d75c552ea6986fd74a775e4da3d560eee32c27c3590707a68d89487a929324a9

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 10.6MB
Sample260818-cepxmsvsds
SHA256 d75c552ea6986fd74a775e4da3d560eee32c27c3590707a68d89487a929324a9
MD5 a17579277d571a6bfb39e675b94803ae
SHA1 95d0d42ff567f74a59a710935c2aa9021f22be3a
SHA512 0fe4be93cbe28c4152931cf57873f7beb7d5509f8e8c8ef20aa846efd392f6f0602a97d33776a42d5b1f9f94871443c69bbc67b326bb276d93dbc6e9fe3938e0
SSDEEP 98304:YKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aS:Yq9q9q9q9q9q9q9q9qxKWQc0gEYnvLh
TLSH
T122B6BF13E7D60071EAB33530466FF37A6D7E77210A34895D93540A7E5E32E80AA2936F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2064	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
2940	svchost_CBACACBBAACCACCABABCCAACCABABCCBBCCCCCABABCBACACBACCCCC.exe
5524	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAACBCCCAABBCAACBCBACACACBBBABCBBABACCCBBABACAABBABAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe"	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACACCBBBACBAACCAABACBBACCAACCBBCCBBABCBAABBCCCAAAAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACACBBAACCACCABABCCAACCABABCCBBCCCCCABABCBACACBACCCCC.exe"	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1880	sc.exe
3388	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
476	cmd.exe
2896	cmd.exe
4656	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACACBBAACCACCABABCCAACCABABCCBBCCCCCABABCBACACBACCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2008	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2008	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2008	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2008	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2064	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
2064	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
2064	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
2064	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
2940	svchost_CBACACBBAACCACCABABCCAACCABABCCBBCCCCCABABCBACACBACCCCC.exe
2940	svchost_CBACACBBAACCACCABABCCAACCABABCCBBCCCCCABABCBACACBACCCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2064	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
Token: SeDebugPrivilege	2940	svchost_CBACACBBAACCACCABABCCAACCABABCCBBCCCCCABABCBACACBACCCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 476	2008	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 476 wrote to memory of 3504	476	cmd.exe	94
PID 2064 wrote to memory of 2408	2064	svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe	95
PID 2008 wrote to memory of 2896	2008	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 2896 wrote to memory of 1880	2896	cmd.exe	100
PID 2008 wrote to memory of 4656	2008	2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 4656 wrote to memory of 3388	4656	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_a17579277d571a6bfb39e675b94803ae_amadey_darkgate_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCBABCBAAABBCACABBCABBABBBABACBCBCBBBACAACBCCCBBCBAAAAACCABBCCABCCBCBCBBCABBACACBABBBBABCBBABACACCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCBABCBAAABBCACABBCABBABBBABACBCBCBBBACAACBCCCBBCBAAAAACCABBCCABCCBCBCBBCABBACACBABBBBABCBBABACACCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACBBBABBCBCBCBCACBCCBAACCABBACABBCCACABABAACACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe" start= auto displayName= "UserDataSvc_BAACBBBABBCBCBCBCACBCCBAACCABBACABBCCACABABAACACCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACBBBABBCBCBCBCACBCCBAACCABBACABBCCACABABAACACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe" start= auto displayName= "UserDataSvc_BAACBBBABBCBCBCBCACBCCBAACCABBACABBCCACABABAACACCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACBBBABBCBCBCBCACBCCBAACCABBACABBCCACABABAACACCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACBBBABBCBCBCBCACBCCBAACCABBACABBCCACABABAACACCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACACBBAACCACCABABCCAACCABABCCBBCCCCCABABCBACACBACCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACACBBAACCACCABABCCAACCABABCCBBCCCCCABABCBACACBACCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
1⤵
- Executes dropped EXE
PID:5524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d7b8802c0207ae718965f959519b18328692c930522c275252f4f3d106148306
MD5 9ea66fd40cc803f3bbf97c1344853b04
SHA1 92bda9a7b23e2a5d2e7a6b60d98346b5e3c5f383
SHA512 7084b2c0c4fee5cae26cda51c6deebe8953528d06bb88627d5345d4e088db6993cd17355dabad9eddeb1d202db28eabf594b7b61d572114c2d683c86680940d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9e58b25d1f12dedfdb7fc9821aad4b038a012d2bd7220d318a026919d4b34263
MD5 8c51db5ed5889832ce569823f2905f0f
SHA1 4b11bb703103021e25051b794b134c4458ea4bd0
SHA512 a827726c090fd52495ea07c442346e20b676ec63baa53bedfb59927981d8bd665b515282b0fd2f02a2ea0a1927d0c406d3cac7db4c19701cae9ea63bfb846aaf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3964477134831f48025f76ec291bc4862b2b2c9f1642df78cdb42b9dfe00835
MD5 723ada86e13d3c722468a6de37158a8c
SHA1 eb698fe873e43f19627460926a586417f19dfb5a
SHA512 0a3a38d4b9bd3e47c016e0f3cbdaa43e2544daec3bf43d53ac81a9b43a54a585f40ded766aa352397ae75cef94cf20a12205e1bf296200f101dc9b018c439734
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 19cd1331202b4eab1f7d284e5ab46c2b112ef0d902a6b2eb78ed2e6b427e72db
MD5 5fbc642157bcb0604db10c4973fb0b22
SHA1 fc1a609d592e6c9bb0338085dc80f53f3a0e7087
SHA512 c58e56c711eb6642032613e94a95fbd2847b572d6284a6ee2cde9c57f977b411ae9ce107a2beac584e707d352b311457b9a9fa558226b60471182d728f8cad72
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84a0fe81f2edea22ef00520eb0fe550f1d66043b2246d3e551718f2f4446ba18
MD5 e1c22e07acf2c794bc15a25bb814cab0
SHA1 3d5f1d762ed6285dfbab735c852c5b64274907dc
SHA512 f03d64707b55a711daf97b20a9e54c98b813ce90085827e33f5d3732d284f2b29ffedc533b612acc586c379f6c9a60569d1da96977767810023e45462966edf0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c47003999500c03b61a211399a66d2e7f1452006ee694e2d791f1929ddfac85f
MD5 fc879d194d06fdde2e69a2e0d6805297
SHA1 2abdcc80734323417818f646a8d7501226fdbdda
SHA512 ad096fcf6fad6ad10d2a26d58d50aa51eeff89a1f2728bd0526a7c7401868c939ea6cd9d16d62939f5211b2d8cd35a1115ffc79efefba846294c2e301718dd23
MD5 SHA1 SHA512

