7048fa226b0f627573b2f8fdd3ebd72e3c5791aa84af50a29f14d6eff9c254dc

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 32.2MB
Sample260818-d2ekvswwas
SHA256 7048fa226b0f627573b2f8fdd3ebd72e3c5791aa84af50a29f14d6eff9c254dc
MD5 3db3eb8ae18bb988c945dd7b71df972f
SHA1 5bca32e251168cb3b41ec13b3d85bb6a6d5ae63c
SHA512 0d508b42461acd488f646fa459a841bec4615cb30c7572fd5441a412791fe0daba806cead55dfc2ad09e60b63109de131992454f5652800df02584b0b9b5a4a2
SSDEEP 393216:GO4q78UhaswO4q78UhaswO4q78UhaswO4q78UhaswO4q78UhaswO4q78UhasbcZN:9hasThasThasThasThasThas2EIvt
TLSH
T16777391CF99640B1D877817088D7E2BE8A31B92197118EDFE689C32F5D27BD26834F25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4128	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
4816	svchost_CABBABACACBBCBBCCBBBBCCBACAAABAACCAACABBCABAABCCBABBCCA.exe
3552	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBACCBACBCBAABACBAACCBACBBABCCCCBACBAACABBAAACBACCBBCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe"	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBAABBCABACCCBBBCABACBBCBCABABBCBCAACBCACCCAABCAACAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBABACACBBCBBCCBBBBCCBACAAABAACCAACABBCABAABCCBABBCCA.exe"	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3688	sc.exe
3812	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3592	cmd.exe
1108	cmd.exe
532	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBABACACBBCBBCCBBBBCCBACAAABAACCAACABBCABAABCCBABBCCA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4240	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4240	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4240	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4240	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4128	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
4128	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
4128	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
4128	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4128	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
820	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 3592	4240	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 3592 wrote to memory of 2936	3592	cmd.exe	103
PID 4128 wrote to memory of 3692	4128	svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe	104
PID 3692 wrote to memory of 4656	3692	notepad.exe	105
PID 4240 wrote to memory of 1108	4240	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	109
PID 1108 wrote to memory of 3688	1108	cmd.exe	111
PID 4240 wrote to memory of 532	4240	2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	112
PID 532 wrote to memory of 3812	532	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_3db3eb8ae18bb988c945dd7b71df972f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACAABABABBCAABABBBBCBCBBCACCBBAABCCABBBACABBBCBCAAACCBCAACACAACACCACAABACBBBBBAABBBCABBBBBCCBABCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACAABABABBCAABABBBBCBCBBCACCBBAABCCABBBACABBBCBCAAACCBCAACACAACACCACAABACBBBBBAABBBCABBBBBCCBABCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABABABAABCBABAACACCCBACCCACCAAABACACBBBCAAABCBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe" start= auto displayName= "UserDataSvc_CBABABABAABCBABAACACCCBACCCACCAAABACACBBBCAAABCBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABABABAABCBABAACACCCBACCCACCAAABACACBBBCAAABCBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe" start= auto displayName= "UserDataSvc_CBABABABAABCBABAACACCCBACCCACCAAABACACBBBCAAABCBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABABABAABCBABAACACCCBACCCACCAAABACACBBBCAAABCBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABABABAABCBABAACACCCBACCCACCAAABACACBBBCAAABCBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABACACBBCBBCCBBBBCCBACAAABAACCAACABBCABAABCCBABBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABACACBBCBBCCBBBBCCBACAAABAACCAACABBCABAABCCBABBCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
1⤵
- Executes dropped EXE
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9bd64f50c7ad16899a8a7ef46fa560185b249397ccb6153c230eb59f7ae5d535
MD5 7ab8176d69c22dd34f83700532589cf5
SHA1 9aec584ad43c00891ac1694f4b2a2123683a94fb
SHA512 cee265ec1ba71049390edc9a179f58b71370fa6e1e4e1e3e051791343b180728e24cb666c5faf24a096fe21e4422d7801cd1dc5d68f255af78f16403908d511d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 846c6c87b7990dd9b5196b28d3e93984b1ccc9d3c0fc6adb6d3b01ca7b896736
MD5 b6131603185f22eb3590e9e2a2597cf0
SHA1 77f73d7b4cafe341826ec85c676e77129dd3daf3
SHA512 d11820f64097cea089f2aec8e8711fd2e3c9e83ad41422f5fe9affd9639c77cbe8e2d4058285ae31398fa58025ad0b6313ee2d499227f86b9c65485ffbb6356b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 922eb8ab3a7e9af0467a4d3ba6d519f0354cc1a25fd1267ed67412856e2bd7a4
MD5 7ef1ff341401bfd88cb4f9b1f846cf6a
SHA1 6bcd53a6f6283ca3a5806a6ee1fecd27c83fbfbd
SHA512 d7b999cf414d872ddd72c639fe61eee11d20df26753cc2fcb632aba05127ed6247de24fbbb77d79cbc222d0c28295bb3b3431ba40cf0a5714783e7cf6ab02b2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 efc093db810b042e8d4ccc4ead4b738994a15291630103cd0c62c5de67d23fa8
MD5 598d636087db3bd2ff038ed6b5fdee7f
SHA1 d1c7e4b70f8d718e9c4fa87830ff40f4b06f14a5
SHA512 3027831ad94e31a2ce3a27eceb79c26dccf3295c342b1352986a4af0f0e4288ef223c8768eb66d238cdd73e78eedeccc2db8c2b14273b12e6c807302d6d6416e
MD5 SHA1 SHA512

Submit Download

svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
Size 32.2MB
SHA256 7048fa226b0f627573b2f8fdd3ebd72e3c5791aa84af50a29f14d6eff9c254dc
MD5 3db3eb8ae18bb988c945dd7b71df972f
SHA1 5bca32e251168cb3b41ec13b3d85bb6a6d5ae63c
SHA512 0d508b42461acd488f646fa459a841bec4615cb30c7572fd5441a412791fe0daba806cead55dfc2ad09e60b63109de131992454f5652800df02584b0b9b5a4a2
SSDEEP 393216:GO4q78UhaswO4q78UhaswO4q78UhaswO4q78UhaswO4q78UhaswO4q78UhasbcZN:9hasThasThasThasThasThas2EIvt
TLSH
T16777391CF99640B1D877817088D7E2BE8A31B92197118EDFE689C32F5D27BD26834F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBBBACCBBBBACCBCCBACCBCBAABAACCBABCBBACAABBBBBBCACAB.exe
Size 8.9MB
SHA256 2ec48e74f766a750c5b9918ca33558c80e114b6290a9a9912adbd3f73291e40b
MD5 cf6e7759755558091d72ae8999c99e47
SHA1 0f27bf289e6990254559e7669c6f4dbb19b6aee5
SHA512 74c9c6fd969c951c4f6ddd20cebd07dd1be9c8f0e8e6251eb83af79e5bc0f97f2fbab844b9f42f6814ccdba1206b8caa0724d00afb6cea416d78dc5c903096a6
SSDEEP 49152:U+ES+ES+ES+ES+ES+EFhO0+ES+Eh+ES+ES+ES+ES+ES+EFhO0+ES+Eh+ES+ES+E0:3VVVUO4q75Av7fbUhabgRVVVv
TLSH
T17D963A0CF99600B1D87751B088DBD2BE8A317A2187118EEFE689C76F9D37BD16834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3692-61-0x0000000005970000-0x0000000005971000-memory.dmp

Download

memory/4128-27-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/4128-37-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/4240-0-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4240-8-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download