50d1d73dcd1835afbc842054e8035a127822a17833d9ae2fe307e2c2ca93f131

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe
Size 22.5MB
Sample260810-c7pscahp7w
SHA256 50d1d73dcd1835afbc842054e8035a127822a17833d9ae2fe307e2c2ca93f131
MD5 467297a8617fb983ae59570eafb6c6dd
SHA1 945a069993f0d8fab5a72c8b074969d76cee5a3d
SHA512 dcf3e2c6db2d55d95feaa53e4ed1a9938bd9812d73fb317bd8ab124a516a6c18c69831df1668b3e4d7f9688fd1dcd2854689e0c2a4b21edfbb14bb9da9113a70
SSDEEP 98304:T7pW7pW7pW7p97pW7pW7pW7p97pW7pW7pW7p97pW7pW7pW7p97pW7pW7pW7p97pl:EKWQc0gEYnvLp
TLSH
T1F0375A01B7F99431F2F31B31AEB592654A7ABD729D38C60E63D80A0E1D71A80D935B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3968	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
4864	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
3380	svchost_ACBCAAABCCBCCBCABCAAACBABCCABBABCBAACCBBCCCCCBCBBBABCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCBAABABCBBACACBBAACBABBBCABCBABBACACACBAAABCBABBCBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe"	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBBABBACCCACAABCBCCCACAACBAAAACCCACCABAABABAACABCBBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCAAABCCBCCBCABCAAACBABCCABBABCBAACCBBCCCCCBCBBBABCBB.exe"	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4624	sc.exe
936	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2872	cmd.exe
1348	cmd.exe
5776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCAAABCCBCCBCABCAAACBABCCABBABCBAACCBBCCCCCBCBBBABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1428	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe
1428	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe
1428	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe
1428	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe
3968	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
3968	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
3968	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
3968	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
3380	svchost_ACBCAAABCCBCCBCABCAAACBABCCABBABCBAACCBBCCCCCBCBBBABCBB.exe
3380	svchost_ACBCAAABCCBCCBCABCAAACBABCCABBABCBAACCBBCCCCCBCBBBABCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	3968	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
Token: SeDebugPrivilege	3380	svchost_ACBCAAABCCBCCBCABCAAACBABCCABBABCBAACCBBCCCCCBCBBBABCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2872	1428	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe	92
PID 2872 wrote to memory of 6000	2872	cmd.exe	94
PID 1428 wrote to memory of 1348	1428	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe	95
PID 1348 wrote to memory of 4624	1348	cmd.exe	97
PID 3968 wrote to memory of 2088	3968	svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe	98
PID 1428 wrote to memory of 5776	1428	2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe	99
PID 5776 wrote to memory of 936	5776	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_467297a8617fb983ae59570eafb6c6dd_amadey_elex_hawkeye_hellokitty_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAABBACACCAACAAACABBACABACAACACABAACBABBBAAAACCBCBACCBCCBCACAAACCACAACABCCAACBAABAACAACACBBBABBACBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAABBACACCAACAAACABBACABACAACACABAACBABBBAAAACCBCBACCBCCBCACAAACCACAACABCCAACBAABAACAACACBBBABBACBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACBCBAABACBBAABCCABBACBAABCBBCBBCBBACACBCBCCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe" start= auto displayName= "UserDataSvc_BBCACBCBAABACBBAABCCABBACBAABCBBCBBCBBACACBCBCCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCACBCBAABACBBAABCCABBACBAABCBBCBBCBBACACBCBCCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe" start= auto displayName= "UserDataSvc_BBCACBCBAABACBBAABCCABBACBAABCBBCBBCBBACACBCBCCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACBCBAABACBBAABCCABBACBAABCBBCBBCBBACACBCBCCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCACBCBAABACBBAABCCABBACBAABCBBCBBCBBACACBCBCCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
1⤵
- Executes dropped EXE
PID:4864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAABCCBCCBCABCAAACBABCCABBABCBAACCBBCCCCCBCBBBABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAABCCBCCBCABCAAACBABCCABBABCBAACCBBCCCCCBCBBBABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0384130757f9213a05e7e82127f63411cceed9684369fa7e28700a6d9c288620
MD5 f7ecb78c7784c11aac989e5ba417d18a
SHA1 26334a0253237df19e1113225f357ea90add4906
SHA512 7143b76c016b0264af21c3cbf79b26eb119064b6dc3109dbf699f1ed563a6879a771ff52d048b0e3e551e6c5af6b023ba54fec9a91660998ffdcb341cd575994
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27bfa081f87ff10d8fdcacb26c9ce1387e999f33e80326686027d2169305f65b
MD5 d499c7a229650df0a08ee5968be14080
SHA1 45f8fd0f7e2c08364a100fed234609cf8d3c4e1b
SHA512 7f54b9b68fbb42744478ea8d5bafa477fe7fd97a1fad66235777b3616b86004da888b7d5209b1430a57ed6e9b2ebf23c4a811dfe0c4f693849230c33b2f4f698
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e9d124edd0354809cd7cf7a54236c27e36a44e7d3a301ef4b1fac40ed9b4a618
MD5 2c9ac2f2c71c3c4bb888560b8962e20f
SHA1 5041c7765c75742d078cbaf97a1580fb25d39252
SHA512 94e5d40b7e33c5d758b8ce0529e38ccc3314fa4158e7915a2890d7dc5d88258e56fb6e7dd2367c22bf3d8389d820367eda9969d4df156d62773c2a1b24eaea08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 539098d4535af32cbe187b7ce45220db8065a3539af71bdebba32dc0436a4f71
MD5 1412d828cc7d5f5ed4c615d6f9b57a29
SHA1 f5077e5e4f2c557fc662924620679fcde29804b4
SHA512 1e285105594c1b9415fa2b35e4bbd8a0e54e2347d62dece0b90be7970aa070f0b66479aa8119c9cdb1b80a8be05fec5339680934f8e01343a7ba572439d21edd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c0d8362f3ee084a2abff5f31c40a9873f951deb49b4fc63c5c4e015a517255c
MD5 b5478a201856c643a8dd92dc363abe8b
SHA1 c4424eaea85b6148872d56e263bd5b132f063696
SHA512 274a2874e14308940839b0c3c0852343f643ee8c359778ded7bc6410232fb0b11e4b99a6592af0b8efe3b79189140f588e3e8b281b60deaa4aeb595588cf05ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 460bb94eebcfafed016387e5c2531a2de11b1f77592f5c4297a12211da314ac1
MD5 ae7a9be038c9eb7da55f8392072b0958
SHA1 af806d1a7cb2229d4daa677637ef22e0c70c8862
SHA512 f40dd4a9673b7d00743250f8f89c90d4d995d3b151d8eb042774642c1a9086aeafd2a922591d81880c7830a09575e663feb2578afb88f837a3cf4b86ddb2ddde
MD5 SHA1 SHA512

