e64fb4fbe1441fd9145ef48406b6b484400b9077003144531aa8f94580e18812

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 51.3MB
Sample260818-b63gdatemb
SHA256 e64fb4fbe1441fd9145ef48406b6b484400b9077003144531aa8f94580e18812
MD5 e03a6e430241250e43b200fd0cfeb238
SHA1 0036fc73b3609765abba935621f6265780cb11c6
SHA512 8366a77b57da8e48ceda54c711e7517dd9b5527c6f7338a74c2ec1bef3f9be8191284ec4c7796c963c37f1b3eab031b51d5a64095d259dcb4ccb61f7fcadd581
SSDEEP 786432:g88K88K88K88K88iJ88K88K88K88K88iJ88K88K88K88K88iJ88K88K88K88K88l:rR
TLSH
T168C78E05F84340B3EB6610B14DDFE27E6A78AB3042528DE7F7CDCE1B7932A91563A116
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3336	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
2620	svchost_CAABACACAAACABBBACBAAACBACBAACBCBBBBBCCABBCBBCCABCABAAB.exe
4604	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABAAACAACCABBCBBAAACAABCBBABBCACBBABCBCCCCAACCABBAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe"	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAABCBCCBCCBACCCACBCAACACACBABBABCBBCABCCCACABBBCBCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABACACAAACABBBACBAAACBACBAACBCBBBBBCCABBCBBCCABCABAAB.exe"	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3620	sc.exe
3652	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1940	cmd.exe
668	cmd.exe
2460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABACACAAACABBBACBAAACBACBAACBCBBBBBCCABBCBBCCABCABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3324	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3324	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3324	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3324	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3336	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
3336	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
3336	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
3336	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
2620	svchost_CAABACACAAACABBBACBAAACBACBAACBCBBBBBCCABBCBBCCABCABAAB.exe
2620	svchost_CAABACACAAACABBBACBAAACBACBAACBCBBBBBCCABBCBBCCABCABAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3324	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3336	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
Token: SeDebugPrivilege	2620	svchost_CAABACACAAACABBBACBAAACBACBAACBCBBBBBCCABBCBBCCABCABAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 1940	3324	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 1940 wrote to memory of 3920	1940	cmd.exe	93
PID 3336 wrote to memory of 2468	3336	svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe	94
PID 3324 wrote to memory of 668	3324	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 668 wrote to memory of 3620	668	cmd.exe	99
PID 3324 wrote to memory of 2460	3324	2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 2460 wrote to memory of 3652	2460	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_e03a6e430241250e43b200fd0cfeb238_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBAAABBAAAABABCCACCBBAACCBCCCCCCAAABACCAAACCCCCCCBCBABBBACCCACACCCABABCBCCBCBAABBBBCBCAAABBABCBCBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBAAABBAAAABABCCACCBBAACCBCCCCCCAAABACCAAACCCCCCCBCBABBBACCCACACCCABABCBCCBCBAABBBBCBCAAABBABCBCBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCACBAACBCABCBBAABCBAACACACBAABBACBBCABCCBCACACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe" start= auto displayName= "UserDataSvc_CACCACBAACBCABCBBAABCBAACACACBAABBACBBCABCCBCACACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCACBAACBCABCBBAABCBAACACACBAABBACBBCABCCBCACACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe" start= auto displayName= "UserDataSvc_CACCACBAACBCABCBBAABCBAACACACBAABBACBBCABCCBCACACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCACBAACBCABCBBAABCBAACACACBAABBACBBCABCCBCACACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCACBAACBCABCBBAABCBAACACACBAABBACBBCABCCBCACACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACAAACABBBACBAAACBACBAACBCBBBBBCCABBCBBCCABCABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACACAAACABBBACBAAACBACBAACBCBBBBBCCABBCBBCCABCABAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACCBABCCCBABCAABBACACCCBCBBBABCBCBACCCACCACBBCBABBA.exe
