fdb11cf40dd0b18aeec3b6ff8c97d3f6afac00ab56b58cac7907677c56842f17

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 9.0MB
Sample260816-j3qbmscb76
SHA256 fdb11cf40dd0b18aeec3b6ff8c97d3f6afac00ab56b58cac7907677c56842f17
MD5 369c7caab12189834475a34613773b57
SHA1 4aeb768e3b9fd3c7314ec9914eed40bf313e01db
SHA512 014111ffad8a68093b1cde0ddf57c821dff593b3b56c9d36294df92b78bf7df9bed5d3a41c4b1361029db780431e580645a7b81caf15ca13b8f7984e88d66207
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+EFiw2F+ES+E8+ES+ES+ES+E7+ES+ES+ES+EFiw2FK:wKjKWQckVgtev5mnlNL
TLSH
T156965C09F9870471D97B51B04CDBD2BE8A70BA1187328EEBE649C72F6933BE16834715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1572	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
2260	svchost_AABABCBCBCBBBAAACBBAACBCAAAACCCAAACBABBBCCAAAACCCAAABAC.exe
3184	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABCBBCABCABBCCACBBCABBCCAACBABACACCBCCCCABABBCAABBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe"	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCAACBCCBCCBBBABBBABCBCACBCBCABCBCAABBABBBCCCCCACAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABABCBCBCBBBAAACBBAACBCAAAACCCAAACBABBBCCAAAACCCAAABAC.exe"	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4156	sc.exe
2300	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3688	cmd.exe
1596	cmd.exe
6120	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABABCBCBCBBBAAACBBAACBCAAAACCCAAACBABBBCCAAAACCCAAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3452	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3452	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3452	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3452	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1572	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
1572	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
1572	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
1572	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
2260	svchost_AABABCBCBCBBBAAACBBAACBCAAAACCCAAACBABBBCCAAAACCCAAABAC.exe
2260	svchost_AABABCBCBCBBBAAACBBAACBCAAAACCCAAACBABBBCCAAAACCCAAABAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1572	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
Token: SeDebugPrivilege	2260	svchost_AABABCBCBCBBBAAACBBAACBCAAAACCCAAACBABBBCCAAAACCCAAABAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3688	3452	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 3688 wrote to memory of 5044	3688	cmd.exe	94
PID 1572 wrote to memory of 4504	1572	svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe	95
PID 3452 wrote to memory of 1596	3452	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 1596 wrote to memory of 4156	1596	cmd.exe	100
PID 3452 wrote to memory of 6120	3452	2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 6120 wrote to memory of 2300	6120	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_369c7caab12189834475a34613773b57_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABBCCAACBCBAABABCABACABCBCBBCAABAACCCCCCAAACBACCBCBBABCACACAACACBCCBCABABBCBBBBCBACACABACBBCAAACCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABBCCAACBCBAABABCABACABCBCBBCAABAACCCCCCAAACBACCBCBBABCACACAACACBCCBCABABBCBBBBCBACACABACBBCAAACCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBBCAABABBBACACACACAABAABBCCBACAACCAACABCAABAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe" start= auto displayName= "UserDataSvc_ABBBBBCAABABBBACACACACAABAABBCCBACAACCAACABCAABAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBBBCAABABBBACACACACAABAABBCCBACAACCAACABCAABAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe" start= auto displayName= "UserDataSvc_ABBBBBCAABABBBACACACACAABAABBCCBACAACCAACABCAABAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBBCAABABBBACACACACAABAABBCCBACAACCAACABCAABAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBBBCAABABBBACACACACAABAABBCCBACAACCAACABCAABAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCBCBCBBBAAACBBAACBCAAAACCCAAACBABBBCCAAAACCCAAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCBCBCBBBAAACBBAACBCAAAACCCAAACBABBBCCAAAACCCAAABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
1⤵
- Executes dropped EXE
PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b719c61b69121be65079c1983f2c935163332c16019df01f2eda89374419fc3b
MD5 7b804f29cae1a3ec57d425be7f930a2e
SHA1 dd3f1e7151fce56fefc494a319bac237eaca75b7
SHA512 c1d414371f4e865e52ef0f361393cbddd6bb817566bb6cf0308d8662dcdcbf3a6b8c1f267277b6eb4f08998818c1458d157ce959974716c5c9aacd3b640e7517
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1497d5dce25bcc020885068302bead72629de6775a102a9927fe1e6ad67a66c6
MD5 62af0c049726e8a4e0ec9855caa7f2f8
SHA1 f91623cc6171f3aba14a513ceec81fac1cb4c4ac
SHA512 80e59e301e26f88d9aee5c0bd302c2baca7cbea76f6a525ba4f26656c466f31d4e08cef4fc15dd25d28d49a39933c22f26af7c6265fe01e032cefb371cc89812
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3db919b7c761c6a6ef26f3ff1dfe8c3283a81c20b8a6ec9f1fee1a2a12c040b3
MD5 c9d570cc78ea8f7747f15635940bdc2f
SHA1 60a0d569aeb14d93ef288e4ec9b342c2590951a7
SHA512 b8eb0819df95d3b286ae170edd995cb7e2a055e79610bece6ad8f13379fc6f730fa9d9eff06a23c01a19ac826c81574ef45773c9d35654540c19ca4a720249f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62a05e52d613231a992f7fdab3d76077a20b720129dd5601e9334f90798e7eca
MD5 258fd174047cd0377ae24600dd83af07
SHA1 cc5c7b2989c715ef76bed0558f70965e73a42805
SHA512 946cf614cd987abd54edb676e0a3290b4675eb1598fb1b68663e820642079576f8d8f7665e9c3a2e530f5c00c2fafc7fd6a2a2b1c0e8b863db32a3ad3da29103
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a8c2801f29fb0ad88d50d0034c31f5b815fe530362ecd35e3f614b7043f9867
MD5 f8ae6f5aa3d73e19b41233f8a05350f4
SHA1 40b6fd456dab6ec60df2d00cd270831a7f8d25e5
SHA512 1998dcd2b3926939cc042aed2c554f3f8292bb2c8f98ce8cd2fd90baeee1f8cbc4477867b633b79c50a299e878de84f491c14aaaad02792c5c79304564b41699
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68dcce3c856725ecd6d0561301e1cabfec6be9364385700e06f6d548c1c09fed
MD5 82156ddb515e18fbbfbf06fe46583d48
SHA1 90ef1acd71df0979fa73e4fb60382466869fdfa9
SHA512 b0b1e88979512eb8d388e15c53c339b853fb7b3e286cef9f0272619ca4d1214de8aad72db715828888e15b1e7afe3428aff03cea464a37f5166affb3fe137fdb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa62d0a8ad225ad505f2e12f7f7b09caa573d04b295305ff7587e3cf4a21f132
MD5 e11fdea64c75ed65cac705a6e9c10357
SHA1 d4d361cdb338fa374feebe91e555b4d8d515532e
SHA512 159b52dd614d1eb89f077a0f3bf3230d29a6b588d9a3b04167e70650aa62c7666f0b4ff5f36c9c1fbb08319fa0719edd28bb49a3d5dac11568e33930d36ae510
MD5 SHA1 SHA512

