e7edfc1e1370721593921c8ff07e8ee4dc8ee51d873dcf731efa61e22e07c3bf

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 16.5MB
Sample260813-eavcns1cqg
SHA256 e7edfc1e1370721593921c8ff07e8ee4dc8ee51d873dcf731efa61e22e07c3bf
MD5 b9ec1bba484fd0d9d608b18b4aff3a80
SHA1 f4efc1e1cba550b6c6dae75d56b474c7147f5bf6
SHA512 3061a36645e0dbd9ac9ffee40712829fe43cf21ccb77ea6545bce9bef06ff360c7bd798d6a1b6b04ce1417e02614a69758cd033e4e454bed222e52d01ef28dd2
SSDEEP 98304:iryrgr2cryrgr2cryrgr2cryrgr2cryrgr2cryrgr2cryrgr2cryrgr2NKjKWQca:kKWQc0gEYnvL8
TLSH
T185075B0F66EC00A6D87FC275E6E18166C670B431672159EFA190C73D9F6BAD1A93CF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2484	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
1720	svchost_BCAAABCACABCCABBBACBCCAAAACACBABACCAABBCCBABCBBACBACBBC.exe
5384	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBAACAACBAABACBAACCBACBACCABACACAACCBCCAACCAABBBCABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe"	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACAABBBBBCACCBCBCCBBCCBBBCBBABCAAABCBACCBBBBABBAABBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAABCACABCCABBBACBCCAAAACACBABACCAABBCCBABCBBACBACBBC.exe"	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1456	sc.exe
4840	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4688	cmd.exe
5144	cmd.exe
3528	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAABCACABCCABBBACBCCAAAACACBABACCAABBCCBABCBBACBACBBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4748	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4748	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4748	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4748	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2484	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
2484	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
2484	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
2484	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
1720	svchost_BCAAABCACABCCABBBACBCCAAAACACBABACCAABBCCBABCBBACBACBBC.exe
1720	svchost_BCAAABCACABCCABBBACBCCAAAACACBABACCAABBCCBABCBBACBACBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2484	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
Token: SeDebugPrivilege	1720	svchost_BCAAABCACABCCABBBACBCCAAAACACBABACCAABBCCBABCBBACBACBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4688	4748	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 4688 wrote to memory of 5048	4688	cmd.exe	94
PID 2484 wrote to memory of 1700	2484	svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe	95
PID 4748 wrote to memory of 5144	4748	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 5144 wrote to memory of 1456	5144	cmd.exe	100
PID 4748 wrote to memory of 3528	4748	2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 3528 wrote to memory of 4840	3528	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_b9ec1bba484fd0d9d608b18b4aff3a80_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBBCBCAABAAAABBCABBCACCABCCBACAAACABCAAABACCBBACBABCCCBBCACCCACAACBCABCBCACBCAACACCBACAACBACABAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBBCBCAABAAAABBCABBCACCABCCBACAAACABCAAABACCBBACBABCCCBBCACCCACAACBCABCBCACBCAACACCBACAACBACABAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABBAABBCAABABCCCBAABBCBACCBCBBCABABBBABACBAAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe" start= auto displayName= "UserDataSvc_AAABBAABBCAABABCCCBAABBCBACCBCBBCABABBBABACBAAABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABBAABBCAABABCCCBAABBCBACCBCBBCABABBBABACBAAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe" start= auto displayName= "UserDataSvc_AAABBAABBCAABABCCCBAABBCBACCBCBBCABABBBABACBAAABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABBAABBCAABABCCCBAABBCBACCBCBBCABABBBABACBAAABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABBAABBCAABABCCCBAABBCBACCBCBBCABABBBABACBAAABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCACABCCABBBACBCCAAAACACBABACCAABBCCBABCBBACBACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAABCACABCCABBBACBCCAAAACACBABACCAABBCCBABCBBACBACBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
1⤵
- Executes dropped EXE
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f4fd9ca986fd13c7034e7b8d88e9d06e6987def139052097c88baa0aa434bef
MD5 bf1b22d6ce5da1dcfad6ac511103d02f
SHA1 09339aa0a64eecb61f921a083299759545226381
SHA512 2a200e3d15af34495322dfa9844c85764391399dba0815b14b959c8ae048448332844426d65179d153128424a469ac2302afceda15e5b9354d9e30aa36e2a339
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c0ccbabab7d5652b08ce624fd6d500ff8734f69eea657585f6e1b125ce0476b2
MD5 35a234c6ee4bdde6e10defd184e41a85
SHA1 48dc5c039e72402b9f5457911172aac945c32145
SHA512 9c519274f3f4b4d60b4be0850a0b4154567a6aebaa740217bbe59117e964cb29dcd5ef73f926f5eb8d6c0bfc0d1fbdf08b167c95b8341ae3a2d0e9586f20f5c9
MD5 SHA1 SHA512

