10c3996903ec3d9df4795f956a6a66a2749458b9c455d0637506cec6aeae46f7

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 5.0MB
Sample260811-ee8qvscd26
SHA256 10c3996903ec3d9df4795f956a6a66a2749458b9c455d0637506cec6aeae46f7
MD5 0fc62fb4b55c349931e821106e30c02a
SHA1 b1013326997e51634d7a6c793863f5ce5f55053b
SHA512 7d7cc517d2492237e0692c406c16bddba2de592c57a3b676354dec1234eff77d538248dc6ed4ae867ccf901617b0d84999b173418c6faa7ff29add583513d0f4
SSDEEP 49152:U+ES+EFhO6+ES+EFhO6+ES+EFhO6+ES+EFhO6+ES+EFhO6+ES+EFhO6+ES+EFhOK:f+++++++WKjKWQckVgtev5mnlNL4
TLSH
T15F368E0DB2EA00E4E97755708967827AC932B8315721DADFA2D4C53E9E33BD4B934F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4592	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
5972	svchost_BACACACCCBACCCBACACBCACAACCBACBAACABABABACBCBBCCCCBABCC.exe
3052	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCACABBAABBCCAACBCBAAACCCBCBCACBBBACCBBCAABAAABBCBABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe"	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABAABCABABCBCCACBCAACBBCCCBBABCBABCCCBACBCCCABBCCABCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACACCCBACCCBACACBCACAACCBACBAACABABABACBCBBCCCCBABCC.exe"	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1156	sc.exe
3368	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4900	cmd.exe
3576	cmd.exe
4264	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACACCCBACCCBACACBCACAACCBACBAACABABABACBCBBCCCCBABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4892	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4892	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4892	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4892	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4592	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
4592	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
4592	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
4592	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
5972	svchost_BACACACCCBACCCBACACBCACAACCBACBAACABABABACBCBBCCCCBABCC.exe
5972	svchost_BACACACCCBACCCBACACBCACAACCBACBAACABABABACBCBBCCCCBABCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4892	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4592	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
Token: SeDebugPrivilege	5972	svchost_BACACACCCBACCCBACACBCACAACCBACBAACABABABACBCBBCCCCBABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4900	4892	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 4900 wrote to memory of 5400	4900	cmd.exe	94
PID 4592 wrote to memory of 1332	4592	svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe	95
PID 4892 wrote to memory of 3576	4892	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 3576 wrote to memory of 1156	3576	cmd.exe	100
PID 4892 wrote to memory of 4264	4892	2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 4264 wrote to memory of 3368	4264	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_0fc62fb4b55c349931e821106e30c02a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBBAACBBBBABCBBBABAABCCBBCCBBABBBCCBAABACBBACACABAABBCBBAABABCBCABACAACBBACCABBCAAACBAACAACCAABACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBBAACBBBBABCBBBABAABCCBBCCBBABBBCCBAABACBBACACABAABBCBBAABABCBCABACAACBBACCABBCAAACBAACAACCAABACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACAACABCAABCCBCCCBACACBCBBBCCBCCABAABBCBABBBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe" start= auto displayName= "UserDataSvc_ABACAACABCAABCCBCCCBACACBCBBBCCBCCABAABBCBABBBCBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACAACABCAABCCBCCCBACACBCBBBCCBCCABAABBCBABBBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe" start= auto displayName= "UserDataSvc_ABACAACABCAABCCBCCCBACACBCBBBCCBCCABAABBCBABBBCBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACAACABCAABCCBCCCBACACBCBBBCCBCCABAABBCBABBBCBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACAACABCAABCCBCCCBACACBCBBBCCBCCABAABBCBABBBCBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACACCCBACCCBACACBCACAACCBACBAACABABABACBCBBCCCCBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACACCCBACCCBACACBCACAACCBACBAACABABABACBCBBCCCCBABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
1⤵
- Executes dropped EXE
PID:3052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b7079742da44b3c4f6a1d2f62dde7a2d4510cf9e57b7c4485eae8bdd046e66ea
MD5 afd190146cd5648a21b37b21f42a7fd4
SHA1 41c70a751da9ac08f2d6e62fb145c895c787f0dc
SHA512 c7b70aa81663fa1805cc5ba1068adb7d22a120621f7f9ea3dd9aafde0eb5be2f710d6b7449ddf682e16ae74c8f6bea3776c557e188462be8268288cf20bd2726
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 643afe23ce13c2eceb6e8a52aa2234cbc63849e18d11e57407c3c326db1fb380
MD5 65b31a0472652262e29cf40265d58200
SHA1 e91d9a4c8559489e4c4ade800905afc535b7f3c3
SHA512 73fce9e59d0a041514c49a0d065de7d1e72c7a977fc8212ef70b5c8a8314ec977847bbb66aa2788f46ea2e0dde29c41e5e24181e5c3f0df88e95993f6a083fdc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d97bb2267cbfc08cfb8ab6ca6fb87ccc47ad48b5f19f97bd7b36dbf74211320
MD5 b40f616f50d6c782743dc41aa23d9d0e
SHA1 dab31dbbeed3908a1274dda42fb4db9999dd811d
SHA512 a30d6aff06e22b1d9a250a182e3ffdbc7b6d40842f9d02dba77ede722c85dd6a30bc11903c554c350f07d7838b6bb0f1600ccc07c466bdbd69083727a4350c3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 919ccfe3ed8c103f49339008c0255eec63eabc9f180f2f6847977170a53689ca
MD5 3665854bcfd2cccb5eaaac0176f5e0ef
SHA1 140714af413139704cdc79bd7dc856d4e037342b
SHA512 2441d4a5bbec2e845370c10e91db13323208c5c6a15c8383821a5b66668c37aaf27680d4f5f6da11e8457af444e72cdfc8d6a41a88d1b197aa1b36c0a66bdd7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e6bcf531efe683075dbf5d1018dcc33b3e948f1a2acd21f91ada96e244d72d1
MD5 aee3366c00b0dbabd2822fda1af9f977
SHA1 b9ef637f2091a467d76053444ceaf577d64fae35
SHA512 02f690e4eda899fc3f4a1fb1f76a9b2e272c59a64fdfedcc6bb594559739e01f7e76c8c7406491a58f0988263fd23503b34b9512ee03ac736881e4d97d062a04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 387988c1c3390b227d04cea10988b17e73b4a8a0c9a77e9a76e981cf0ac90908
MD5 da30f05585df0d09a4b2db7230da9e54
SHA1 6d4ac457e0dcb483ab2ac73720888919b9b8cabd
SHA512 21145dcd430941533e229c739a8e92e3dff05fd7a16c26c6bf6698bffb636329952434790f6fc5d31e1c2626a8a32340dd1ded670bf25e19fe9dd971fa25eff8
MD5 SHA1 SHA512

