5200bf3bbcc767b979d555f622ad0e7874710c949d44adf989b8731b3133e7a8

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 38.0MB
Sample260811-bjwqbaseqf
SHA256 5200bf3bbcc767b979d555f622ad0e7874710c949d44adf989b8731b3133e7a8
MD5 86d2fd3ce302c190047900e8b9139dcf
SHA1 1220dd393ec6c58fa0409aa6028d416a856108de
SHA512 122bfa1541283171aa64d947e36d2a34770883737b8bf02e3535e3f3ef1fa87855d0c4809f7cdde6cb5cae724380b2c52100730f15206a012e62c07e5a249373
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+Efiw2I+EF+Ei+EF+Ei+EF+Efiw2N+EF+Ei+EF+Ei+EF+EfB:TKjKWQckVgtev5mnlNLy
TLSH
T108974C09FADA04A0E97761704CD7D37E8AB179218732CAEFE649C72E5D33BA05838715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5320	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
1216	svchost_CABAAABCCAAAABACACABCACACCABAABAACABBACCCCCACCCABCABCAA.exe
968	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAAAACBCABABAACBBCCBBBBBCAACABABCBBACBABBACAAACCABBBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe"	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCBBCAAACCABCBBCCCBACACCBCACBCAAACABBACCBBACACCBCCBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAAABCCAAAABACACABCACACCABAABAACABBACCCCCACCCABCABCAA.exe"	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1088	sc.exe
2860	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5412	cmd.exe
3336	cmd.exe
5568	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAAABCCAAAABACACABCACACCABAABAACABBACCCCCACCCABCABCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3444	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3444	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3444	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3444	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5320	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
5320	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
5320	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
5320	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
1216	svchost_CABAAABCCAAAABACACABCACACCABAABAACABBACCCCCACCCABCABCAA.exe
1216	svchost_CABAAABCCAAAABACACABCACACCABAABAACABBACCCCCACCCABCABCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5320	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
Token: SeDebugPrivilege	1216	svchost_CABAAABCCAAAABACACABCACACCABAABAACABBACCCCCACCCABCABCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 5412	3444	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 5412 wrote to memory of 2096	5412	cmd.exe	94
PID 5320 wrote to memory of 3500	5320	svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe	95
PID 3444 wrote to memory of 3336	3444	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 3336 wrote to memory of 1088	3336	cmd.exe	100
PID 3444 wrote to memory of 5568	3444	2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 5568 wrote to memory of 2860	5568	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_86d2fd3ce302c190047900e8b9139dcf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACCABCAACABBCCCBBCBBAABABAACCBCBBBCCBCCBAABCACCCAABACCACACCCAABBCCCABCBCCACABBCABACABBCACCCBBBBACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACCABCAACABBCCCBBCBBAABABAACCBCBBBCCBCCBAABCACCCAABACCACACCCAABBCCCABCBCCACABBCABACABBCACCCBBBBACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBABAACABAACCBBBCCBBAAABCCCBBABAAACBBACAACCACCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe" start= auto displayName= "UserDataSvc_ACBABAACABAACCBBBCCBBAAABCCCBBABAAACBBACAACCACCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBABAACABAACCBBBCCBBAAABCCCBBABAAACBBACAACCACCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe" start= auto displayName= "UserDataSvc_ACBABAACABAACCBBBCCBBAAABCCCBBABAAACBBACAACCACCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBABAACABAACCBBBCCBBAAABCCCBBABAAACBBACAACCACCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBABAACABAACCBBBCCBBAAABCCCBBABAAACBBACAACCACCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAABCCAAAABACACABCACACCABAABAACABBACCCCCACCCABCABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAABCCAAAABACACABCACACCABAABAACABBACCCCCACCCABCABCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
1⤵
- Executes dropped EXE
PID:968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8276e05bd5ce5eb3c84da47a6f232a15448a4ee16eb8b7c462c98173cf0b8c1
MD5 8d06ea17139c0d8d4d1fde5e0ed63c38
SHA1 9bec889aa7014850ffa7c36492824ba387d9b0bd
SHA512 92d71e5e7335e14a284cfedbaa4b24f18396bee4161c151c47b65624784e650af44851da0dcee19236fcbefa800e8790915eef2539e24d3e0ca9a7ecad82a477
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 87ebb4c6a912b1c49a32dba36518e75045b2b9387b6c9ff051ac710ccf7b85c5
MD5 9a634a9e85f3c9294b5ad9edc5e4fd97
SHA1 2c60c1d339d9e760bd7469bb59bc71dad5127f52
SHA512 94e46be0ed5119f14beb44142296d6afeb709235bebfae60b9b8bfc85b5c8de9bdd5d19a4c1bf4e6e8896fb7e026e95920a048d2d147449f5491caa9a1f47240
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 814f55b62f97823adf56fdf2606cac2c89a7780f04e501fafe5e738fb150a219
MD5 fbba3d7ae70b039a40caeeb7b3e200a6
SHA1 092be3f50cc33150264a64e9102ef7fd831c13c5
SHA512 1df1e326b2d112a90dad9c347cd9e59e2262a505a857da9427b44bef1ea593cce0bd04930bc1869d23566df31661c78c8ab6a0e7a0a03d7a59497e78fd0cc33d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52ff1ca214353d4caa0df5f1a16550ad06b8e7866a8ba4b88da680371a25545f
MD5 c96b1769209eac38fd7a73268c51a9b2
SHA1 a1344fb42bcfb59feccaba1c8644c6eacbe14005
SHA512 2253c4845d285bf4f9a2b7e46a46e64610c62e608cfb962b5854a96848366de5e6faad5c5359dc2385a4a991cb2bc4054823b184b59fb33e33115cb8d27c6e6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 89c7bc787026966125583d0492fd9b393c6cc1c42aa6e982fc89f96bae260666
MD5 5ea0609db4011e8eb448db8671899118
SHA1 29c454202259133cbcd24c9411f216b0ccb571b6
SHA512 adb17e83cd6210f0d1e425cb2f6b22a2c81d994b87b772b3891c802e4454fb391af1bf3dff9f3b73280355b7e6df9334354de8329306b6f2618c3f1827ab7756
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52d712e293e3c0b065267721484524d01f8ed7b8b0c3e75f059e11a64a1ae6f0
MD5 6b3418901291339aa111d9e0ea3a60cf
SHA1 80d16968ea81c96aa0470feef4269b83bbfe0550
SHA512 16e0ef0f47782d2d2c200983c4305431bac1a1b44b20cdb82d18993a3eec35eea087857f41659c8abbed8537935433a5699c5bd6f44ce4b5f4ace7d6064625d9
MD5 SHA1 SHA512

