9ff5c32bb1c5f1ea3aa24c23458ef2049fccffd4ef6504c6eef2d51838d3874f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe
Size 20.8MB
Sample260810-ct5xeahm51
SHA256 9ff5c32bb1c5f1ea3aa24c23458ef2049fccffd4ef6504c6eef2d51838d3874f
MD5 7f0c514e4754df3989470de1e53606ce
SHA1 4ea83b93992a2b2fdbba9093109bb0e4ed5e03b0
SHA512 f1d99da1ac490d4d965e0ddac6e9371749f59e1dc4de52336ab46a40ec7ea3ab8deef9a062a584a42c12823420e47e0e7b6eefaef1d1a890b0e2e2afb0e7d997
SSDEEP 196608:vBBBBABBBBABBBBABBBBABBBBABBBBABBBBABBBB7KWQc0gEYnvLd:FcZEIvp
TLSH
T15F278D10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2468	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
872	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
868	svchost_ABCABCACBABBBBCCBBCCCABCBBBBBBBCCBCAACBBCACCCCAAABCACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCCCACABCACBBCBACBBCBBBAACCACAABACAABAAABCCABBBBBCABCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCABCACBABBBBCCBBCCCABCBBBBBBBCCBCAACBBCACCCCAAABCACAA.exe"	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBACBCBBBABABBBCACBBBAAACBCABCCABABBBABABCAACAACCCABABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe"	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4152	sc.exe
1880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1664	cmd.exe
4408	cmd.exe
556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCABCACBABBBBCCBBCCCABCBBBBBBBCCBCAACBBCACCCCAAABCACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3304	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe
3304	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe
3304	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe
3304	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe
2468	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
2468	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
2468	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
2468	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe
Token: SeDebugPrivilege	2468	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4484	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1664	3304	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe	100
PID 1664 wrote to memory of 8	1664	cmd.exe	102
PID 2468 wrote to memory of 2256	2468	svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe	103
PID 2256 wrote to memory of 4928	2256	notepad.exe	104
PID 3304 wrote to memory of 4408	3304	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe	106
PID 4408 wrote to memory of 1880	4408	cmd.exe	108
PID 3304 wrote to memory of 556	3304	2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe	109
PID 556 wrote to memory of 4152	556	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7f0c514e4754df3989470de1e53606ce_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACCBBBABCCAABBABCCAABAACBBBCABCCACABBACBABAABBCCCCCCBAACBCBCCABBCACBBBBBCBBABCBBBBBACCAACAACBABBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACCBBBABCCAABBABCCAABAACBBBCABCCACABBACBABAABBCCCCCCBAACBCBCCABBCACBBBBBCBBABCBBBBBACCAACAACBABBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:8
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCACBABCACCAACABBCACCBBCBCBABAAACCCCBAACBBBCABCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe" start= auto displayName= "UserDataSvc_CBCACBABCACCAACABBCACCBBCBCBABAAACCCCBAACBBBCABCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCACBABCACCAACABBCACCBBCBCBABAAACCCCBAACBBBCABCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe" start= auto displayName= "UserDataSvc_CBCACBABCACCAACABBCACCBBCBCBABAAACCCCBAACBBBCABCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCACBABCACCAACABBCACCBBCBCBABAAACCCCBAACBBBCABCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCACBABCACCAACABBCACCBBCBCBABAAACCCCBAACBBBCABCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
1⤵
- Executes dropped EXE
PID:872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCACBABBBBCCBBCCCABCBBBBBBBCCBCAACBBCACCCCAAABCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCACBABBBBCCBBCCCABCBBBBBBBCCBCAACBBCACCCCAAABCACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9dfc7bc5a620d5a5b60c59ee264d6b220d527c44c6a3e94f385380815995cfb1
MD5 67f03af9a91aa9ba5416538bf202b5b8
SHA1 4813cef1c9d043ccb702f6d5b3af142153aee43e
SHA512 25f8b22cae9015b3cb97dd425286abac030d37866302746347ca5163a1bbf186a317692d669dd06f573aa877d4726901578e648e7cc0a062b6ab7f7c2ee05980
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fe3968a2ad66a0b8b6084e08c688beb6c5b40d1aed651e4383a1302d8c2c386
MD5 640de6302c83ff7ecfc8936143161a5e
SHA1 3cc6c09975055666c40ecb3439b2bbd037dff940
SHA512 4340bc676de8b032dd224ad7b246174e4f3e7293617fe53578d9d74c3b7b884805c1b81a6ce27e2ed5a8e2f8f6685687d6b88f53eb276925160659211455e40f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8d64629f39a007f82ed7750fd233574aed265aece44bc6c352a9e9c11bcc996
MD5 24293f37b9983dc8453096373b9cbd2a
SHA1 97718e90e91da47e38576844c3969b16150680d8
SHA512 c25cd1b86df4a3af4a48cdb421b4b18cbc3c4f231bb4f25abe759e098344ce74b10a14ce1316d8b9d81a9fb12e24c9ad8806873b395438aeae2cdef43bda693a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b179939ba3e6d0d1d57387ad3bd4c8acebc6b45cab01b61b4ecee9f8000773ca
MD5 8428a987b7b13ddec609ddda0c89126b
SHA1 cd5d4e0fdc7095295710fb84c0b67350165c6fa7
SHA512 61f424234216c63621c850bc12fc2dc4775892bfe47eca7ace6ec816d60ac221d2746efa3cd52f20bbcedbde00581a52772a114a0bd2977afba56b49f4417b5d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b853aba75730c8d4e33983d096eec6a98c2bea4f551349a4d7e17215934c6060
MD5 c9e318ca6cf730659603a83b54dc5936
SHA1 a91a6b4bf71ec040d15e97f91de0fa961c84222c
SHA512 8ac4687040959de73c18a78e3afc77dacdaa83d33b69c4998978f80945a2ab81eba6167e4b6aa1a18eb3ce6e74adedc284904e683186a697ddaec96f643e3434
MD5 SHA1 SHA512

Submit Download

svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBACABBBCBCCCACAABABBBBCBCBBACACCAABCACCABCBABACB.exe
Size 20.8MB
SHA256 9ff5c32bb1c5f1ea3aa24c23458ef2049fccffd4ef6504c6eef2d51838d3874f
MD5 7f0c514e4754df3989470de1e53606ce
SHA1 4ea83b93992a2b2fdbba9093109bb0e4ed5e03b0
SHA512 f1d99da1ac490d4d965e0ddac6e9371749f59e1dc4de52336ab46a40ec7ea3ab8deef9a062a584a42c12823420e47e0e7b6eefaef1d1a890b0e2e2afb0e7d997
SSDEEP 196608:vBBBBABBBBABBBBABBBBABBBBABBBBABBBBABBBB7KWQc0gEYnvLd:FcZEIvp
TLSH
T15F278D10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/868-80-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/872-75-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/2256-60-0x0000000002430000-0x0000000002431000-memory.dmp

Download

memory/2468-26-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/2468-39-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/3304-7-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/3304-0-0x0000000000140000-0x0000000000161000-memory.dmp

Download