362310c3ac81a45bae2d78d4669f7626ce1afd8bbb13fa7f46853dd0ab84b10d

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 22.0MB
Sample260810-crhn4ade96
SHA256 362310c3ac81a45bae2d78d4669f7626ce1afd8bbb13fa7f46853dd0ab84b10d
MD5 891c45815957495abd8e912bd754231a
SHA1 b7affa4eb3d0a6f4344bf748a7658ca9a40dec30
SHA512 f052cae665840dff9b4ce08c66f6ee649ed361cfe97ee452c994a401b5cf3a7d9392d8723bb935d37b930b9301731835fa61522f96c690c44cb9884ceacef0cd
SSDEEP 393216:+O4q78UhashO4q78UhashO4q78UhashO4q78UhashO4q78UhashO4q78UhashO48:1hasIhasIhasIhasIhasIhasIhasxEI/
TLSH
T1F4374C2DBD9844E6D8729275C492E999EA3178126B009FCF71E5530E0F3BBD2AC34F25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1692	svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe
5012	svchost_AAACABCCACABCBAACAACBACAABCCACCABCABABAACBACCCABACCCAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCBACBBAAAABBCBAACCACCAABBACABBABCCBBCCCBAACABCCACACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe"	2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAABABACCBAABAACAACBCAACACACCABCABABBABBCBAAAABACABBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACABCCACABCBAACAACBACAABCCACCABCABABAACBACCCABACCCAAA.exe"	svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2584	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACABCCACABCBAACAACBACAABCCACCABCABABAACBACCCABACCCAAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5948	2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5948	2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5948	2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5948	2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1692	svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe
1692	svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe
1692	svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe
1692	svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5948	2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1692	svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 2584	5948	2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 2584 wrote to memory of 4516	2584	cmd.exe	94
PID 1692 wrote to memory of 1940	1692	svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_891c45815957495abd8e912bd754231a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABACAABCBCAACAAACBBBCCBBCBBCACACBACBCACCBCCBABCAAAACAABABBBACBCCCCCAABACCCBBCACCBAAACCABBBBACBBCACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABACAABCBCAACAAACBBBCCBBCBBCACACBACBCACCBCCBABCAAAACAABABBBACBCCCCCAABACCCBBCACCBAAACCABBBBACBBCACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCCACABCBAACAACBACAABCCACCABCABABAACBACCCABACCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCCACABCBAACAACBACAABCCACCABCABABAACBACCCABACCCAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82d5487a10f07228de8c7492fba5ae0f8e70730e8ec2e5aa711b91d21580fe2d
MD5 206a1a3feac0bcd089080f04203f3e96
SHA1 da38e863ea8ac5705792ab204026effb586f9153
SHA512 b75dfb661a751207a12b73c55e7dcc34a5b4ac96224b5e8a7bd3e1892426ba9db499a621824c8e869dbdb265210c94b22a774f311c530cc2e3e4ca671a3bb165
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3e50126ae586b46828e00a3f4e9be34e8fab81b22b63b2826730f9ee63fa84e
MD5 49725d4759c03a5d445c6fbc12bf6117
SHA1 964ccfb724b01e3976bbc5c7a7ea12b9996e6db9
SHA512 7e9d2b7a55828c46b93649441efe66de620319361edc756b85c7c23e2e9c2dbf5bc17e3955a465fe855883ef59f7619d6250b6fb3cc90353385057c081173937
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fd278a1bd81eb37aa529393ac96941d7cb611894ead5eb9385db8295576f9a65
MD5 0ff1202407245c4f633c60014433fd6a
SHA1 b84c1ffc39835c3c7e81f2f207bab11d775d157e
SHA512 de7a191f8595ce3806b88f8d158ee7a5bac03a0fe2ee57d709c2142e723a078afce9087e2c66e22eef44e38f03849270abb72f999b771260964657c294376eb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 283b88a71f09a8764374deda7ba5df711c863e922fcc288ab5ccddfca9e03c3d
MD5 b5834736ec61527c951243423f98b7ba
SHA1 eca339097141c56dae4080ddede04ab9a27c98ea
SHA512 0289010963915c35b892851c80750e8e0cb46bd553221dca0dbb563b62050f68e0cb0fd250736073b9cc8998227a5bb41ffc1a976a0d9ce152b375357a20d9ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e9be180b84736f9ef0de7ee85dd27f63ea510650ce6c9f65f77b86859770d6d
MD5 f178c52b71b283aa2845d60373060b21
SHA1 064a841f9599ca7e5e5ec7ee626c3e203dcc4a04
SHA512 4e9de6a57c1f9f464f66e0c79b1449e77450bc855b39ce48581629c9f655b8300c0222825174b5c1c3017d8ccd1960aa7022b9e79ee68be22947b46083c5013e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 053351daa5964b80bf2d551ae4188e459c349519e0083603c1ebdd028da9be75
MD5 2ebe6d5c9600e203f4a3b65ddeb9eb23
SHA1 db7fe40716552dd96ec63cd5139b0255c39f38e8
SHA512 fa56c03815c27e3ecaa11e5c2fa4544f1bcee83ec93f8e4a95668042d26ed383d9cca7af11f57b18f158d80dad6f54512e4dcee94b86537f9891169ef51cdfd9
MD5 SHA1 SHA512

Submit Download

svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBABCACCCCAABCAACAAABBAAAAACBCCCABBCBCACBACBBCACBBB.exe
Size 22.0MB
SHA256 362310c3ac81a45bae2d78d4669f7626ce1afd8bbb13fa7f46853dd0ab84b10d
MD5 891c45815957495abd8e912bd754231a
SHA1 b7affa4eb3d0a6f4344bf748a7658ca9a40dec30
SHA512 f052cae665840dff9b4ce08c66f6ee649ed361cfe97ee452c994a401b5cf3a7d9392d8723bb935d37b930b9301731835fa61522f96c690c44cb9884ceacef0cd
SSDEEP 393216:+O4q78UhashO4q78UhashO4q78UhashO4q78UhashO4q78UhashO4q78UhashO48:1hasIhasIhasIhasIhasIhasIhasxEI/
TLSH
T1F4374C2DBD9844E6D8729275C492E999EA3178126B009FCF71E5530E0F3BBD2AC34F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-35-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/5012-69-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/5948-0-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/5948-8-0x00000000003F0000-0x0000000000411000-memory.dmp

Download