a5e191e312ea9d49942ad726f1a29cf996977c0ee661eb72e7535ecea3322f0f

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 11.6MB
Sample260814-dfmpcaeg79
SHA256 a5e191e312ea9d49942ad726f1a29cf996977c0ee661eb72e7535ecea3322f0f
MD5 e4932c829517f021bfe67400f757f400
SHA1 a04a11e82e6402ead8e96f348b499525b9679c81
SHA512 988345dbe2138602629c5527ce255bc83773a8eece026306a544e1aa4f67b5f860b2d2f3fa9ac484bf6a56f756642f8b0b732cc73d56e612e8b821775aa025b2
SSDEEP 98304:6tdtdtdtdtdtdtdtdtdtkKjKWQckVgtev5mnlNL/:6bbbbbbbbbjKWQc0gEYnvL/
TLSH
T17EC68D1DB2E900E5D8778175C6A6827BD671B4322322DADF6350C63D6F27AE0A83DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2836	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
1784	svchost_ACCCABBCBCBBBBCBACCBAACBAABCCCCBAAABCCCCBBACBCABBABABBC.exe
4176	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCACBAACCCBBCBCBCBCCCBABBBBBAACCBBCABCBBCCCACAACAACCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe"	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABCACCBBCBCBBACACCCAABBCACCCAACBCAAAACBBBABBCBCBBBBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCABBCBCBBBBCBACCBAACBAABCCCCBAAABCCCCBBACBCABBABABBC.exe"	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2340	sc.exe
2232	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3160	cmd.exe
3780	cmd.exe
2644	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCABBCBCBBBBCBACCBAACBAABCCCCBAAABCCCCBBACBCABBABABBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4280	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4280	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4280	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4280	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2836	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
2836	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
2836	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
2836	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
1784	svchost_ACCCABBCBCBBBBCBACCBAACBAABCCCCBAAABCCCCBBACBCABBABABBC.exe
1784	svchost_ACCCABBCBCBBBBCBACCBAACBAABCCCCBAAABCCCCBBACBCABBABABBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2836	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
Token: SeDebugPrivilege	1784	svchost_ACCCABBCBCBBBBCBACCBAACBAABCCCCBAAABCCCCBBACBCABBABABBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 3160	4280	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 3160 wrote to memory of 4592	3160	cmd.exe	94
PID 2836 wrote to memory of 5076	2836	svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe	95
PID 4280 wrote to memory of 3780	4280	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 3780 wrote to memory of 2340	3780	cmd.exe	100
PID 4280 wrote to memory of 2644	4280	2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 2644 wrote to memory of 2232	2644	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e4932c829517f021bfe67400f757f400_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABBBCAACCBBBCAAACBAACCBCCACABCBABABABBCCACACCCBABBBABABCABCAABBCACBBCBCAABAAAACABACBBCCBACBBAABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABBBCAACCBBBCAAACBAACCBCCACABCBABABABBCCACACCCBABBBABABCABCAABBCACBBCBCAABAAAACABACBBCCBACBBAABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACCCCBACBAACABABCCCAAACBACCBABBCBBACACACABCBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe" start= auto displayName= "UserDataSvc_CABACCCCBACBAACABABCCCAAACBACCBABBCBBACACACABCBBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACCCCBACBAACABABCCCAAACBACCBABBCBBACACACABCBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe" start= auto displayName= "UserDataSvc_CABACCCCBACBAACABABCCCAAACBACCBABBCBBACACACABCBBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACCCCBACBAACABABCCCAAACBACCBABBCBBACACACABCBBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACCCCBACBAACABABCCCAAACBACCBABBCBBACACACABCBBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBCBCBBBBCBACCBAACBAABCCCCBAAABCCCCBBACBCABBABABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCABBCBCBBBBCBACCBAACBAABCCCCBAAABCCCCBBACBCABBABABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
1⤵
- Executes dropped EXE
PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb114da58df70dccb2b812acd8869cd8b1fcd860101c3cf2269292e138fe0548
MD5 7a1e299f4fbdfc45888ca00a2aa2d263
SHA1 ea8a6a9507e7dd227da4ad7cc8aca651e7f0d61d
SHA512 a3caa3777e597a0fb5dda32a514f6e8968411a3e24481b9f7cebb9e8242fc769f695a9d43b087e88ec084d9e0225e92b26c3889d12ced2c6fa7339950f041e8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 08995eba500a08f7ce402d9335ea6b85c38354d2ae3524530e4f6b8284e2286e
MD5 5bdd1902e6f797923d56330572f90be5
SHA1 b25987e7b6a610a63054ad97d874c7a1efaececa
SHA512 408864c56709daa5976140e0844eef7ad9bffcd62f141bd371dcded5e2ec125a02a87b63b159003c7390c78c137d2f6951afdbfa03c5a0a353a23cf1d1a44595
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 53ce422490678fde116a8004f91e016d640574acce761a790b0feefde2c63d8e
MD5 aa6965c725bb3146d2d6f63809b0e74a
SHA1 91bffe0e40bc4d55a5a85efa0f061e3913575c31
SHA512 f97f18a746949546affea1e55b4c044c12059e1e94169df5db0e2f1e6b0a5c4461501d0fc890315b67f06d9f993d149b517fbe462a1579b9237293bb334d5640
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e0864dffb3b89e20da17b622416aeab9f87e16518deaa9fd0a21f2ea5e7e627a
MD5 c3890aa1e779bef68fda64e75d24151b
SHA1 eeff98658c783662f7eee9e4b2bcbf44e2a35b35
SHA512 c47df74ec4e60f4ee76a8f3ed5d82985e5726a8aa895a7063f7c2b3b5beb1c51243690df3718b48171e8b9189d1d6c0b0cc62a366d587d7b14e53ab409a9e0f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6d68f82f5f5342382fefa86c5f1cb51690b836001108ecf420d490581e4d5bf1
MD5 bdd04279f4416a68463ecb2da66d451a
SHA1 1f71d8a1d6eff9bfb1b2445991ebe25144ba5d24
SHA512 7ce819ab20a822351bdb0382c76380773775040fe8f489e2d0105c5ae499714bd2e7b0d1b18917636e033e2903384938a8c1f545f78b8289868d7104a3bbb577
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7ab3be5aac35c24a826188c29200efa85a93e7f32182205d68f1afb215abfb72
MD5 af50fb768794913fe67c3dd01621f737
SHA1 315ef3c166536bc70bd1f7b8cff2a252138ac0b1
SHA512 18cd476858a2b641a826f819f918258c1fefac13caa4c7b7f18f2f17181227ab83dc8e6ae74771a86cdac09a5c29ebce886e787add119e8ff8f26ceb6e41b95a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 32e2a681c7a06761e2d31d7af94e86b22926bd800df170f8568f95f27288de04
MD5 7ec399d14b2f2164242f687f77b9afc4
SHA1 1686517446ed223726c61bb6e6b91a4c8563b095
SHA512 9ad9e0f2a703e6e424c09c50ad651aa98671a0d2eb6b74ba01fd566c79c0c77dc8a493f08de6bf22a3fe87a5779e83563ab948513908579cc93baff11b659084
MD5 SHA1 SHA512

