f66552c9bb3252229ceea1c0c2d69e919ba83244747d9460b3536e448f366039

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 7.7MB
Sample260815-eeh57sybph
SHA256 f66552c9bb3252229ceea1c0c2d69e919ba83244747d9460b3536e448f366039
MD5 5d1c788d436828790f19e4d0311c5359
SHA1 626e45e2d11983cff4fc49106221aafa8869fa01
SHA512 91729a53ac88b26fd908df37e2c8dd42e41c0493468c7945ca247df9c1d4041fde80a43347e0fe0dc9f942ae0a94e4de9ad6798babf5fd6a954ba2b3717e8226
SSDEEP 49152:U+ES+ES+E2+E+hOeV+ES+ES+E2+E+hOeV+ES+ES+E2+E+hOeV+ES+ES+E2+E+hOr:cBBBBBBBBAKjKWQckVgtev5mnlNLY
TLSH
T187866D09F6DA00E5E877557049ABC27A8931BD314721CDEFE684C67EAD33BD0A934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3936	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
5140	svchost_BABACCBACCABCBCAABBCCAABCACBCABCBBCBCCBBAABCABCBBACCAAB.exe
4976	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCACCABBCAAABAAAABBABBBBCBBCCABBCACCBCBAABCAACACBAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe"	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABACCBACBCCACACACBABBBCAABABCBAABBABCAABCACCCACCCAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACCBACCABCBCAABBCCAABCACBCABCBBCBCCBBAABCABCBBACCAAB.exe"	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2288	sc.exe
4564	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1260	cmd.exe
5940	cmd.exe
4780	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACCBACCABCBCAABBCCAABCACBCABCBBCBCCBBAABCABCBBACCAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5892	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5892	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5892	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5892	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3936	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
3936	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
3936	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
3936	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5892	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3936	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 4780	5892	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 4780 wrote to memory of 3516	4780	cmd.exe	94
PID 3936 wrote to memory of 4436	3936	svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe	95
PID 5892 wrote to memory of 1260	5892	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 1260 wrote to memory of 2288	1260	cmd.exe	99
PID 5892 wrote to memory of 5940	5892	2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 5940 wrote to memory of 4564	5940	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_5d1c788d436828790f19e4d0311c5359_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABBBBCCAAAABBCAAACBACAABCAAAACABBBABACAAABCAABBABACBBACACBBBBACCACACCACCACBAACBCCBCBCCBCBABAACACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABBBBCCAAAABBCAAACBACAABCAAAACABBBABACAAABCAABBABACBBACACBBBBACCACACCACCACBAACBCCBCBCCBCBABAACACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAACAACBABACAABBBACBBBACBBACBBCBCBCABCBABACCBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe" start= auto displayName= "UserDataSvc_BACAACAACBABACAABBBACBBBACBBACBBCBCBCABCBABACCBCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAACAACBABACAABBBACBBBACBBACBBCBCBCABCBABACCBCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe" start= auto displayName= "UserDataSvc_BACAACAACBABACAABBBACBBBACBBACBBCBCBCABCBABACCBCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAACAACBABACAABBBACBBBACBBACBBCBCBCABCBABACCBCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAACAACBABACAABBBACBBBACBBACBBCBCBCABCBABACCBCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCBACCABCBCAABBCCAABCACBCABCBBCBCCBBAABCABCBBACCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCBACCABCBCAABBCCAABCACBCABCBBCBCCBBAABCABCBBACCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
1⤵
- Executes dropped EXE
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 411de3225e89f231c69ab1f0553a2e9932c68bd11ef55b027186f1284f2880d7
MD5 c9a298bf8cc23b76e0c4fcb63f32a5a5
SHA1 2789d516241bdcc6751235ecc3433a269757aa59
SHA512 6edbaf90ba757c0ca63e179167858608eabb1301753bcb7b79fbae1df9fec653a8ffdf05cf93add55ebd67d1928007ca985dbd49f76c3bd3f3e43aae3a266df6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0dda07f0350a0fb50968549502d61212ff19d1454e113401cf54ba5b411647d
MD5 6fb8f8c5ef6489c3d294a54a66a46366
SHA1 e4840fb55d00fe2adb8d79d8e2ace1ed1f96cc38
SHA512 293e9a4715b4fe50deff200c88787caa687c277e622a8e8480222476dbae703a4855620a9681acd5752bd1e14ca0111a811559d0d9a7476e37f77612add04627
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8005e3d0a411ea586a5fa306b3f057793d5d0722159987cb7bd57e1b0e07dfc4
MD5 45d014b65fa56390e7548babeb62816a
SHA1 e73cd714af3d8ce97e6f4fe91017fd97b5c201dd
SHA512 d77316414823a255c0fd6f37722c1b7ea572a0ad5d92e360acba531ee23832db71f8b4ae52d7db4764e5a063b2af08c3b1e1a9def88420d73134310722f13fc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6b976f4fc9613da2967506851fc37e6675fc9e8613ac4c774a6b5f67d559567d
MD5 fbe79a9ccfbe08cb4b2033e63d8cdc02
SHA1 f00d44901256afcb341c4feb3fb288b5e534ee52
SHA512 9ee87749b456f1e27fb0c0aec543f5634b6ae6a84c5f7c409855be90c3cba77cfe67e8ee6f5243fab616c561484c9498a337e3004813c41e9e687ac955d1d91e
MD5 SHA1 SHA512

Submit Download

svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCAB.exe
Size 7.7MB
SHA256 f66552c9bb3252229ceea1c0c2d69e919ba83244747d9460b3536e448f366039
MD5 5d1c788d436828790f19e4d0311c5359
SHA1 626e45e2d11983cff4fc49106221aafa8869fa01
SHA512 91729a53ac88b26fd908df37e2c8dd42e41c0493468c7945ca247df9c1d4041fde80a43347e0fe0dc9f942ae0a94e4de9ad6798babf5fd6a954ba2b3717e8226
SSDEEP 49152:U+ES+ES+E2+E+hOeV+ES+ES+E2+E+hOeV+ES+ES+E2+E+hOeV+ES+ES+E2+E+hOr:cBBBBBBBBAKjKWQckVgtev5mnlNLY
TLSH
T187866D09F6DA00E5E877557049ABC27A8931BD314721CDEFE684C67EAD33BD0A934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3936-24-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/3936-34-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/5892-0-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/5892-8-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download