58c26ac26188caafabd4a8f5fb345d6cb2761a993ba385c59de25ce629c1993a

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 18.0MB
Sample260813-ffxknazzdw
SHA256 58c26ac26188caafabd4a8f5fb345d6cb2761a993ba385c59de25ce629c1993a
MD5 5f97a5539e4805a2a7c79aabab5b0ed2
SHA1 da3a943d160127f95e5aeade14c8ec91f5579a10
SHA512 2e54961a49dccf95592377789964ccc78fe0f9fbb2c89243c357aa3ec552f53e00ac1622657017166013052d34faab2c3ef7108e362531b019d9ed9d153c94bd
SSDEEP 98304:NtstststststststkKjKWQckVgtev5mnlNLs:N+++++++jKWQc0gEYnvLs
TLSH
T158175D0DF98600B1D93B51B089DBD27FC670B62543128EEBF749C77E6A27AE16838711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1588	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
960	svchost_AACCABBBABBABBCBCCBBABCBBACBBBCACABBABACBAABCACABABCABA.exe
5752	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCBAAABCCACBCCBCAACBBCABAAABBACACCCCBCCCBBBCABBBBCCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe"	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCACCAABCBABBBCBABCBCAACCABABABBCCCCAAACAABCCABABBBABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCABBBABBABBCBCCBBABCBBACBBBCACABBABACBAABCACABABCABA.exe"	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1216	sc.exe
1604	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3048	cmd.exe
2664	cmd.exe
4516	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCABBBABBABBCBCCBBABCBBACBBBCACABBABACBAABCACABABCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4144	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4144	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4144	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4144	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1588	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
1588	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
1588	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
1588	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
960	svchost_AACCABBBABBABBCBCCBBABCBBACBBBCACABBABACBAABCACABABCABA.exe
960	svchost_AACCABBBABBABBCBCCBBABCBBACBBBCACABBABACBAABCACABABCABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1588	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
Token: SeDebugPrivilege	960	svchost_AACCABBBABBABBCBCCBBABCBBACBBBCACABBABACBAABCACABABCABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3048	4144	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 3048 wrote to memory of 3312	3048	cmd.exe	94
PID 1588 wrote to memory of 5244	1588	svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe	95
PID 4144 wrote to memory of 2664	4144	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 2664 wrote to memory of 1604	2664	cmd.exe	100
PID 4144 wrote to memory of 4516	4144	2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 4516 wrote to memory of 1216	4516	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_5f97a5539e4805a2a7c79aabab5b0ed2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACCCCCCCCABBBCBABCAAAACAABBACBCACCBCCACBAABBBBACBCABCCBBACABCCACBACCBBBCABAACBABCAABBBBBBCCBACCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACCCCCCCCABBBCBABCAAAACAABBACBCACCBCCACBAABBBBACBCABCCBBACABCCACBACCBBBCABAACBABCAABBBBBBCCBACCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABBCCAAACBBAABCBBBCBBCCAACABBBCACAABACBBBBABBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe" start= auto displayName= "UserDataSvc_AAABBCCAAACBBAABCBBBCBBCCAACABBBCACAABACBBBBABBABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABBCCAAACBBAABCBBBCBBCCAACABBBCACAABACBBBBABBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe" start= auto displayName= "UserDataSvc_AAABBCCAAACBBAABCBBBCBBCCAACABBBCACAABACBBBBABBABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABBCCAAACBBAABCBBBCBBCCAACABBBCACAABACBBBBABBABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABBCCAAACBBAABCBBBCBBCCAACABBBCACAABACBBBBABBABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCABBBABBABBCBCCBBABCBBACBBBCACABBABACBAABCACABABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCABBBABBABBCBCCBBABCBBACBBBCACABBABACBAABCACABABCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
1⤵
- Executes dropped EXE
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c84a3f42981a98bf5a415c691b90fb5575600c9ca283111bf31f0efd002c5cdc
MD5 bcdac6bfdae4bc5fbfe3845dc18b7f1d
SHA1 af5d86aa3da1bdd841fc42a7e7a4f753c511f74b
SHA512 ed02bb9b5b777114049aef33253b4d26eefb2c0be01d796924e4287e554c5fd769fbec494792b4ea927b1060c45f79b84a0349091eab16107ac33d9211ee4056
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bc29ad4667e3d08e3ef5b9485b7f784a3e607e9fdd7bcfa89f041b54cd0574b7
MD5 6d80107e855551fbe5e72e49e99ad6e5
SHA1 d560803396051cd0c97970c4681265b9fe2e825f
SHA512 89fb90bc6738896ea5fc2db8f6b78e831d850a516fe93dafc18177cd0608b9905b12991875b7d35f83362b0586529b72a9378ca881cd0d4093d5323d7f7f7771
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c27c773f780d058e1b626c10ae02afcbd1758a09715b567ca9ce83560dfdc9f
MD5 7e888278837d49a85298241f885bcba6
SHA1 f7c56a51722fa13b119addc9deb736d68b0c3bd8
SHA512 ed98521bead210046fdae0f3fc20f04fceb78ae43b94634a72ae7c0845414fef5030ade2e0167c2f00877f57b79311cc3333f107b9f9818ab22f56e4fb321a18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c02c6abc9dc228079db87b551aa40e053f34fc38c54f1b67062b5893fca9e0a3
MD5 eacf123a36e95fecaf78419e642b8d8c
SHA1 9afe7fb1a17a21d7e0524c0177c4534f4a99197e
SHA512 35d23a09526ae6660af180b8b5815bc8c2b4e601875019ef1b3e3599304f6461d70871b2981971c933665b2c9417985000c36ad17146085306f0f55d291bd3ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 240f2d1ba30999c9671e3eb1cedfe362e7726087b65d4da60ea9350e08d3a110
MD5 2a98ca66bfbf44ca89eb3d4e9559a281
SHA1 39fd117d9000ce62f2609af489148b4b01afab9c
SHA512 b6d2bd2c4465de89a4e3e717d7068b7501a4dfb3c35801a6a516738ef28552f6058ed275f8ac13402ef5a47944a9544d0b89f2938aad35a6c85895401ea76910
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7ce6db721a06a30d6c402c0166764e4c1056592c92152c247ffbf29958433c87
MD5 445c51857c4fb972db5cf6ffa9dcfcd2
SHA1 eab7ddfaa108f27d01dc7bd84ecf8660bbe7178f
SHA512 eb6c744c16f5b942d9b3e0418509b039fb98665570cf8183dede01e4ff485aa6634fada58f79a781a9bc0d80e951eebe0be57cc4e7b08829c0d35ec8423117e9
MD5 SHA1 SHA512

