51c1de924bbabcca14180ebb58967a7cde9c58ba14f4f22ea8648715780e04e9

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe
Size 20.0MB
Sample260810-c591hadf78
SHA256 51c1de924bbabcca14180ebb58967a7cde9c58ba14f4f22ea8648715780e04e9
MD5 4d9021e1a94fd6dd8fcd5e6f960d9ec6
SHA1 0362b8cde174761914ec02ffaf8d065e3c687914
SHA512 cb9c90219acad41539f68b6334367595f2d118bdc44c3459716c0b5052cd22e5231b19caa5d3a8e82a41e6ebc4bfbb5c4a5d42932e352ffbccc3e9cbc161c005
SSDEEP 98304:T7pW7pW7pW7ppA7pW7pW7pW7ppA7pW7pW7pW7ppA7pW7pW7pW7ppA7pW7pW7pW7z:wXXXXXXXZKWQc0gEYnvLl
TLSH
T1A5276B02B7E99074F6F31B309FB992758A7ABD629D35C60F63844A0D1D71A90E934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2712	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
1124	svchost_BBBCACBBABCACBAAACBCACABBCCCBCCBCABCBAABCABCBBCCBBACAAA.exe
4184	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCCCACABABCAABCCABBABBCABBBCCCBACBACCBBCCAACAABAAACCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe"	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAAACACBABBABBBCCCCCCCACBCACCBBBABABABBBAACCCCACAACACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCACBBABCACBAAACBCACABBCCCBCCBCABCBAABCABCBBCCBBACAAA.exe"	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5740	sc.exe
6064	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5684	cmd.exe
4168	cmd.exe
1396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCACBBABCACBAAACBCACABBCCCBCCBCABCBAABCABCBBCCBBACAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3400	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe
3400	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe
3400	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe
3400	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe
2712	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
2712	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
2712	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
2712	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe
Token: SeDebugPrivilege	2712	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 5684	3400	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe	94
PID 5684 wrote to memory of 4544	5684	cmd.exe	96
PID 2712 wrote to memory of 3784	2712	svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe	98
PID 3400 wrote to memory of 4168	3400	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe	102
PID 4168 wrote to memory of 5740	4168	cmd.exe	104
PID 3400 wrote to memory of 1396	3400	2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe	105
PID 1396 wrote to memory of 6064	1396	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_4d9021e1a94fd6dd8fcd5e6f960d9ec6_amadey_elex_hawkeye_hellokitty_hijackloader_icedid_luca-.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABBBCABABCACCABACACCCCCBABCBACACAAABCCBCCACBACBABBBCCCCABCBAAABCBCACCACACCACAACCCCCCACCCCBBCBACBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABBBCABABCACCABACACCCCCBABCBACACAAABCCBCCACBACBABBBCCCCABCBAAABCBCACCACACCACAACCCCCCACCCCBBCBACBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCBBCBCCCACCCABBBBBABABAACCCCBCACCCCACCBACAABABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe" start= auto displayName= "UserDataSvc_ABCCBBCBCCCACCCABBBBBABABAACCCCBCACCCCACCBACAABABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCBBCBCCCACCCABBBBBABABAACCCCBCACCCCACCBACAABABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe" start= auto displayName= "UserDataSvc_ABCCBBCBCCCACCCABBBBBABABAACCCCBCACCCCACCBACAABABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCBBCBCCCACCCABBBBBABABAACCCCBCACCCCACCBACAABABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCBBCBCCCACCCABBBBBABABAACCCCBCACCCCACCBACAABABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBBABCACBAAACBCACABBCCCBCCBCABCBAABCABCBBCCBBACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBBABCACBAAACBCACABBCCCBCCBCABCBAABCABCBBCCBBACAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
1⤵
- Executes dropped EXE
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PingSubmit.exe

