36496af09f37a492d07291fa88eff758716c48a1128289068d05b32f7f227ecd

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe
Size 10.4MB
Sample260814-dap8aataqd
SHA256 36496af09f37a492d07291fa88eff758716c48a1128289068d05b32f7f227ecd
MD5 efe02068393aa7c032c6888cfad0ff7c
SHA1 547dd282c1996d6140d7708ca4215bd8a89d22f9
SHA512 85cdc1780276092b23141be1d50d4b104381359266103c8516b0962f0ce91fad66afbdd8747be554244c00bffe8300143dab0b3ae8d714d0ebeef397ce47089e
SSDEEP 196608:BLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLg:PT5JOT5JOT5JOT5JOT5JOT5JOT5JOT5Q
TLSH
T184B66C2576E14122F7F31672A938D2717D38BE241760CAAFA7C4B9093E358C1977B326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4532	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
5044	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
2776	svchost_ABAACABCBACACCABCCCAAABAAACAABCAACAABCCCCCBBBCCACACCAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCCCBAABCBBCACACCBBBACCABACBBAACBABACBAAABBBBBACCBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe"	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABBBACCBBBCAACCBBBCABBABAACACACBBABBACBAACBCAABBAABCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACABCBACACCABCCCAAABAAACAABCAACAABCCCCCBBBCCACACCAAB.exe"	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2320	sc.exe
1232	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1648	cmd.exe
1464	cmd.exe
2668	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACABCBACACCABCCCAAABAAACAABCAACAABCCCCCBBBCCACACCAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2372	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe
2372	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe
2372	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe
2372	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe
4532	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
4532	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
4532	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
4532	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe
Token: SeDebugPrivilege	4532	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1648	2372	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe	92
PID 1648 wrote to memory of 4988	1648	cmd.exe	94
PID 4532 wrote to memory of 5580	4532	svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe	95
PID 2372 wrote to memory of 1464	2372	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe	96
PID 1464 wrote to memory of 2320	1464	cmd.exe	98
PID 2372 wrote to memory of 2668	2372	2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe	99
PID 2668 wrote to memory of 1232	2668	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_efe02068393aa7c032c6888cfad0ff7c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_r.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABBCCCCBCCBBCACBCBCACAACBBCAACCCBCCCACCACCCACCBACABACAACCAABCAAABCCCABBAABAACABBACBCBAACCACBCBCCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBABBCCCCBCCBBCACBCBCACAACBBCAACCCBCCCACCACCCACCBACABACAACCAABCAAABCCCABBAABAACABBACBCBAACCACBCBCCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBAAACAABABABBACBABAACCBACCBCAAACCABBBBACCACBBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe" start= auto displayName= "UserDataSvc_ACBAAACAABABABBACBABAACCBACCBCAAACCABBBBACCACBBABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBAAACAABABABBACBABAACCBACCBCAAACCABBBBACCACBBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe" start= auto displayName= "UserDataSvc_ACBAAACAABABABBACBABAACCBACCBCAAACCABBBBACCACBBABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBAAACAABABABBACBABAACCBACCBCAAACCABBBBACCACBBABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBAAACAABABABBACBABAACCBACCBCAAACCABBBBACCACBBABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCBACACCABCCCAAABAAACAABCAACAABCCCCCBBBCCACACCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABCBACACCABCCCAAABAAACAABCAACAABCCCCCBBBCCACACCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 928a0823c3945615802f386b2b5f98fff0c506fb92c6c63893c0a874be4ccc79
MD5 c4851382a6aeb1a0ce71495f01394b17
SHA1 921db8ef7d477bd27f63d8a52425a4e4f65a8136
SHA512 6443379ee2852651940930e6d80be9fec2241a038d8602b7b118fea0354438d39511dabd1692aadb38ebde021602564933cfed67cde622d61c3116466b08fadf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0abe5ed85cbef6919ef904de3fc11a26ee75a326e5db1cbc1b306103b8ef308f
MD5 776b6ad2f7e74673915c1d8e850932c4
SHA1 e1701fc2c0873f581f72056994bc8fef74bf35b9
SHA512 29fbdf7bb82a7ffdf643a96d6b584605b933c5af7664a5d91a1bf2518dd5eaf499777490d2fa12d2408a1a36ca65c864dbe801fedb6aba79a2945219ed1a7fdf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74193707a5bccd7e908820c9453f1adc068fcb0113f9715432b643c932e0e25e
MD5 b2945b4a312410122b176992182714a9
SHA1 f2c4057034fdd95d3ba30d4c83bc7f5d0a1ac522
SHA512 37f7c9f5df454c1c1525edf247612c3f9c19222b7f7b5b05c46e091a71e1f7099903b5bcc7612c2f7c9847fc1c75499e6e8857fb9bd0e6f7f45d4b09a6adc7da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 380c0678a809bff84fdf92503bf5662c7a6b2e95cc7cbf24804ff0e0f911cee6
MD5 d3610570aab4c799f17bcdd2653174d9
SHA1 de186cae4a3370b48fdf006082612d0677048cf0
SHA512 0618db883aa17f3721a807aa4ead6914ebf57710bb7d839558413c4ffe68f39de6e2fe31f13119bfb8010b08f962857063edb0222c405bd3d60249487cf0b143
MD5 SHA1 SHA512

Submit Download

svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABCAACCBAAAABBCBCBBCCCCCBACAACACACBCBCACACBBAABCBC.exe
Size 10.4MB
SHA256 36496af09f37a492d07291fa88eff758716c48a1128289068d05b32f7f227ecd
MD5 efe02068393aa7c032c6888cfad0ff7c
SHA1 547dd282c1996d6140d7708ca4215bd8a89d22f9
SHA512 85cdc1780276092b23141be1d50d4b104381359266103c8516b0962f0ce91fad66afbdd8747be554244c00bffe8300143dab0b3ae8d714d0ebeef397ce47089e
SSDEEP 196608:BLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLZaLZT5DLg:PT5JOT5JOT5JOT5JOT5JOT5JOT5JOT5Q
TLSH
T184B66C2576E14122F7F31672A938D2717D38BE241760CAAFA7C4B9093E358C1977B326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2372-0-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/2372-7-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/4532-24-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/4532-37-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download