ad49caf79ade91e060bacc620692ba887d47d41e2f9a447dfba7072126464e2c

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 18.1MB
Sample260814-e77z2avcra
SHA256 ad49caf79ade91e060bacc620692ba887d47d41e2f9a447dfba7072126464e2c
MD5 47288fc958f58c69e8874c973acddd5c
SHA1 f0f9083909c06704e6500f2bb1607d5e390f439f
SHA512 29c7858558784d94154a0f5547068fc383efd5a3af715d0ac794e4b6f2daaf142ef6834b3740004d047759cdfb9173ea710d6447fefcf6ac939a2cb0b5c9d60b
SSDEEP 49152:U+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EzXpo:MKjKWQckVgtev5mnlNLP
TLSH
T194173C05F98340B1D92B11F10DCBE3BF8A61BB2186228EF7E74DC75BB932FA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
5672	svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
2196	svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBBCABAACBBABBACBACAABABBACAABABACCCABBCBBCCACAABCABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe"	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2872	sc.exe
5752	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3092	cmd.exe
1656	cmd.exe
1608	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4920	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4920	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4920	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4920	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5672	svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
5672	svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
5672	svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
5672	svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5672	svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 3092	4920	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	93
PID 3092 wrote to memory of 3904	3092	cmd.exe	95
PID 4920 wrote to memory of 1656	4920	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	96
PID 1656 wrote to memory of 2872	1656	cmd.exe	98
PID 4920 wrote to memory of 1608	4920	2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	99
PID 1608 wrote to memory of 5752	1608	cmd.exe	101
PID 5672 wrote to memory of 2136	5672	svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_47288fc958f58c69e8874c973acddd5c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCAABBABCABACABBCCCABCAABCBCBCBCBBCACCCCBABABBBCAACBAACACCCAABABCABACABBBBCCAABBBBAABABACCCCCCABACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCAABBABCABACABBCCCABCAABCBCBCBCBBCACCCCBABABBBCAACBAACACCCAABABCABACABBBBCCAABBBBAABABACCCCCCABACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBCAABBAAABBABAABBABAAABCCAABBBBCBAABABABCCBBCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe" start= auto displayName= "UserDataSvc_CACBCAABBAAABBABAABBABAAABCCAABBBBCBAABABABCCBBCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBCAABBAAABBABAABBABAAABCCAABBBBCBAABABABCCBBCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe" start= auto displayName= "UserDataSvc_CACBCAABBAAABBABAABBABAAABCCAABBBBCBAABABABCCBBCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBCAABBAAABBABAABBABAAABCCAABBBBCBAABABABCCBBCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBCAABBAAABBABAABBABAAABCCAABBBBCBAABABABCCBBCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
1⤵
- Executes dropped EXE
PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bec7c8f96f161f1d959c959303127f46c6fce3bbb611758d674ee9c5d575a683
MD5 5b3580093ed0221b9a39becc22592511
SHA1 e9daadb26f11eb6a3a963558c6ce17f23b05a1cb
SHA512 41435ea1ec00dbd24cd0113877f4fe6930dc764f1d6e1765a02a3d5c0afb750adc53af4d0ef2040921224ed1d1bc9880537c1c33769ff4c0686aadcc50026bcd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6bf4befbcafecfb7152ae87317b7c65d0c122581f7cc170b82748a658e26e70
MD5 e2441658f8fa9c045b8f6ed1bcd04a22
SHA1 a38408b8da63a90b8a40742125d4d9ca721cf3d7
SHA512 ee5e808b833c9d80656149dfa6c7a0cce18bdaff6b0422d58422f645ab7d2274515c3c8617538a832f5cfbdc828fb469079b3323c57570ccb83ab087a6314065
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79f0793014dd978385181d9242d272155c637f2c5eb4a3630b1c4ac0599c24de
MD5 15fd26e0549eacd0cf1da50c0d836549
SHA1 f39a09d0424d4c6d47e560cd245b806ce174b72d
SHA512 b91e062e3c30d490234fa06ee08def65352d315eeb81631649b426f7105f80e7e5dd8355ef683a092e0e94715e74cc76a9194b5c490ce09b8e226ac6857a332f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e255dbaffb325618e8b2889a7f492c2aa467b6a5f5be73c6267543850f6418f6
MD5 24d5b08e8db3cee052a9d73d7aa58c7c
SHA1 615e17c42e20f4bd17df83b9c456cb085e30e70e
SHA512 533528da7558724031ff1093c5d4e0172aba85298bdc3d191392c21a30c6b45c37e777a689ca3ff53fe792410d984eec4fb4ba6eb60a387fda1f42a823e2b824
MD5 SHA1 SHA512

Submit Download

svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBCBCBBBCACCABAAABABACCAABCACBCABABABACBBBCCACBBACB.exe
Size 18.1MB
SHA256 ad49caf79ade91e060bacc620692ba887d47d41e2f9a447dfba7072126464e2c
MD5 47288fc958f58c69e8874c973acddd5c
SHA1 f0f9083909c06704e6500f2bb1607d5e390f439f
SHA512 29c7858558784d94154a0f5547068fc383efd5a3af715d0ac794e4b6f2daaf142ef6834b3740004d047759cdfb9173ea710d6447fefcf6ac939a2cb0b5c9d60b
SSDEEP 49152:U+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EN+ES+EzXpo:MKjKWQckVgtev5mnlNLP
TLSH
T194173C05F98340B1D92B11F10DCBE3BF8A61BB2186228EF7E74DC75BB932FA15428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4920-0-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/4920-8-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/5672-24-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/5672-37-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download