6b1c7a4c2c7f3288da7f775e6b714b4640b1130c0e9f46f80a5254ea0a93a7fc

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 22.9MB
Sample260818-dj4f9sdl2v
SHA256 6b1c7a4c2c7f3288da7f775e6b714b4640b1130c0e9f46f80a5254ea0a93a7fc
MD5 a27be6cf77882b1eba16fa35f08de06d
SHA1 aa52dbccb4f80ef838629c4419570a8c14ad8dc1
SHA512 bbaabc2dd49d927134d8a8b6cda3a55a76b7035b7a7a1680371ac5aabbe212a8404856684c6e4f0aa63bb0d9ddc5d8d3c4b276ba4727d55bb924deacb0e7f893
SSDEEP 196608:4LZgLZkLZ/LZgLZkLZ/LZgLZkLZ/LZgLZkLZ/LZgLZkLZ/LZgLZkLZ/LZgLZkLZA:8EoFEoFEoFEoFEoFEoFEoFEoWcZEIvW
TLSH
T1D1376D09F88340B2EA6710714DDFD27E9674BB2087228DEBE7CDCA1B7933AD15935216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5876	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
4632	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
5012	svchost_BACBACCACCCCBBCACAACAACBCACACAABBCAABCCAABACBABACCAAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBABBBCCCCCCABCAABABCCAABBBBBACBABBAAAAABBABACBCABABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe"	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCACBBCAABCACBBCCCCCBBCBCABABAABABCAAAABAABCAACCBABAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBACCACCCCBBCACAACAACBCACACAABBCAABCCAABACBABACCAAABA.exe"	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5456	sc.exe
5552	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5892	cmd.exe
856	cmd.exe
2136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBACCACCCCBBCACAACAACBCACACAABBCAABCCAABACBABACCAAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5476	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5476	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5476	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5476	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5876	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
5876	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
5876	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
5876	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5476	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5876	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5476 wrote to memory of 5892	5476	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 5892 wrote to memory of 3416	5892	cmd.exe	94
PID 5876 wrote to memory of 3224	5876	svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe	95
PID 5476 wrote to memory of 856	5476	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	96
PID 856 wrote to memory of 5456	856	cmd.exe	98
PID 5476 wrote to memory of 2136	5476	2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	99
PID 2136 wrote to memory of 5552	2136	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_a27be6cf77882b1eba16fa35f08de06d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABCACBCAABBBCBCACCBCACBCBAAABABCBABCACAABAAACCBBCCCBABBBBABBCCBBACBBBBAACCACABBCABABAABACBCAACCBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABCACBCAABBBCBCACCBCACBCBAAABABCBABCACAABAAACCBBCCCBABBBBABBCCBBACBBBBAACCACABBCABABAABACBCAACCBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCCBCBBCCACACABAACACBABABBCCABACCBABAACAABABABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe" start= auto displayName= "UserDataSvc_ACCCCBCBBCCACACABAACACBABABBCCABACCBABAACAABABABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCCBCBBCCACACABAACACBABABBCCABACCBABAACAABABABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe" start= auto displayName= "UserDataSvc_ACCCCBCBBCCACACABAACACBABABBCCABACCBABAACAABABABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCCBCBBCCACACABAACACBABABBCCABACCBABAACAABABABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCCBCBBCCACACABAACACBABABBCCABACCBABAACAABABABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
1⤵
- Executes dropped EXE
PID:4632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCACCCCBBCACAACAACBCACACAABBCAABCCAABACBABACCAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBACCACCCCBBCACAACAACBCACACAABBCAABCCAABACBABACCAAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e79533df2b5c1113cb9d654c9d3fa394751c3a9803d4def285ff5de69b62ed97
MD5 440827316d1d9f64cca38c250f5ae6db
SHA1 41fd97eb0787a4ab9f02399f8880f874f0c2b9e8
SHA512 b79a6f0cb446e3842e8b6a68cd528b27ad6e3cc0227dc6dc3ecb52fa590a14b4a63b750888f328efe9bc9434a8e860967a5d50e4adbaf6884a6415ea4da44bc2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2982aa23a8fbb523fd5d04b129972351263d5426e6e0103b6fab4ac6f9a44ee3
MD5 a950cd6ecf8125f62f726b66dca3bf27
SHA1 2ba4d02730741d13acd22ae53294b4694367831b
SHA512 7860544ef30cc67e0304b8c76b4dbb5991938135a98f6942751352c480e79aef6246f5f1b5532f9b2004f6ff63bb0dd9a360e5948a663432bfaafaced68af522
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cbb022f63d800dcf6ba77e2c83d77d62f10183f6f0d6ab87618cc5582c98d288
MD5 449fa0a9642df144cb7905901fab0f58
SHA1 355fcacd3479716cea77f9d1298057bd271995f4
SHA512 7b98c6557837321c9ad25eb486df7f32bb0c58ff960c3f01e02c0c0679ba1c56730d5b13e698508a44d977f82854a3d60fd89aacb8ed1933beae2e99f3437247
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 83f9048190fe9140343c67a14d83ba287dd9fe1bc0a59267d3367788b905fb21
MD5 c11f4d1f7a785fdaa9aeb199a864a2c4
SHA1 0e3324c72752bfeb6f9cea742e52678c12573277
SHA512 a32ed44e7a597d8165c4a8185ae1d93c127ad5bdf8fd51132ba71b456d91b50699d6189e9942db3662c60990c721577488fa098b4226f75f69244b1eacd347a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48c25046c8d55d3013ed233b49d8623702d909b5054821c932f1ce87a662edf1
MD5 312a3bdbb588d35e9062cccc3012556a
SHA1 69bdf46adcabb6937cc134b8cd70a31639a2b832
SHA512 04c2fa754d4c1fd5bbc0681f3588e93c7dcb784cfd7dcd02d6678458720e95cbcc75dc37b6717c033f29a3f3b1907e9d48a57588ba6ec0073c9dfdbf5eba1b7d
MD5 SHA1 SHA512

Submit Download

svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCCBBBCBCBCCBCCBBBAAACCACAAABABAACBBAACCCBABBABCABCA.exe
Size 22.9MB
SHA256 6b1c7a4c2c7f3288da7f775e6b714b4640b1130c0e9f46f80a5254ea0a93a7fc
MD5 a27be6cf77882b1eba16fa35f08de06d
SHA1 aa52dbccb4f80ef838629c4419570a8c14ad8dc1
SHA512 bbaabc2dd49d927134d8a8b6cda3a55a76b7035b7a7a1680371ac5aabbe212a8404856684c6e4f0aa63bb0d9ddc5d8d3c4b276ba4727d55bb924deacb0e7f893
SSDEEP 196608:4LZgLZkLZ/LZgLZkLZ/LZgLZkLZ/LZgLZkLZ/LZgLZkLZ/LZgLZkLZ/LZgLZkLZA:8EoFEoFEoFEoFEoFEoFEoFEoWcZEIvW
TLSH
T1D1376D09F88340B2EA6710714DDFD27E9674BB2087228DEBE7CDCA1B7933AD15935216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4632-67-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/5476-0-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/5476-7-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/5876-23-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/5876-36-0x00000000006E0000-0x0000000000701000-memory.dmp

Download