Path C:\Users\Admin\Desktop\PingSubmit.exe
Size 40.5MB
SHA256 701f8b6f1140236f63407c979384933639583544cc31f3c6c7bea4db87868bad
MD5 c90da7621c262b0a616aff0d96b00e2f
SHA1 ec0cb13bb427e70e90d85091b415a33d8fd28d73
SHA512 99df30a5c2ff834e765c25500faec9f1d4f831a432a6c7824fb942999c4272d636f7e381f7c208bd57a3704dcf6f6fd9449d18ec2af3645513c51ad12b4b1765
SSDEEP 196608:wXXXXXXXZKWQc0gEYnvLSXXXXXXXZKWQc0gEYnvL2qs:dcZEIv3cZEIvc
TLSH
T10A976C02B7E99074F6F31B309FB992758A7ABD629D35C60F63844A0D1D71A90E934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75ea998248ab3283fc5294e7cb2a6f57a68974627541f94a43fb8538c9c160c7
MD5 814eb028fd0e421e79c559f177f12783
SHA1 2c42c26cb19005f07bc3f5f416f0bc19a8aabe44
SHA512 62299e402ea515b1c4eaafe018d638ed0fff40cfefc0ac2e00ec98dbf661ca0a2804dde67b96dc650b8069a8eaaf2bf3123daf9422e3c48674e5804f613b9fe1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74144bbf95f956d520aa2ed17039c1130d56e61e31ab861889da9cc961539da4
MD5 4ba8b711b8b1e173847efd72198387b6
SHA1 e89a59eda5e5f4abb6698dc227cdd749f123e934
SHA512 6ce559f92bfa130bcb76b4742a990f909f19bb7ec708a85c471068f57e7ab05e9eb824b7c08b2abb07492e572951d8479feaed1250b260cbdccf624a14ceae00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a2c34387f66ead384bfae35e6c790ec00e75522cd6a05e667de5e7a8c9aded93
MD5 17f8fd3dcbc540e1558d9ab65ddffede
SHA1 222f460e6d0628f3ce566c174d2e8d4c360f3d57
SHA512 78857ee28b5e8a2bba375d99d3b5b49fe4d2b1060e713a2fd4eba153114af7d9c3135533d97ce633bd7b90cc33bfa9df6e01984fc962431d05c782dd577e5cf8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 49a828566ab25fcf12259ce25447ca7a24ea6b0534cebd0ab1ab1972b2af0598
MD5 be9e8b5715123a1ffd11560fdca7abed
SHA1 cae0b6ab6c4f8ebf031fd590c788a5219d7aed25
SHA512 0167d4bee23d7a17bab3af8ad4cfcadd999cff4c2fb29ab0ee9d745d5be12f6cbd5ea541e32699dd3e399d9898b535a6baab50018670054a4ae0f9b8940ab25f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 05ce471994d4a7fffac7359481f106748c4001cf5c1a1bf6e606ea7f6b35c537
MD5 dfa2096281cd4bebedb6db35e5ea35c1
SHA1 810b2750f5b9a88f3eeeb17e0b3c1566242e7ff1
SHA512 5d62aaf272768851d9d47b3a02037d7caf8b97f43d532490fa499361ca36b766900cc0909e59fba897221eb07ce425f2ed151bc25342e9e6c42b4c1b19143b18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 089d820a51749a291215f2e4db434174c26021e80fc62b24e343808d2304f1ef
MD5 b5c7104a0474872725dc3db59a44b652
SHA1 c41faf7252d6fc0116d87556f2189cc57b733f97
SHA512 67ab2751aacf2b3254903c29323f42c627c94eaaa2cefe196edf47a121846b004dec78ec523284a5a362e7d5f688f3d0a0836c58a9e7db8350fe30e33bdafa15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5bbcfb001336e7b419b57454d05989c51a7617d102f77f5bfe31234700b10282
MD5 1b2ea59a2bf3ca36bc150b2dd43fdb20
SHA1 3bbafc97cb64831c01de22028ea3e7b4e72d2d6b
SHA512 706782fdb0ce8f557f30e5b72055d38ffb6dea569237d34f93f5c844cafb1f39d8b75b5883ddcfc9314bdf36d93291a687531a464266f4cd57c93d97836fd1e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 485800052dd4d7b66524f22d8ca024e39f1e52e2d30f8bd1556632cfa61acab1
MD5 0713d7f5fb355cbb9a663b831a666a65
SHA1 3bf7319d9291f7f4fc8cf111fb0a9f4d7cf25eb3
SHA512 7730848ead8445b9fb2b12908281de68d630d4601cd9d53974d19be31d7e30cd0cb9ff9345cc120bfd68ce4273f5b327c30a97dc49fb8902ce0e566a44329da0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e1d421e83028cc948e425598d9abd59715180ea7a8817a0d27d68a84c52f1259
MD5 7b7c3bf96f10c6a04998e73681d90689
SHA1 9c7e6f6d23d756b19a787c2a185b353d44fb5071
SHA512 d2402e53a8c3a4f5c4f79402c7015ad246bae624c4191a4233e8a2d934e99a230870f49eb306d3fd9003547c4e881cb15ffb099a3bda7b6a2de1f6b804d3d56d
MD5 SHA1 SHA512

Submit Download

svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCABBBACCBBBBCABAACBABBCCCABBAABCABABCAACAACBAACC.exe
Size 20.0MB
SHA256 51c1de924bbabcca14180ebb58967a7cde9c58ba14f4f22ea8648715780e04e9
MD5 4d9021e1a94fd6dd8fcd5e6f960d9ec6
SHA1 0362b8cde174761914ec02ffaf8d065e3c687914
SHA512 cb9c90219acad41539f68b6334367595f2d118bdc44c3459716c0b5052cd22e5231b19caa5d3a8e82a41e6ebc4bfbb5c4a5d42932e352ffbccc3e9cbc161c005
SSDEEP 98304:T7pW7pW7pW7ppA7pW7pW7pW7ppA7pW7pW7pW7ppA7pW7pW7pW7ppA7pW7pW7pW7z:wXXXXXXXZKWQc0gEYnvLl
TLSH
T1A5276B02B7E99074F6F31B309FB992758A7ABD629D35C60F63844A0D1D71A90E934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-97-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/2712-88-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/2712-111-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/2712-62-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/3400-89-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/3400-0-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/3400-30-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/3400-63-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/3400-16-0x0000000000650000-0x0000000000671000-memory.dmp

Download