0df8ab0e14f33e2551ecd5927d48cc1f6ce0d8586444fdffd3ff67a049420c4a

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 10.5MB
Sample260810-df7phsdg47
SHA256 0df8ab0e14f33e2551ecd5927d48cc1f6ce0d8586444fdffd3ff67a049420c4a
MD5 1b87ac30ad9cf75861a011e818685742
SHA1 d19da9953478273041c6d3be3159f7467af8b47d
SHA512 0c5ec20d504b1bbc94a8d1ae573d19141d7550c8f6c8e8a0adc1630e2a62e8a46e30fed42710bcd273e373b73aa4407e61f078628fdda76f5121ffe8fc3c3a27
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wqu:uKjKWQckVgtev5mnlNL4
TLSH
T175B67D14FAF60C62E1BB11B11DF6E67A0C31BB7A8128D55DF99E874F7833B8044167A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2388	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
1868	svchost_CCBBCCACCCBBCABCCBBBBABBACAAAACCBABBBAAACCCCCCBACABCCAC.exe
3360	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCAAAAAACCABABACBAABCABAAACBCCCBCCABBACCAABCCABACCBABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBCCACCCBBCABCCBBBBABBACAAAACCBABBBAAACCCCCCBACABCCAC.exe"	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBABCAAABCABAABCBBBCBCACAAAABCABBACAABABABABBCCCAAABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe"	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1744	sc.exe
1808	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2124	cmd.exe
1660	cmd.exe
2716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBCCACCCBBCABCCBBBBABBACAAAACCBABBBAAACCCCCCBACABCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1536	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1536	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1536	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1536	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2388	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
2388	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
2388	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
2388	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2388	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4004	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2124	1536	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	106
PID 2124 wrote to memory of 2916	2124	cmd.exe	108
PID 2388 wrote to memory of 3068	2388	svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe	110
PID 3068 wrote to memory of 2328	3068	notepad.exe	111
PID 1536 wrote to memory of 1660	1536	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	115
PID 1660 wrote to memory of 1744	1660	cmd.exe	117
PID 1536 wrote to memory of 2716	1536	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	118
PID 2716 wrote to memory of 1808	2716	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBABCCBBBBBBBCBABACAAABBAABCAAAABABCAACCABABCBCBACCBCBCCBCACBCCCCBABBBCCABAABABACAABAAABAABAAABABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBABCCBBBBBBBCBABACAAABBAABCAAAABABCAACCABABCBCBACCBCBCCBCACBCCCCBABBBCCABAABABACAABAAABAABAAABABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACCCBCACAABACBBAACBCBABCAACABCABBCCABCBBBCBACAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe" start= auto displayName= "UserDataSvc_ACACCCBCACAABACBBAACBCBABCAACABCABBCCABCBBBCBACAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACCCBCACAABACBBAACBCBABCAACABCABBCCABCBBBCBACAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe" start= auto displayName= "UserDataSvc_ACACCCBCACAABACBBAACBCBABCAACABCABBCCABCBBBCBACAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACCCBCACAABACBBAACBCBABCAACABCABBCCABCBBBCBACAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACCCBCACAABACBBAACBCBABCAACABCABBCCABCBBBCBACAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACCCBBCABCCBBBBABBACAAAACCBABBBAAACCCCCCBACABCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACCCBBCABCCBBBBABBACAAAACCBABBBAAACCCCCCBACABCCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
1⤵
- Executes dropped EXE
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OpenUse.exe

