979f4a3b4518a3a22e1a4c4ce54e5c270176a5a2cfcd6bafa2d296bdbfe69089

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 18.0MB
Sample260813-lddmnavxfs
SHA256 979f4a3b4518a3a22e1a4c4ce54e5c270176a5a2cfcd6bafa2d296bdbfe69089
MD5 65b302233fce3033ad5aba62e8e449e1
SHA1 176c927dde6809e41f033f203ee5ceec74292e8d
SHA512 1efe1a8e00ddba6ed263b66962e6780fb67951036b69ff30e696787d277b5996cf92cc66c5626021cc41ae6232842ff0bd219ea1bd39faa63868b66d077b8e9b
SSDEEP 393216:gT59T59T5QT59T59T5QT59T59T5QT59T59T5QT59T59T5QT59T59T5QT59T59T5t:gT59T59T5QT59T59T5QT59T59T5QT590
TLSH
T11D175B19B7D21122FBB356718C79D2B27D34BA204730CADFA784B9093D359D1DA3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3512	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
1788	svchost_ABCBCCCCBBABAABCCCCBBCCCABCBBABACCCABCABBBBBBBBBBBBBAAA.exe
1116	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBBCCBBCBACCACCBBAABAAAACACCBAABCCCAABACCBACAACCBCBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBCCCCBBABAABCCCCBBCCCABCBBABACCCABCABBBBBBBBBBBBBAAA.exe"	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBCACBAACCCACBCBACBCABABCBCACCCBCCAACAAAAACCBBCBBACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe"	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4824	sc.exe
2728	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4664	cmd.exe
1216	cmd.exe
6000	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBCCCCBBABAABCCCCBBCCCABCBBABACCCABCABBBBBBBBBBBBBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
244	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
244	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
244	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
244	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3512	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
3512	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
3512	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
3512	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
1788	svchost_ABCBCCCCBBABAABCCCCBBCCCABCBBABACCCABCABBBBBBBBBBBBBAAA.exe
1788	svchost_ABCBCCCCBBABAABCCCCBBCCCABCBBABACCCABCABBBBBBBBBBBBBAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3512	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
Token: SeDebugPrivilege	1788	svchost_ABCBCCCCBBABAABCCCCBBCCCABCBBABACCCABCABBBBBBBBBBBBBAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 4664	244	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 4664 wrote to memory of 5256	4664	cmd.exe	94
PID 3512 wrote to memory of 4936	3512	svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe	95
PID 244 wrote to memory of 1216	244	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 1216 wrote to memory of 4824	1216	cmd.exe	100
PID 244 wrote to memory of 6000	244	2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 6000 wrote to memory of 2728	6000	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_65b302233fce3033ad5aba62e8e449e1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABBBAAAAABBCAAABCACAACCCABACCBCBABBBACBCCBACCBBBABAAAABCAAAACBBACBCCCBCBCBBCCCBBBBAAABBACCBACBBBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABBBAAAAABBCAAABCACAACCCABACCBCBABBBACBCCBACCBBBABAAAABCAAAACBBACBCCCBCBCBBCCCBBBBAAABBACCBACBBBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBAABBBACBBACBCCCBABBBBABCABBCCBCCCABAACCAABBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe" start= auto displayName= "UserDataSvc_BCBBAABBBACBBACBCCCBABBBBABCABBCCBCCCABAACCAABBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBAABBBACBBACBCCCBABBBBABCABBCCBCCCABAACCAABBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe" start= auto displayName= "UserDataSvc_BCBBAABBBACBBACBCCCBABBBBABCABBCCBCCCABAACCAABBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBAABBBACBBACBCCCBABBBBABCABBCCBCCCABAACCAABBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBAABBBACBBACBCCCBABBBBABCABBCCBCCCABAACCAABBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCCCBBABAABCCCCBBCCCABCBBABACCCABCABBBBBBBBBBBBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCCCBBABAABCCCCBBCCCABCBBABACCCABCABBBBBBBBBBBBBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
1⤵
- Executes dropped EXE
PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7a6766dda95852a2c2150e9403d7bfe620b2c09a3db2dc4dc9908885f1e7db58
MD5 5148e4b0c9eb46d60289ce07c40988d0
SHA1 88d0176814a4eeae59834f55f20bc83d2bcb3ab5
SHA512 60f9f83bb2c04e9003c1347bca356d6ad398d6caf4038c2ca2eab9f3e2a182a32fa6ed28633480e5def54fc216a8c99c63240327729a2e8b52dec11560b13671
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b89d41d2433f4ee3418e55556ad0561e6614c95b65e772d90b882da1ecdc97b0
MD5 d9cfa08c8e9e6b9ceb697d0dc2482463
SHA1 9524681aea7a8f23eabe7f9ecc9970a0e508a6dc
SHA512 4da47f4c7895e9c9ac4bc7e601f3714ca464eb3f1f1499e87518fd4fe5208246e1660441236371920b484439f21adb82d8407a42675d2a9d1d281ebeac3dd732
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1001b125fcce293d1154c6aade22c5a8d5f1c7203bb1eacbeb5f0bc31daedc0d
MD5 f9b6b0b9b26d10f2c458dc29dd45fc6d
SHA1 130fb4eeb810fb4cc27d68cbd4ffe53c438197b7
SHA512 e18bf30742f153bdf9d37d13b67f1db323b18ed4695b998bf4ae4f9b1c411f4e9172ab1659b4a23688dc4dc75bf0dca0c8fb6fe868f9da932eb053ce9c671e19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c978915c132296606de55248a5645341497ff38e66ebe63fdc67469a96afd539
MD5 625b66764d00a42d1b2e1c9bfb42236a
SHA1 f71c854b65a5dbdbc64a55e9bd1334a45816a404
SHA512 fa1d16f0c21b0de8a1f526c33474b4780ccdbbd78b389553214b4ebc7d1ceeee0770846f39fd3088a4b280c1d3b4afa2a978d0b8631be7316ca2f2efc4fd40f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7828b2e9406adc23db5cfe6f3a4994869fb3f4415674d0d36c94857a292e2831
MD5 63e21efe46a47cdaeb73ac4cb4f1d638
SHA1 bbe71845763c37943323b1d8e5899afa7a54798e
SHA512 38357d8f3dba2c3c9cf52db94bb56298d7060c84997513b1a66ff4c01481017406f954aaef44345c490bc6a8c188dcbea8b641df7dff0b71a5dab90fb0c577ad
MD5 SHA1 SHA512

