7adfb9e1a0775d2b7ad46497f1c8e8bfc9d2c1c5b9a0af147247314d7864822a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 22.1MB
Sample260813-mlp64aab92
SHA256 7adfb9e1a0775d2b7ad46497f1c8e8bfc9d2c1c5b9a0af147247314d7864822a
MD5 139d972e58b5e28f129092afcbde28cf
SHA1 a82fee66e741dacdbdd5d2290f9eca9f56460bd1
SHA512 f2895b1afa6ea89eb2d5b93bc00550c5213138e2633d4d3e14ac4a5e42b0cac10b2207c4e43fb2940e69c30f720fdf2c246c3f25a387805f0b6a8e4e89f5dbf8
SSDEEP 49152:U+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+EeF:vKjKWQckVgtev5mnlNLl
TLSH
T13C375B09F94344B1D92B50B04DCFD2BF8A60BB2587128DF7FB8DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5352	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
5620	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
1200	svchost_CBCCACCBCBCCBBACBAABCACCAACACABBCCBBCCABCCABACCBBCBAAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACAACACBAABACAACBACCACCBBCBBAAACBBACBBCABABABCCCCAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe"	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACBCBABBCCBCCBCCABAABBBABACBBCABAABAAAABBBCCBCBABBCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCACCBCBCCBBACBAABCACCAACACABBCCBBCCABCCABACCBBCBAAAA.exe"	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5556	sc.exe
6008	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4008	cmd.exe
4464	cmd.exe
4996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCACCBCBCCBBACBAABCACCAACACABBCCBBCCABCCABACCBBCBAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3748	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3748	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3748	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3748	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5352	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
5352	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
5352	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
5352	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5352	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 4008	3748	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	90
PID 4008 wrote to memory of 940	4008	cmd.exe	92
PID 5352 wrote to memory of 2392	5352	svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe	93
PID 3748 wrote to memory of 4464	3748	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	94
PID 4464 wrote to memory of 5556	4464	cmd.exe	96
PID 3748 wrote to memory of 4996	3748	2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 4996 wrote to memory of 6008	4996	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_139d972e58b5e28f129092afcbde28cf_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCAAAAAAABBBAACBAACCBCABBCAAABCCBACABCCABBBCACCABACBBCABACACCAACCABBCBCAABBAACABCABBCCBBAACABBCABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCCAAAAAAABBBAACBAACCBCABBCAAABCCBACABCCABBBCACCABACBBCABACACCAACCABBCBCAABBAACABCABBCCBBAACABBCABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABACACAACBBBBABBCCCABBABBAAACACACBBCACCACCBAACBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe" start= auto displayName= "UserDataSvc_BABACACAACBBBBABBCCCABBABBAAACACACBBCACCACCBAACBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABACACAACBBBBABBCCCABBABBAAACACACBBCACCACCBAACBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe" start= auto displayName= "UserDataSvc_BABACACAACBBBBABBCCCABBABBAAACACACBBCACCACCBAACBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABACACAACBBBBABBCCCABBABBAAACACACBBCACCACCBAACBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABACACAACBBBBABBCCCABBABBAAACACACBBCACCACCBAACBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6008

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
1⤵
- Executes dropped EXE
PID:5620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCBCBCCBBACBAABCACCAACACABBCCBBCCABCCABACCBBCBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCBCBCCBBACBAABCACCAACACABBCCBBCCABCCABACCBBCBAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5145f0e2bfb05e565429268dd2f091269167d97802a2272d0800020a99600278
MD5 9a26c498fb9584244efa20984e0d0d5a
SHA1 b45cacc3f823e02c48ee5ff083c61e3d48c08f1c
SHA512 fe02a8a24adf71df95e5b987b903ce89a6c669b55d082f6ddaee01c9ecd444796242263b662855acdd8ebf5dea7ae6262bfcd1e658a2f91b08cc579c23a380e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b74f77ee4643c8c796bdba1d248e0e694297a94fc44cacce7fc48e3d304d822d
MD5 5fa3cf9977ce5756ea77057c632ff42d
SHA1 c1190a33a922e9d1fdf13d609b17ee14b6c24cb6
SHA512 08e05a046371b2a25016afa84bbaab7b4251954990dfa66bcb1de530b847151bd0438be67ece93d108f66d61d320572c01eb8196d40f6774a8c1e1a073a45a81
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 941f33157420c0b840ba725909d051060b304cb4ac6637592ea62ad59412a3d7
MD5 8e5a7849cb9fbaf980b970092693cc8c
SHA1 fb0385be2af8bf676a8e64f96a4b48cf2368f7aa
SHA512 8f716d23248354aff48a0162d5e652f0f3ada8d903d0eb19973a4105bea5b05df9bf84c53611410682427f210fe142f48d671a96d1cf348e437d2be150b2a8e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a5a29fa6cb4674a101d66b68c2f6a93348d54042486f0e7169d1b75255fe5f4
MD5 66ae63bcfa31be1c2a1a25fdfb298a99
SHA1 65d982d2aea09f6fd0af20a9679f9d250b040b4e
SHA512 df512f9ea28505e7b420b6cb987f0f0e110a97af186041049ed9d7edb442cc7c2ccf8d35068afcfb4f01f37572356eb822a5ef525a184036feac699c0d1c789b
MD5 SHA1 SHA512

Submit Download

svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCCBBABCCCBAAABCACAACBBABCBAACAABBCACBBCACCBACA.exe
Size 22.1MB
SHA256 7adfb9e1a0775d2b7ad46497f1c8e8bfc9d2c1c5b9a0af147247314d7864822a
MD5 139d972e58b5e28f129092afcbde28cf
SHA1 a82fee66e741dacdbdd5d2290f9eca9f56460bd1
SHA512 f2895b1afa6ea89eb2d5b93bc00550c5213138e2633d4d3e14ac4a5e42b0cac10b2207c4e43fb2940e69c30f720fdf2c246c3f25a387805f0b6a8e4e89f5dbf8
SSDEEP 49152:U+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+EeF:vKjKWQckVgtev5mnlNLl
TLSH
T13C375B09F94344B1D92B50B04DCFD2BF8A60BB2587128DF7FB8DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3748-0-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/3748-8-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/5352-24-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/5352-37-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download