d3c474196180b17445cc803afceddc097846d4a821a8c1a76b706b8b917193c2

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 10.9MB
Sample260816-kd8x5atdrf
SHA256 d3c474196180b17445cc803afceddc097846d4a821a8c1a76b706b8b917193c2
MD5 19cd9ca06ef6370ca97d14a2213c8911
SHA1 7bd1504bccc317dee22e55bb939fe90942f99d9b
SHA512 e5743b53c44d522fa8e9ed8eff59b90a090540b811f661e6df3397c7b48c91ed8615cd69a9cc5457262e1f737f8431bc080c295302eab00ecf080a95bee647da
SSDEEP 98304:gKRBKRBKRBKRBKRBKRBKRBKRBKRGKjKWQckVgtev5mnlNL4:gqqqqqqqqCKWQc0gEYnvL4
TLSH
T160B6AF02F6C544B1E97321700D9BD3BE9579BE204B218DEFE748662F6A32FD1593831A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1240	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
852	svchost_AAAAABAAABACAABCCCCCABCCBCACABBCAAAAACBCACCBAABCBACBABB.exe
3464	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAACCCCCCCCACCACCBCAACABBBBBCCBACCBBABCBCACAABBBCBCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe"	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBACABCABBCCBCBBBBCBBCBCBACACABBCBACAABACBABBCCBABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAAABAAABACAABCCCCCABCCBCACABBCAAAAACBCACCBAABCBACBABB.exe"	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2376	sc.exe
4384	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4084	cmd.exe
1232	cmd.exe
5432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAAABAAABACAABCCCCCABCCBCACABBCAAAAACBCACCBAABCBACBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4568	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4568	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4568	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4568	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1240	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
1240	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
1240	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
1240	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
852	svchost_AAAAABAAABACAABCCCCCABCCBCACABBCAAAAACBCACCBAABCBACBABB.exe
852	svchost_AAAAABAAABACAABCCCCCABCCBCACABBCAAAAACBCACCBAABCBACBABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1240	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
Token: SeDebugPrivilege	852	svchost_AAAAABAAABACAABCCCCCABCCBCACABBCAAAAACBCACCBAABCBACBABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4084	4568	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 4084 wrote to memory of 4172	4084	cmd.exe	94
PID 1240 wrote to memory of 2596	1240	svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe	95
PID 4568 wrote to memory of 1232	4568	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 1232 wrote to memory of 2376	1232	cmd.exe	100
PID 4568 wrote to memory of 5432	4568	2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 5432 wrote to memory of 4384	5432	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_19cd9ca06ef6370ca97d14a2213c8911_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBBAACBBACAABBCCCACBAAABACBACBBCCBABCAABABBAABBABBBABBBACCCCCABABBABBCCCABCBBABABABBAACAACBCACBBCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABBBAACBBACAABBCCCACBAAABACBACBBCCBABCAABABBAABBABBBABBBACCCCCABABBABBCCCABCBBABABABBAACAACBCACBBCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABACBAAAABBBAABBCABBAACAAACBCCCCBAABBAABBACBBCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe" start= auto displayName= "UserDataSvc_CBABACBAAAABBBAABBCABBAACAAACBCCCCBAABBAABBACBBCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABACBAAAABBBAABBCABBAACAAACBCCCCBAABBAABBACBBCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe" start= auto displayName= "UserDataSvc_CBABACBAAAABBBAABBCABBAACAAACBCCCCBAABBAABBACBBCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABACBAAAABBBAABBCABBAACAAACBCCCCBAABBAABBACBBCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABACBAAAABBBAABBCABBAACAAACBCCCCBAABBAABBACBBCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABAAABACAABCCCCCABCCBCACABBCAAAAACBCACCBAABCBACBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABAAABACAABCCCCCABCCBCACABBCAAAAACBCACCBAABCBACBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
1⤵
- Executes dropped EXE
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1358d389144925d9183da302547e96ff1dd83274381f7fa9f5fa94ebe01d412
MD5 3af889c3aba1d30374cf0c51cd6ac341
SHA1 ef820ac4646f6308be3b5ae2e8fa578bda3580fd
SHA512 bb37ea1d33e420c6934764ee22a87369403a023910232f64cd131cb6f10ccdd26058e38bd0d79c9c88eafb7948749339cda21d3a9a2e8c35dcb63cfe94cbaa24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5975042ef6dc1683273d174d0dda100e96559fa1d408be384977bd1f3a7e5a8b
MD5 ec28533b89ff332216c3b68b384f60c2
SHA1 9845ad21c4a131e2854dd8116ebe8766632948e7
SHA512 f40b684d1c0e47393fbd14839d9150e7feca51573901d0145974a3657f12caf01171fc5cfe074765c443805bce41c24acf7a9c082b37eac427be768c41c182b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1824d08cbfe8bac8b94e26122017cb35921791052ae975c3bc655fbfc731217b
MD5 3bc5de24cd401694e93ef53e8a4a8289
SHA1 57107301b8002436b7d6c52e53f6ae375e4da914
SHA512 27260fd6eba2d606ba1e4fac0657e9fb88106be8fcb2feae0aa245e4dd65381feb769cca92fcd8f1b75b9012ed40722d1506e0135f03c94debebffa5df1fa720
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35b4e4019fda0a4655076a94399bc7d534d6f1a28fdea14be6d65ab22a79c4b1
MD5 2fdcb6ebf9c4a8622907db2c14b5483b
SHA1 a71a704c9c9a428caea40beaf12ff387d95ce6a8
SHA512 13a7339996524b1e8f60a92e2c80b2a1aa2f7ff657c9f3b8c81bc9d74be439f26c61f337772499865bf7cc5fd5b371a8ca00fa5159e03a6fdafad06eb3c39985
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9a6dd74a3a08edd7f89efcf770636b05c7c7cd45e3f719119bd876ab3295792
MD5 40074a7a1786bd389f6f92efcfd188dd
SHA1 67a82c73b645f19fb5d0ae7ba839d74e6776871a
SHA512 fbc8304cf196bb7b61bcf7459fb9fe02809949028ee1e44780c774092bae00f3cf52541c361a84daab2d0df27b06584b1e883fe08e697bc09794c6bcb1168500
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8bd15cff54f72efa1b59c59c912d134d1968a3bfb550be4edde0c70b843cb6d3
MD5 02d4b9462d22302ac691fade990e95f1
SHA1 9fe193bcdcbd458c8ff71a9c2cf803a21b2e5d93
SHA512 c196bc447cfadb88281cc28fc257accf8762fc3ed66ef90e8aec99c8e9dd7bc91d18b178ff731b34d40cd5b0d8891673af466a8f76c10c715cc6114cbbe3d94b
MD5 SHA1 SHA512