Submit Download

svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABCABACCCABBCBBCBABABCCBABACACABBAABBBCACACAABCCCBBB.exe
Size 18.0MB
SHA256 979f4a3b4518a3a22e1a4c4ce54e5c270176a5a2cfcd6bafa2d296bdbfe69089
MD5 65b302233fce3033ad5aba62e8e449e1
SHA1 176c927dde6809e41f033f203ee5ceec74292e8d
SHA512 1efe1a8e00ddba6ed263b66962e6780fb67951036b69ff30e696787d277b5996cf92cc66c5626021cc41ae6232842ff0bd219ea1bd39faa63868b66d077b8e9b
SSDEEP 393216:gT59T59T5QT59T59T5QT59T59T5QT59T59T5QT59T59T5QT59T59T5QT59T59T5t:gT59T59T5QT59T59T5QT59T59T5QT590
TLSH
T11D175B19B7D21122FBB356718C79D2B27D34BA204730CADFA784B9093D359D1DA3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e04d6376dfa7313be2d4565c4aa5ff51b051f5c76ed88ce77a2ee8f80fea9e5e
MD5 eac6ef3dc78136dc30d0361e696ba236
SHA1 89c5510d0ab64348054c6e51978688031d97a0c0
SHA512 496b9ebcac7714c309f410cb03e9a8854af526f3e2636c9123da439e94c28cdb769024a7704471562dc4b6dde7f28481bfff310c46eb072526e7bf2f791b3952
TLSH
T1A91194A1F4E59423ED7228DAB33ACAE30CDD27A7589D6B9812094119E349C774D2D0F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-0-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/244-8-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/1788-79-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/3512-32-0x0000000000390000-0x00000000003B1000-memory.dmp

Download