Submit Download

svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAABBBCCCBCCCCBBCBCBBBCBACABBABBCBCACAACCBCCCBBAABAC.exe
Size 18.0MB
SHA256 58c26ac26188caafabd4a8f5fb345d6cb2761a993ba385c59de25ce629c1993a
MD5 5f97a5539e4805a2a7c79aabab5b0ed2
SHA1 da3a943d160127f95e5aeade14c8ec91f5579a10
SHA512 2e54961a49dccf95592377789964ccc78fe0f9fbb2c89243c357aa3ec552f53e00ac1622657017166013052d34faab2c3ef7108e362531b019d9ed9d153c94bd
SSDEEP 98304:NtstststststststkKjKWQckVgtev5mnlNLs:N+++++++jKWQc0gEYnvLs
TLSH
T158175D0DF98600B1D93B51B089DBD27FC670B62543128EEBF749C77E6A27AE16838711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 47d03f4f6bac334c04452a0c9fc7bf9e1b255620bc992066b375b651af99b600
MD5 9eea30ba670ba0b72f6015196efb8d38
SHA1 18cce78f2e65969b62c194cf1c14ceae28a6fcaf
SHA512 829fb11f3a647217eaa9e19611dc219820421d17398429da568c5ca9f685b848dd48cfb78459acd624abcec551e44835d33107fab00556b3acb6be3b6252738f
TLSH
T1E0110800E8F5CCC3E831688B673ADBD208A8739B649C7A0822CA011DA785D73CD590D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-74-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/1588-34-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/4144-0-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/4144-8-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download