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\ProgramData\Microsoft\WDF\qap`g`v~dtlq
        • Size 10B
        • SHA256 be0ff4bb57905ddb324850e3c399421fb88cc734a5b79f3d0ed7499cce8ba346
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
        • Size 10B
        • SHA256 6e57d57e470fefac635fcb5ea2d8b3ad1c9234f0d5df26a5980ae45f70c82cfd
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mi-NZ\qap`g`v~dtlq
        • Size 10B
        • SHA256 93c7cce44e1433a37fa3f8cacddd4b43bfec4fea3c4a3bb307409da8d2af84f9
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\SystemAppData\qap`g`v~dtlq
        • Size 10B
        • SHA256 9ee4ec48c22d3b2bfcbcb748d9f26b6b19ffb4713ebbb50eb42f51979b064af4
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\qap`g`v~dtlq
        • Size 10B
        • SHA256 2ef1905df7737422f17c134dc6406756ba04841ff4ebee43a53e2d15be385aae
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
        • Size 10B
        • SHA256 7fda9597e5d8869757fe381bd43d9fb73ab7fba4c3a17a82e40322ef0dea8917
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
        • Size 10B
        • SHA256 47537be73b872d98e7f595c7fb0e32b5a1a64d644a297eae4883018d66c5915f
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
        • Size 10B
        • SHA256 8ec6dd2dfb931d9711c676110c73952af78072a0fe3eb4b458db2ae7b3740ec1
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
        • Size 10B
        • SHA256 25617de26fa403ddc6ecb09b6750b913959817a56bcb82f3f26eea32f5edc184
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
        • Size 10B
        • SHA256 3b3ec3f5a0cf3bb7d1544c94d2bc082d9ff1373810383c65c7e261bf93332337
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
        • Size 10B
        • SHA256 2aa5e510fbbbc46fc7deb11784514da23d7a8e07f7cc85b403a3964a0e796e3c
        • MD5 SHA1 SHA512
        Submit Download

        qap`g`v~dtlq
        • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
        • Size 10B
        • SHA256 aefc4a8f2db6c473e35f6a47e70ad79a0fb7d95acb11f7d6a6212ffaeb895950
        • MD5 SHA1 SHA512
        Submit Download

        svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe
        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBCBBAACABABBCCACAAACCACACBCABAACCBBBCCBACAAACBCAC.exe
        • Size 18.4MB
        • SHA256 8718f345973a79f5452c6931f9221ea0a62f7cc2d9bed169701c7b36166fce73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        virus_log.txt
        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
        • Size 1KB
        • SHA256 8f3b2bbfe502590676b17f453d0ec2addedc7e7c282a2445d5edf678cefc46b9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        virus_log.txt
        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
        • Size 934B
        • SHA256 ae105a519c52e27fe4ea4ddf1c49f85da5f4e4bbc39b1f227cd0a27bef5475b2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        virus_log.txt
        • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
        • Size 1KB
        • SHA256 cc45ed383ef3d50ff3dc1c94b3221ba82c3be03db7e0b6bd9e809eef83c2ba6c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/460-6-0x0000000000220000-0x0000000000241000-memory.dmp
        Download

        memory/3924-83-0x0000000000DE0000-0x0000000000E01000-memory.dmp
        Download

        memory/4248-36-0x0000000000DE0000-0x0000000000E01000-memory.dmp
        Download

        memory/4364-59-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
        Download

        memory/4396-71-0x0000000000260000-0x0000000000281000-memory.dmp
        Download

        memory/4396-1377-0x0000000000260000-0x0000000000281000-memory.dmp
        Download