Submit Download

svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACCAACBCCCACCABCABAAABBCBCCCACBACACCABAAABCBBBACBB.exe
Size 5.0MB
SHA256 10c3996903ec3d9df4795f956a6a66a2749458b9c455d0637506cec6aeae46f7
MD5 0fc62fb4b55c349931e821106e30c02a
SHA1 b1013326997e51634d7a6c793863f5ce5f55053b
SHA512 7d7cc517d2492237e0692c406c16bddba2de592c57a3b676354dec1234eff77d538248dc6ed4ae867ccf901617b0d84999b173418c6faa7ff29add583513d0f4
SSDEEP 49152:U+ES+EFhO6+ES+EFhO6+ES+EFhO6+ES+EFhO6+ES+EFhO6+ES+EFhO6+ES+EFhOK:f+++++++WKjKWQckVgtev5mnlNL4
TLSH
T15F368E0DB2EA00E4E97755708967827AC932B8315721DADFA2D4C53E9E33BD4B934F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 15b6eb946d3e3dd872d2048a2c1208fc52bffb038d628cb89cc4d0c5d4bcf315
MD5 9ef13c0a49b81f49f8710d84169decfe
SHA1 ae6c29c27e18661a5b9eebd7ecf2729a361335cb
SHA512 89570e7e91a05d82d4813f9695d4f6700dd1c22bbe5ed16cc497d2df5f4ebe1fbdd603a83239ba3e0ce6b6f49f877d55c0fa2dec68bc7cad3888d4fb3a7b8594
TLSH
T15911C140E4E5D873E92228CFCA3A9B431CE4369FAC586B64229983197799C33CE110E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4592-34-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/4592-24-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/4892-8-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4892-0-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/5972-79-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download