Submit Download

svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBAAAAAACBCBCCBBACCACCBABAABBCABBCBBCACBBACBAAAAABBC.exe
Size 10.6MB
SHA256 d75c552ea6986fd74a775e4da3d560eee32c27c3590707a68d89487a929324a9
MD5 a17579277d571a6bfb39e675b94803ae
SHA1 95d0d42ff567f74a59a710935c2aa9021f22be3a
SHA512 0fe4be93cbe28c4152931cf57873f7beb7d5509f8e8c8ef20aa846efd392f6f0602a97d33776a42d5b1f9f94871443c69bbc67b326bb276d93dbc6e9fe3938e0
SSDEEP 98304:YKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aOKRuy5aS:Yq9q9q9q9q9q9q9q9qxKWQc0gEYnvLh
TLSH
T122B6BF13E7D60071EAB33530466FF37A6D7E77210A34895D93540A7E5E32E80AA2936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5b949ea762ce628814d62c75ae6bfc55376a90f9593027022a2b4c6ab2c4fa4c
MD5 d44bfd994feac6cdd286412f518354a8
SHA1 e65c9733b9018b7b968d37c064df0d5d8e343a06
SHA512 9c0c32774b978ee3ef2bf9e257b6e651cb74a8998a4b57454adef471f3e93343d9ab12bf6ad4093373a04f121cd9bf1b8d65d5fc268ebb242a28e5985400783f
TLSH
T1CA11A371D5EBD827EE22399F922DBB838CA0379F9C187A54120D4619BF75C32ED110E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2008-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2008-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2064-33-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2064-23-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2940-79-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5524-81-0x0000000000400000-0x0000000000421000-memory.dmp

Download