e792d6ce963ea552411754826028177b9683dc718541b17df84e68f660787305

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 8.0MB
Sample260815-eck7sadf88
SHA256 e792d6ce963ea552411754826028177b9683dc718541b17df84e68f660787305
MD5 62cda794ded62431be11599ec234ebf0
SHA1 e19ec597dab49c2b392b27316de5d6794368aa3d
SHA512 e36208468a4c3630d88eb43b07510ee79c027ee7a1b247a4c2c83bc6bc192098b37c1f689424405898bb81dc157b0c8b6394467aa05a10fe6715613eb9d7481e
SSDEEP 49152:U+EV+ES+ES+E9wq8+EV+ES+ES+E9wq8+EV+ES+ES+E9wq8+EV+ES+ES+E9wq8+ER:XKjKWQckVgtev5mnlNLF
TLSH
T1A5869F10FAE60C22F1FB11B15DF6D5790D31BB6A8234D58EFA9D468F6833B8054267A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4904	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
2868	svchost_AAABCBABBCBBACCCBCBABCACABACCCBABCBABBBBBCBBBBCACBBBBAA.exe
2184	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBABBBCBCBCABABBCAACCCBBACCACCCACABABCCBCBCACBBBCBBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe"	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBCCCCBBCABBABBBACBCCACACBBAACCABABCCCBBACCBAABBBCCBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCBABBCBBACCCBCBABCACABACCCBABCBABBBBBCBBBBCACBBBBAA.exe"	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1004	sc.exe
3992	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4000	cmd.exe
2120	cmd.exe
2560	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCBABBCBBACCCBCBABCACABACCCBABCBABBBBBCBBBBCACBBBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
900	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
900	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
900	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
900	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4904	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
4904	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
4904	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
4904	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4904	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2360	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4000	900	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	103
PID 4000 wrote to memory of 4832	4000	cmd.exe	105
PID 4904 wrote to memory of 2396	4904	svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe	106
PID 2396 wrote to memory of 2136	2396	notepad.exe	107
PID 900 wrote to memory of 2120	900	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	109
PID 2120 wrote to memory of 1004	2120	cmd.exe	112
PID 900 wrote to memory of 2560	900	2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	114
PID 2560 wrote to memory of 3992	2560	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_62cda794ded62431be11599ec234ebf0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAABCABCACABBAAABCABCBABAABCBAAAACAACABCBCCCBCBAAAACAABACCBAABCCBCCCAABAACBACABCBCCBCCCBCAAAACCCCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAABCABCACABBAAABCABCBABAABCBAAAACAACABCBCCCBCBAAAACAABACCBAABCCBCCCAABAACBACABCBCCBCCCBCAAAACCCCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCAACAAABACACAABACCCBBABABCBCACBBBABBCCCBACBCABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe" start= auto displayName= "UserDataSvc_BBCAACAAABACACAABACCCBBABABCBCACBBBABBCCCBACBCABABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCAACAAABACACAABACCCBBABABCBCACBBBABBCCCBACBCABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe" start= auto displayName= "UserDataSvc_BBCAACAAABACACAABACCCBBABABCBCACBBBABBCCCBACBCABABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCAACAAABACACAABACCCBBABABCBCACBBBABBCCCBACBCABABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCAACAAABACACAABACCCBBABABCBCACBBBABBCCCBACBCABABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBCBBACCCBCBABCACABACCCBABCBABBBBBCBBBBCACBBBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBABBCBBACCCBCBABCACABACCCBABCBABBBBBCBBBBCACBBBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
1⤵
- Executes dropped EXE
PID:2184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 496bfee659ba8b251b539791fbdf7cf266cb5ae1dc9c25d0cab9fe0687122da3
MD5 b686278dadeccfd67fb1e5f69407d58f
SHA1 bd4d4d15983c9410605fcff3b10237735c69c8a1
SHA512 91a2c0ce1deaf224fec2496637cc3a7a2be289f9449fb3bdc64043115c770903db901d839e15feaef518ba6275672b0817bf545e235f0bd7e465eb101456f1d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 592865c118f54a1f0b2bbd08383a470c73fb5be99fcbf6f5ff036f93e9313d13
MD5 753b85948191dd1876c03984d238133c
SHA1 4bdf30af964e8fde0a9de5e9c96a7b032e4a3a98
SHA512 9211cc6dcb16d525b4859040ae30bc06ba4f72349d4de8bea32ed80c4ab5cb57e9d1e9a6cb74eb1a3cdfd6b84458ec678052d2e5c718a8c88cc4c8fd80d3b674
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 de7f0fdb7f52c73b7c7dacbe8563ba0c921903dd31857819ab6c8e379b67c061
MD5 1c2f8f99f6c118d09c2a16dbbdd09ca1
SHA1 5b52656708b0536119698fa73a2450fec7ac1434
SHA512 3402a207135b2d4aacf8d2f490409e4be56e6985ac3aea6903729d0eee674f9e2557baf996cd5df32778355cf69866cee85069baf30e2b8119c2516ec570a633
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c26f6d120ccc0fae8206fc712eca569610994e8117ef4b7918a1aaa174328fa4
MD5 1afc2a6fdf3425281825939e25723867
SHA1 6ec0bdfa86f77475880ccc8a8879d3a1de67d954
SHA512 097dc03169e4c543c64708c849247ff197f8fe50ef2f7c84912380079ff1b5b300ceed7cb61a1d08b30169221836f820979137ab0bebec9e5a6fb1861cce9ba6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 15f13771465520e1f165b496fc2dda295e5e4e326f7ca47e57fd7efca16ebe0a
MD5 b80491364d9d846d63d2c2a431d16030
SHA1 0f0be665dc4802c95e129a98d68b0be4e92365c7
SHA512 4bb5a8a703ed656d939dd1f1feb093767efce4787a66ff1070351db7ee237694c08c6818666660426e32bc7ae2d9de6f5a03c523b4949df600ff2783d1484bfe
MD5 SHA1 SHA512

Submit Download

svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACCBBAABBBCABCBBCCCBCBBACABBACBABACBCCBCACABBABACB.exe
Size 8.0MB
SHA256 e792d6ce963ea552411754826028177b9683dc718541b17df84e68f660787305
MD5 62cda794ded62431be11599ec234ebf0
SHA1 e19ec597dab49c2b392b27316de5d6794368aa3d
SHA512 e36208468a4c3630d88eb43b07510ee79c027ee7a1b247a4c2c83bc6bc192098b37c1f689424405898bb81dc157b0c8b6394467aa05a10fe6715613eb9d7481e
SSDEEP 49152:U+EV+ES+ES+E9wq8+EV+ES+ES+E9wq8+EV+ES+ES+E9wq8+EV+ES+ES+E9wq8+ER:XKjKWQckVgtev5mnlNLF
TLSH
T1A5869F10FAE60C22F1FB11B15DF6D5790D31BB6A8234D58EFA9D468F6833B8054267A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-0-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/900-7-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/2396-60-0x0000000005B00000-0x0000000005B01000-memory.dmp

Download

memory/4904-27-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/4904-37-0x00000000007F0000-0x0000000000811000-memory.dmp

Download