Submit Download

svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABCBABCBACCACBACBACABBAAACCBBCCACABCCAABACCABCBACBC.exe
Size 11.6MB
SHA256 a5e191e312ea9d49942ad726f1a29cf996977c0ee661eb72e7535ecea3322f0f
MD5 e4932c829517f021bfe67400f757f400
SHA1 a04a11e82e6402ead8e96f348b499525b9679c81
SHA512 988345dbe2138602629c5527ce255bc83773a8eece026306a544e1aa4f67b5f860b2d2f3fa9ac484bf6a56f756642f8b0b732cc73d56e612e8b821775aa025b2
SSDEEP 98304:6tdtdtdtdtdtdtdtdtdtkKjKWQckVgtev5mnlNL/:6bbbbbbbbbjKWQc0gEYnvL/
TLSH
T17EC68D1DB2E900E5D8778175C6A6827BD671B4322322DADF6350C63D6F27AE0A83DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b7082253cbedbed4e5f8a097c617f3213ea8974e3413fe82d49e46a9897b502e
MD5 326ae914a2b2b9829975e5946418bede
SHA1 74ec2cf710b08eb8d110c13e085c1acfbd91bd34
SHA512 72ca9c5383eed20cec187366e09f0fb5a46421b25679a6bcf3b016954b341b65077c6b121d05016580b1a284dd13946df884dffc17b20bff6b5f5a4de34192b1
TLSH
T16411081164F5CC57EC33A9CA6229CBA218A473DF1418EA00134D422CBB9BC314D254E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1784-64-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/1784-82-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/2836-33-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/4176-84-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/4280-0-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4280-7-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download