Submit Download

svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACBABACBCBACBBBCCBCAAABCCCCCBBCCCCACCBAABBABCCBCA.exe
Size 10.9MB
SHA256 d3c474196180b17445cc803afceddc097846d4a821a8c1a76b706b8b917193c2
MD5 19cd9ca06ef6370ca97d14a2213c8911
SHA1 7bd1504bccc317dee22e55bb939fe90942f99d9b
SHA512 e5743b53c44d522fa8e9ed8eff59b90a090540b811f661e6df3397c7b48c91ed8615cd69a9cc5457262e1f737f8431bc080c295302eab00ecf080a95bee647da
SSDEEP 98304:gKRBKRBKRBKRBKRBKRBKRBKRBKRGKjKWQckVgtev5mnlNL4:gqqqqqqqqCKWQc0gEYnvL4
TLSH
T160B6AF02F6C544B1E97321700D9BD3BE9579BE204B218DEFE748662F6A32FD1593831A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5c43913c4e224ca0b0600b4c339a3f945933585a5e147b2a7d80a99f9ea606ee
MD5 53dbfada9bdbd1c1ed4bd92a4878bfbb
SHA1 751c40ffc50605f4b745ae81db133cbb9e5eec9a
SHA512 74fc0b1c586ca804946ab4909215273d1243efbddfa1f415bc0b7468ccea60df17a5a7f2e1a491665e57d88d00e2c2e5d2942400ccb4dc6976f20eb0261634e9
TLSH
T171119471A4E5D8A7E83368CF652DCE530C9637EFA81CAF14230E4218A799C728E154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/852-79-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1240-32-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/4568-0-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4568-8-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download