Submit Download

svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBABCCCABBCCBCACCCBCABAABBCABCBBACBABACBACBBABAAA.exe
Size 9.0MB
SHA256 fdb11cf40dd0b18aeec3b6ff8c97d3f6afac00ab56b58cac7907677c56842f17
MD5 369c7caab12189834475a34613773b57
SHA1 4aeb768e3b9fd3c7314ec9914eed40bf313e01db
SHA512 014111ffad8a68093b1cde0ddf57c821dff593b3b56c9d36294df92b78bf7df9bed5d3a41c4b1361029db780431e580645a7b81caf15ca13b8f7984e88d66207
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+EFiw2F+ES+E8+ES+ES+ES+E7+ES+ES+ES+EFiw2FK:wKjKWQckVgtev5mnlNL
TLSH
T156965C09F9870471D97B51B04CDBD2BE8A70BA1187328EEBE649C72F6933BE16834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a56ea9b9105925b7e7b63c7da7799819edfa68b8c821afb8b12aca74c19e426a
MD5 cb14b7979e8e4d55fef8361de7d864a5
SHA1 94fd6bcad84ce20e1d0417a7b0a338c6c3489105
SHA512 a341a11ef2084fc682186be0c21058c51230625854658b5784fdbbf75396bd9a06e7022dfe9187ae5aa3c20fd2a41b566b09e83074c2fdd853950bbe40620654
TLSH
T1B611826195E5D897F9232CCB462EFE831C99379B686C6F182245821DF685C30DE198E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1572-34-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/2260-71-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/3452-8-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download

memory/3452-0-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download