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 49.9MB
SHA256 d01d92a0a154aeb140d2944947385b9b2a14373b7ea5002ac1bbd72bb4137952
MD5 f60f43521ca30a899bbc5f7cbb7b00f4
SHA1 1008301c27f0f48c645f57e36373505143f2b63f
SHA512 301ec0bc353907529e12737bbacf49333c1f7e8fb44e51f5e5d3ce176fe68d49ba4a21e6b28750f222e57ba9f5aed98219f452610c7bb5ba816b1f0422b488e4
SSDEEP 196608:kKWQc0gEYnvL9KWQc0gEYnvL9KWQc0gEYnvLlcyp:tcZEIv4cZEIv4cZEIvZ
TLSH
T192B75B0F66EC00A6D87FC275E6E18166C670B431672159EFA190C73D9F6BAD1A93CF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 06e09d405d51693855f3a218bab1eff40975d8699fb4b11ab213b81abb00c599
MD5 367f26567364e22c6725ca43b0888fc8
SHA1 9f0b1d5cdef69dc01279cb6034484410f05bbf84
SHA512 962d7943ebe2ec5d40fcb77aab84585d65f9cec8e4357892c29a5bba29361c260dea215ce1c5bd3cfba204f267050116c7be94f4916b6c223ee42af8c828c28a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 da4c06875248849a62366c72202802159da5501dd3077d18604d1603ff98b6a9
MD5 177f8a99d9484e725739b3ac89f227bc
SHA1 96e8dfaf3efc448dff23f8840aba4df416e3e798
SHA512 358ab3d34fa3d5ba768564667702c2df04e19f686534fad6bb8682a5157c5bf11eb173147468b6ccb51374b11885a99e61d9afdc2f51513aee56691378fe57a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e3ed1e798894b8d6d8844d4af1a820b51ec9284b43a478a2548871ee9b219e6b
MD5 8a0a4efdc6738b11f7294565c61d94ed
SHA1 23a2908bd6713ead40ce397f6f6beeea93055fe3
SHA512 cb9e2b25febb0a80e24880b260f3fa853ef0b257baa5fc982daa8f4873e7412140c4b9582a97e71fb8f95121a85360c079d48dbe719bb1f9f09523dd8319ce16
MD5 SHA1 SHA512

Submit Download

svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBBCCACCBBBBBBBCBCABCAACCACCACCABCBACBBBCBCBCBCAAA.exe
Size 16.5MB
SHA256 e7edfc1e1370721593921c8ff07e8ee4dc8ee51d873dcf731efa61e22e07c3bf
MD5 b9ec1bba484fd0d9d608b18b4aff3a80
SHA1 f4efc1e1cba550b6c6dae75d56b474c7147f5bf6
SHA512 3061a36645e0dbd9ac9ffee40712829fe43cf21ccb77ea6545bce9bef06ff360c7bd798d6a1b6b04ce1417e02614a69758cd033e4e454bed222e52d01ef28dd2
SSDEEP 98304:iryrgr2cryrgr2cryrgr2cryrgr2cryrgr2cryrgr2cryrgr2cryrgr2NKjKWQca:kKWQc0gEYnvL8
TLSH
T185075B0F66EC00A6D87FC275E6E18166C670B431672159EFA190C73D9F6BAD1A93CF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0d9459221905a1696d8e87d6e65a127274b3dd2d4eb6b9916a86735dc20bbbeb
MD5 1e77a69a5d127a4aa3c0c215c035361b
SHA1 38fb6e852792f0291aea80b2dda6f925968b34e1
SHA512 3332f7d8b3bbb7e3056e31143aa0846eee2f0b284d74cb1d4c1d8167b53a4d2b0f84378d078dd5226edc99f7756ae04371423d7e923cb59e0519f4b9540566b7
TLSH
T19911C860B4A5DC53E93368DB662FDAC20CA43AAB5C586A2C2309821A6745C738D11CD2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2484-49-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/2484-71-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/2484-34-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/4748-0-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4748-61-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4748-35-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4748-23-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4748-12-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download