1⤵
- Executes dropped EXE
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d2df4c9a2bf039d04c21d4acadf39902d3b19f2fbe37b256d05e64e1642bc939
MD5 a356125865eee408a74afbbabbea3978
SHA1 653fd18ec6beaa0a28af20ec459b8ba363166fe9
SHA512 417352034368a7faa0217556e6967159134f1a771679040f9d5c987dc98cd463b47908f8550114ad2c23cc109dfeeb30c259a323fb3c735bde307a3288fe8e32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e004e4d46dba6a370d1aa0fd97406848e445d67d1749eb315f83be9917b4c704
MD5 3cb5ef9506c3de3bd76e4bae2dae220a
SHA1 857c5cc3f91b5a45bacac4412c5526bdc5f7cedd
SHA512 1d17cf688ca88aaec0278f873943efd01683396fb4a0d9e96439df49d177fb43d38efa5a662e9cbf1441060ccd87b58a6a5cd391868eaf131f49f529690a6fcd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 020632a352ca31ad6a66c60f7ccdb2da2bcc952a5d1c9588b9326bc8d6fe9157
MD5 815acb95ff7e2bfb27823f9c98b97611
SHA1 7230023ab3dc506a9fa6960b984592d994a5d94c
SHA512 eed48f1a884df0fd813440b328e0cd47455570660406406793d0aacfcfe58e6619f193e4baa7460a944f92c2459a8e482d34f7d85cbb4cb5c5c3d5f04ddb325f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9fbd68b3ede6492aadec80fb59e9933bb47e7bba2d3f18e0b13af9af382d396b
MD5 ebf00a99c8a0fe48b58ce6ca50135f39
SHA1 188c0ef2876bb559c486054cecdbf31d872cacb5
SHA512 6d10a58a9f88fad15989187c6c75f30ccd35d762427ffad50572ae1be320c2c20bbc6efd1baa1c0bb1c14c2acecbe922332cdf6727f1a64a002e11d9247abcc3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a6bf91a31819aa70485be54e5e0904af6cd8b71ae572f0cfb5cafc210708119
MD5 d684ec05b9b11c0097f074ec8561aebf
SHA1 782da17c5445e3ddc6b01ecea8eec46913df7ca5
SHA512 834236f662818f5361a67a2f55428bedf15b34963721af8757cb04ed92882efbbaec8996b8afe1bee841124d833d35c69145b4eda891a3a5188077df4e41e650
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 217531869547ec49399151f2622ed084651777707f1c06bb893f297e9fa6443e
MD5 bac8c3eb64d8577f1975f10b192de146
SHA1 b3f0b9e86dcabdff85e91bd0a2e8e43281325640
SHA512 19613e1094bd655021d883082f7d4831ac47b83fa44e6583d338d1728ac93cbea7a750fc891bf504670d118e712fe89353ed1c3c7353a680ff78f05f3eada365
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f70550ea4daaffc2acb5ab8f4ec4b13d0e523e76ee56721b1f5b591ccfa2937a
MD5 9040119598cf534f5fd7dd8f3acd9ca3
SHA1 499d84c11a62c215f08b66aebfe7238cbb9840b8
SHA512 3d115ab4bcc8fbaf2c56331ab0065f0e53bc5ee83820903112f677b601b211fac0896df0725d6c9ae32fe2ab20c6b21f502e19bd9921e8f6b6b534d5356e5c5d
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3091506b378eeb0d13103fa56a3dda16dc60b873ec6666f46c536524537e3914
MD5 1dab90229a66d842840391f242d55de3
SHA1 2439bfec49745a9546b6396c3b04364ccf7eeeda
SHA512 e7a3457ec4049db3f6a4ae751f3ab3655414400b534e005aad2e984e800c6f7fc863304561f8937202ade7fcc6dd505824206a2380f0b7f26c319ac240eae79e
TLSH
T1DE110421D4E6DC23F83269DB722DDBC30DAD328B585C7A4423088218BBD5C318D294F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2620-92-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/3324-49-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3324-23-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3324-71-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3324-0-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3324-12-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3336-48-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/3336-64-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/3336-101-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download