Submit Download

svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCABBCBCAAABCCCBACBACBCBAABCCCBAACCAABABBAAACCCAABB.exe
Size 38.0MB
SHA256 5200bf3bbcc767b979d555f622ad0e7874710c949d44adf989b8731b3133e7a8
MD5 86d2fd3ce302c190047900e8b9139dcf
SHA1 1220dd393ec6c58fa0409aa6028d416a856108de
SHA512 122bfa1541283171aa64d947e36d2a34770883737b8bf02e3535e3f3ef1fa87855d0c4809f7cdde6cb5cae724380b2c52100730f15206a012e62c07e5a249373
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+Efiw2I+EF+Ei+EF+Ei+EF+Efiw2N+EF+Ei+EF+Ei+EF+EfB:TKjKWQckVgtev5mnlNLy
TLSH
T108974C09FADA04A0E97761704CD7D37E8AB179218732CAEFE649C72E5D33BA05838715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0baa46c8a364eda277981b9cad5bf42457ce7ca45a618d44459b1b31c2be4ef1
MD5 34524d2cb744a180ad7a0c3c4b957efa
SHA1 c86da8664dd774df12629d71389ba211ab193426
SHA512 4715d810e6212f8e11090ddb5a2343da672fbda46d0357d9d62ce8243911286a972f741d0fc066ecea7f98c4ed6d9ebfe277d5fb138b0f2604f2eeb64f82d11c
TLSH
T11311BF61D4E5DC27E9232C8FD53DEB438CB0369FDC6C6B18AB58421867D5D20CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-79-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/3444-8-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3444-0-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/5320-24-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/5320-34-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download