13f9c1dadda622489d8c132f8987de4b52eefd5602f29eb6c0e8eaa612f0bb7b

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 24.2MB
Sample260818-c8mdlsvyfs
SHA256 13f9c1dadda622489d8c132f8987de4b52eefd5602f29eb6c0e8eaa612f0bb7b
MD5 e84b7e4611823d430022443286fba40f
SHA1 5e5d6a31f07da13a925088c0e1c4bf5b98199bef
SHA512 6c44326fb6f734122d5ee87f8bc03ef212ce95ab08693927659c49af90ef5825e5a7af4b9cbc9ffb12b10d5d5bdfdbd03d0ec7d8c8d4f49f649b7b0a63ef9f4c
SSDEEP 196608:ULZgLZkLZzLZgLZkLZzLZgLZkLZzLZgLZkLZzLZgLZkLZzLZgLZkLZzLZgLZkLZo:YEo5Eo5Eo5Eo5Eo5Eo5Eo5EoWcZEIve
TLSH
T107476C09F84340B2EA6710B14DDFD27E9674BB2087228DEBE7CDCA1B7933AD15935216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4544	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
5100	svchost_CCBCABACBBABBCCBACBBCCACCBBCBACAAAACABBCBABAACBAAAABCCA.exe
3100	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCAACBBBBAACBAACAAACBBBABAABBAACCACCCCCABCACAABBACBBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe"	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCACCCBCCCACBCACCABBAACBBCBAABACAABBCCABAABABBCCBBCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCABACBBABBCCBACBBCCACCBBCBACAAAACABBCBABAACBAAAABCCA.exe"	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2792	sc.exe
4340	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2060	cmd.exe
3768	cmd.exe
1048	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCABACBBABBCCBACBBCCACCBBCBACAAAACABBCBABAACBAAAABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2748	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2748	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2748	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2748	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4544	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
4544	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
4544	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
4544	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
5100	svchost_CCBCABACBBABBCCBACBBCCACCBBCBACAAAACABBCBABAACBAAAABCCA.exe
5100	svchost_CCBCABACBBABBCCBACBBCCACCBBCBACAAAACABBCBABAACBAAAABCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4544	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
Token: SeDebugPrivilege	5100	svchost_CCBCABACBBABBCCBACBBCCACCBBCBACAAAACABBCBABAACBAAAABCCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2060	2748	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	99
PID 2060 wrote to memory of 648	2060	cmd.exe	101
PID 4544 wrote to memory of 4320	4544	svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe	102
PID 4320 wrote to memory of 2384	4320	notepad.exe	103
PID 2748 wrote to memory of 3768	2748	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	107
PID 3768 wrote to memory of 4340	3768	cmd.exe	109
PID 2748 wrote to memory of 1048	2748	2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	110
PID 1048 wrote to memory of 2792	1048	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_e84b7e4611823d430022443286fba40f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABCAACCBCBACCCCCBBBBCBCABCCACCABBBCBAAAACABBBBBCBCCAAABCBABAABAACCBBACABBCCCBCBACABBCCBAABBCCAABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABCAACCBCBACCCCCBBBBCBCABCCACCABBBCBAAAACABBBBBCBCCAAABCBABAABAACCBBACABBCCCBCBACABBCCBAABBCCAABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABABABACAABACCABACABBCCBCABCACCABABCCCCCAAACABABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe" start= auto displayName= "UserDataSvc_AABABABACAABACCABACABBCCBCABCACCABABCCCCCAAACABABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABABABACAABACCABACABBCCBCABCACCABABCCCCCAAACABABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe" start= auto displayName= "UserDataSvc_AABABABACAABACCABACABBCCBCABCACCABABCCCCCAAACABABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABABABACAABACCABACABBCCBCABCACCABABCCCCCAAACABABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABABABACAABACCABACABBCCBCABCACCABABCCCCCAAACABABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2384

