eebe6fcf1306d9f5c15be4bc70cf15e9480e7a3de3c5f521513b299a4fc10ee3

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 13.3MB
Sample260811-cjjanadr2w
SHA256 eebe6fcf1306d9f5c15be4bc70cf15e9480e7a3de3c5f521513b299a4fc10ee3
MD5 f2e5f7bbcc34f9b53cbf2939a3d1a1a5
SHA1 03ee5f5af7b56441e341a017e7ff13a6a47191ed
SHA512 dbc59cb6eebd61ebdb8d8c00c8a8a8f350ecaa217f1d0e6749b3b7390251aa35d9a7210caa6c292661e2e4f89b2b56cd7ade97864c51aa8bc94157d0d782d88d
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMD+ElwMV+ElwMV+ElwMV+ElwMD+ElwMV+ElwMV+E0:PKjKWQckVgtev5mnlNLA
TLSH
T1DFE67E29FA980CE1E873517C8586C619EB7274251B21CBC7B27C832F2F276E5AD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2820	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
2204	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
4752	svchost_BABAAACCCBCBCBABCAAAAABAAAAAAACAACABAAACBACABAAABCBCBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACAACCCCCBCBCACBAABCBAAABABCCBACAAACCBBAACCBCBABBCBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABAAACCCBCBCBABCAAAAABAAAAAAACAACABAAACBACABAAABCBCBAA.exe"	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCAABBBAAABACBBCCBBACACBCABAAABCBABBAAACBBBBBCCABBBAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe"	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5336	sc.exe
3592	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6512	cmd.exe
4600	cmd.exe
5868	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABAAACCCBCBCBABCAAAAABAAAAAAACAACABAAACBACABAAABCBCBAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4084	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4084	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4084	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4084	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2820	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
2820	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
2820	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
2820	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2820	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 6512	4084	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	94
PID 6512 wrote to memory of 4524	6512	cmd.exe	96
PID 2820 wrote to memory of 6832	2820	svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe	97
PID 4084 wrote to memory of 4600	4084	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 4600 wrote to memory of 5336	4600	cmd.exe	100
PID 4084 wrote to memory of 5868	4084	2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 5868 wrote to memory of 3592	5868	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_f2e5f7bbcc34f9b53cbf2939a3d1a1a5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCABABABABABACBCBBABBBCBAAACBABBACCCBCBCBAAAAABCBAAAACACACBCCAABCCBCBCABAACBACBCBBABCABCCBCCAAAACAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCABABABABABACBCBBABBBCBAAACBABBACCCBCBCBAAAAABCBAAAACACACBCCAABCCBCBCABAACBACBCBBABCABCCBCCAAAACAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBABCCBABBABAABCABCCBACBCBCCACBBCCCACCBCBABBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe" start= auto displayName= "UserDataSvc_BCCBBABCCBABBABAABCABCCBACBCBCCACBBCCCACCBCBABBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBABCCBABBABAABCABCCBACBCBCCACBBCCCACCBCBABBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe" start= auto displayName= "UserDataSvc_BCCBBABCCBABBABAABCABCCBACBCBCCACBBCCCACCBCBABBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBABCCBABBABAABCABCCBACBCBCCACBBCCCACCBCBABBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBABCCBABBABAABCABCCBACBCBCCACBBCCCACCBCBABBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
1⤵
- Executes dropped EXE
PID:2204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAACCCBCBCBABCAAAAABAAAAAAACAACABAAACBACABAAABCBCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAACCCBCBCBABCAAAAABAAAAAAACAACABAAACBACABAAABCBCBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 016dc75301d3adc825896b5b1f1c1400c6b6ca6f46bb695f302f18321f2be3e8
MD5 978e481f20deed5d220249d27dda7296
SHA1 8f28511929bd6ed153f81027aa5864197922a17c
SHA512 377dd88848a023ede019e472635d062e5ddd60fed73f0f45e5206639d7ec251501efb88489f002f255b1d403c66777507dae1a430ad1eae90e1dbd5049acacba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f2589d1a190953ff9e66cd173262d9372fa395a81dcfb029509d4619777940a2
MD5 badaa0d09fdff7a6c5e93d0ff08bad77
SHA1 e27112221a016ab390e5d86dd4a87f229efc514d
SHA512 3772d0150a201585cafab2877ea1859dcc175115b95a8ecf8f0d1bf2a13e0f0bc2276cfee1f97e99361464ac3ace427f54d8aa2c2db8578a9ee54f81445d2b30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1c181f60259432339c4549043d84ee920f18a749a09c422a888c95ec95ee594b
MD5 ec948b944f73c0aa65d364853f9c8626
SHA1 27cc21425511f5b35552e0a85ba346b651bd1d51
SHA512 f2ca6a4f83bdb3c264403d9fdc1a3d83f2c151c2fab159e589220dba2db583b3c0410c3d6df6312f2c4964fbb64363033100d4bfdc8401674d575e4405584ba5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7cf9802a5903ae13a2e37e362ee854fabf33f1f6035e0194961f6945b6039a18
MD5 f209679a7730e9f17980af389f904a89
SHA1 f9477146aab35a2127c69cbc5a07d8a340e22b4d
SHA512 4356e9eecb1e30bd1050940b0cf9def4aa667832c117a2116321a0830f663fedc31930dda3728d7b102afe15950897211a2ae2715e37ffb031b8d0f72c033073
MD5 SHA1 SHA512

Submit Download

svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAAAABCCAABCCBBBABCBAABABBCACACCBCABCBCBBBBCCCBBACBC.exe
Size 13.3MB
SHA256 eebe6fcf1306d9f5c15be4bc70cf15e9480e7a3de3c5f521513b299a4fc10ee3
MD5 f2e5f7bbcc34f9b53cbf2939a3d1a1a5
SHA1 03ee5f5af7b56441e341a017e7ff13a6a47191ed
SHA512 dbc59cb6eebd61ebdb8d8c00c8a8a8f350ecaa217f1d0e6749b3b7390251aa35d9a7210caa6c292661e2e4f89b2b56cd7ade97864c51aa8bc94157d0d782d88d
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMD+ElwMV+ElwMV+ElwMV+ElwMD+ElwMV+ElwMV+E0:PKjKWQckVgtev5mnlNLA
TLSH
T1DFE67E29FA980CE1E873517C8586C619EB7274251B21CBC7B27C832F2F276E5AD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2820-24-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/2820-37-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/4084-0-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/4084-7-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download