Path C:\Users\Admin\Desktop\OpenUse.exe
Size 2.3MB
SHA256 7c5ff230f9cd57d5b6c32092c26a92c9f05220a0009ddccdca2f8c824b3d9335
MD5 f9dbac2f635db7a27baa43952e4bb075
SHA1 21d20efcd5dc93bcc79e25bc8329e69356a3ab3b
SHA512 b35e3bf581bc0e2ca6b3977d7489a3e9fb41c83b4c8f0d414ac0c317a7380d59049e59a438c2a1c499989a517e2fdcc46b353f67dc49cf58411113b5387806ee
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EFR:n
TLSH
T16EB57D14FAE60C62E5BB11B11DE7E67E0C31BB3A8124D95DF99E874F7833B40441A7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 24b5e5f2ab24f33b699905b18bcd8bfafe82596cd8cd505c74930c7c44c5826a
MD5 ea11ab7e43023bb9c6ca17f1702ffa75
SHA1 7b652eee40719642b8ae28a119c765c12401e3c3
SHA512 0c3fad046b06503c6c1f3b9963d008db9273a7bf42fa4049676936ce094fa3ad9dc5d0a86480a041e18dd6c65a38ad9d34b213b49aba79cc06684b27b1501841
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e8bb68e4fba9258b571509aec6a38d0daeba30c14e703ef90ade6735fd5c6dc
MD5 1cfdd559f93f90a80160ef857b18e294
SHA1 7a1d38069a674aa76a11172e7220fcf4136949bd
SHA512 b19501c1f346062912c14ec733ba7333ba955aa00090fe659cb37b1c74503ac617262b445e70516d7b797e48bab9df7a0f4176ff34d9edd616590071392894de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2404687cecf47d7b8f0d3f35cfa377015da2b5ec9a92a4ff861effaf05c6d365
MD5 a8b8910b24136ede905aab1f30d3ea65
SHA1 aa4cbd2c7030569fbed21edcbfad020386411f5d
SHA512 197bf8c61fe83994a41c65ab9a2f5bce8ba15f5efd754ae3726222641aa5d9e0945b36757a67c22c25eabaa6ef9dfd27b2d1ff1f2578ebed2608b823ef32fb80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d7548415a680e160a845dd9b8e6e0bc20b3f78b3822c7d9321cf8c2f7631cda
MD5 47a36db23d9f67b79862caca062dc329
SHA1 feb572f8647477ed751ceba9a734bcdd081c2f29
SHA512 b98d1e51c905553ad579fb3db921abfba0df57c76c8eff3dce9fc72d27b5a79a92f926e17f786f1d57667c7343486e4bb8e1d215be209d283fd7bdcaf0a5ddcd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c67a6a3f6db2b1bf39ac2086042a4b652b5151310c3f69c6370559625d9f4a47
MD5 3e6d374571e30a6f55ab895db26d5887
SHA1 3c9142af07a258f49775c586a5f4f79bdbd3459b
SHA512 1b53d875cfd3435d3c1c5c3c06916b40ea249c2d78ec79227474f1bd2b40d94f66f5475e418d19da1a173b1a197739af6a8bef667063662ba2b096073e0a9522
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 af30abccf88bad5e238d0552fdc45d1cea7c77c3a7195727a82dd9318af72da5
MD5 c0fd1977502432798b5c77d620fd50a2
SHA1 9e9ecd94473598f97251a92b2b4f8ce40bc8f911
SHA512 b70a674bc7b1fe251f2bd43fe3804ad7aa220a564c911c340b473fe4fad207d399beb29498bdfc0ec4b42b81c6ebbce3aeea5236a18f1e53544f7d242cf57a77
MD5 SHA1 SHA512

Submit Download

svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCBCCABBACCBBAABCCBBABBBBCCBCBBBCABCAAACBCCCCCCBCBBC.exe
Size 10.5MB
SHA256 0df8ab0e14f33e2551ecd5927d48cc1f6ce0d8586444fdffd3ff67a049420c4a
MD5 1b87ac30ad9cf75861a011e818685742
SHA1 d19da9953478273041c6d3be3159f7467af8b47d
SHA512 0c5ec20d504b1bbc94a8d1ae573d19141d7550c8f6c8e8a0adc1630e2a62e8a46e30fed42710bcd273e373b73aa4407e61f078628fdda76f5121ffe8fc3c3a27
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wqu:uKjKWQckVgtev5mnlNL4
TLSH
T175B67D14FAF60C62E1BB11B11DF6E67A0C31BB7A8128D55DF99E874F7833B8044167A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-25-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/1536-0-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/1536-12-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/1536-51-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/1536-75-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/2388-37-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2388-76-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2388-52-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/3068-78-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Download