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABACBBABBCCBACBBCCACCBBCBACAAAACABBCBABAACBAAAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABACBBABBCCBACBBCCACCBBCBACAAAACABBCBABAACBAAAABCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
1⤵
- Executes dropped EXE
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 86e620f2919d49618b2d36bd24cdbd2634cded4baa27cef17b145dbf2ebd5373
MD5 1b7d1b1c60a680558dc7c5bf1e4ed538
SHA1 c28cc301380de9c89a299e545302b4d421e1c665
SHA512 fa2eeb37772b534bbb0512230dd3d188a1043522dd5aef79cfc9427cafaa8dff97f458cc41abddd2f5d2d83d9f53cd147ee0d127cb193fe15299c745e7a3e100
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6645a317af6c54b5a48cd7d878a6a1d1bafc10cfe581f936839e0d3eea1bd484
MD5 6a5575560bf3cea9440131d6c5fab22c
SHA1 dc17fc2a5316130dd95e902e1a5d3c830f6119aa
SHA512 ec203f443c6a533ffda6bedd456138565bc612e876c349d6957d5f598db863758efb9a47043b924e0cfb16322ce0c7f783fd9816c3a12a60cc8a9f42446bcc24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77cdb4c7915fe99445656940197e5c2fddb459a5d3bd519c457212242c8ddefe
MD5 8a04f350c20f79660fbc2cf936994f72
SHA1 b1622cbedb1a62bf1f521a9a8b2c2caa1e159da1
SHA512 61954addd440d593ca67ea37b6ca3ebf6307b2f30908962a909eebbd48e55999eecaccaf74cae6b2227c347b14dc8fd19bd491768660c049101889cae184836e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a0827628cba51921d611612a5f4e47a666d2fb05183c5a2ae7f044b5386c835c
MD5 7ae723d8ac3435d24efc25da7928df4d
SHA1 95b8e6e42a1e074e3d000311e6640a871ea20480
SHA512 43de09e8fad3a1e49c0e04f970d9daa2d714ed159682da029b53e61ab090d7ae188d564b1c170f1603ae12c7ecf4118fc25199a5f6cdd8ef7becda1a552bebcb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 48d686a9ecb10a3e83593646f713e24964783aa7e5cb45b181c4c13e162f51a4
MD5 fd289a69261266456a3785256fc4fb31
SHA1 9e260bcd36df03e9eed9abe769075600cd829f38
SHA512 6bd8dcf3f6c05b30e5c59981e30a180ff7c38616c99f7bb5f0c02beed0b0f740376f979fba12c6c0ec3fc2112481d15921c77602e1d944a8f1cb0b7a273886bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 598c2e9f2aeb133327b55c9068da7439c67eb870ed1b371510997edd67a73a88
MD5 8e940028d6f5eb315483b3c465f81c81
SHA1 1a02f8423d93ce4c8260d45ab8504a25e131501e
SHA512 7c0c3528814c437bbce334f51ae6e096212b763118ba7dc982413a378f0916a1b3b1dcc406deb7ecfbf08296ec88c08b9698735c79f330ce1b15e32751e44e96
MD5 SHA1 SHA512

Submit Download

svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCABACAACBBCABBCBACACCACCCAACAACBCBABABABCAACBBCCA.exe
Size 24.2MB
SHA256 13f9c1dadda622489d8c132f8987de4b52eefd5602f29eb6c0e8eaa612f0bb7b
MD5 e84b7e4611823d430022443286fba40f
SHA1 5e5d6a31f07da13a925088c0e1c4bf5b98199bef
SHA512 6c44326fb6f734122d5ee87f8bc03ef212ce95ab08693927659c49af90ef5825e5a7af4b9cbc9ffb12b10d5d5bdfdbd03d0ec7d8c8d4f49f649b7b0a63ef9f4c
SSDEEP 196608:ULZgLZkLZzLZgLZkLZzLZgLZkLZzLZgLZkLZzLZgLZkLZzLZgLZkLZzLZgLZkLZo:YEo5Eo5Eo5Eo5Eo5Eo5Eo5EoWcZEIve
TLSH
T107476C09F84340B2EA6710B14DDFD27E9674BB2087228DEBE7CDCA1B7933AD15935216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 91053ab3ffd0f718d3da39bb01747de65baa5a2b279c9a050ab8ce152ca0f147
MD5 021cf8c0e37070923d422b85acf64f04
SHA1 211b42333b5591ced26c4da4f1d60419799b54fe
SHA512 3b58ae1998b76fb3523dca7f6d3cf10ce5e6796e91ee03ae044b30871213d2e603c95016a4b834cafce20079fc8f1562aae3549d04c246dcde9ac05e16a7d857
TLSH
T10211B955E4D7DC13F932A8CB92197FC64C9436AFAD5C6A45230D82196F8C833CD194D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2748-0-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/2748-7-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/3100-89-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/4320-62-0x00000000057E0000-0x00000000057E1000-memory.dmp

Download

memory/4544-36-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/4544-26-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/5100-88-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download