Submit Download

svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCAACCCABBCACBAAAACABACAAABCBBBBACACBCABCACBBACACCA.exe
Size 22.5MB
SHA256 50d1d73dcd1835afbc842054e8035a127822a17833d9ae2fe307e2c2ca93f131
MD5 467297a8617fb983ae59570eafb6c6dd
SHA1 945a069993f0d8fab5a72c8b074969d76cee5a3d
SHA512 dcf3e2c6db2d55d95feaa53e4ed1a9938bd9812d73fb317bd8ab124a516a6c18c69831df1668b3e4d7f9688fd1dcd2854689e0c2a4b21edfbb14bb9da9113a70
SSDEEP 98304:T7pW7pW7pW7p97pW7pW7pW7p97pW7pW7pW7p97pW7pW7pW7p97pW7pW7pW7p97pl:EKWQc0gEYnvLp
TLSH
T1F0375A01B7F99431F2F31B31AEB592654A7ABD729D38C60E63D80A0E1D71A80D935B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2fa366e3bfc4731d24965447a6bea6dcb8140d9abfe5c363784368c29015d56c
MD5 7cde707dcdc33c23f261f2aed6dab1a5
SHA1 1b5eefb66c7a61c58a51ab903496b43d731b5591
SHA512 379f7468fa93109a0613e578de7c63376951140fd3dff4ecce9c9a7c2e17985716c4f63751dc6db099bb8c3ef3ad66dbc88a1f92630c5c3aa9ae5af71f26e520
TLSH
T11E119150E4F9D827EC3368CF562ACAA21CE437AFAC186E142309421D6BD9D32DD558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1428-7-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/1428-0-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/3380-81-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/3968-23-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/3968-36-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/4864-66-0x0000000000180000-0x00000000001A1000-memory.dmp

Download