769885fcb7ef1a49f957274c80088076b5f75f277b9da660a2edb4115219fc0e

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Size 1.8MB
Sample260818-ryqqlsvyfw
SHA256 769885fcb7ef1a49f957274c80088076b5f75f277b9da660a2edb4115219fc0e
MD5 c02ec4d9089011536097e80ed003e6ef
SHA1 f915d9c5d55f4eb47141fa06814c31773f8a7d32
SHA512 eef0c3fc943cf5fc7d02ca2404a8955b826a8425e72a39dc57af741300913d33c5c2236d7f468b040dc32f54fa204300540c3126830127bf2c09b0e7afe529cc
SSDEEP 49152:U+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2vm:PKjKWQc+KjKWQc+KjKWQcZ
TLSH
T18F85AE09F9C340B1D93B55B00CCBD2BF8A74FA3585128E7BFB4DCB1B6A32B519818656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5656	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
4700	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
5448	svchost_ACBCAAABCCBABBCBABAAAAAABBCACACBABABBCBABACBBACACBCACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCCAABCBACCCCABAAACBACCCCCCACBCCBCAAACCCCACBBABCACACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe"	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBABABCBCBAACBACBCBCBACBCBBBCACABBBAAAACBCCBBCACCBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCAAABCCBABBCBABAAAAAABBCACACBABABBCBABACBBACACBCACBC.exe"	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4992	sc.exe
4820	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5980	cmd.exe
4424	cmd.exe
704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCAAABCCBABBCBABAAAAAABBCACACBABABBCBABACBBACACBCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4452	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
4452	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
4452	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
4452	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
5656	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
5656	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
5656	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
5656	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
5448	svchost_ACBCAAABCCBABBCBABAAAAAABBCACACBABABBCBABACBBACACBCACBC.exe
5448	svchost_ACBCAAABCCBABBCBABAAAAAABBCACACBABABBCBABACBBACACBCACBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5656	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
Token: SeDebugPrivilege	5448	svchost_ACBCAAABCCBABBCBABAAAAAABBCACACBABABBCBABACBBACACBCACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 5980	4452	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe	91
PID 5980 wrote to memory of 4400	5980	cmd.exe	93
PID 4452 wrote to memory of 4424	4452	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe	94
PID 4424 wrote to memory of 4820	4424	cmd.exe	96
PID 5656 wrote to memory of 1040	5656	svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe	97
PID 4452 wrote to memory of 704	4452	2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe	98
PID 704 wrote to memory of 4992	704	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_c02ec4d9089011536097e80ed003e6ef_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCABBACBBACBBBBACACBBABCABBBACACBBABCCBBAAACBCBCCCBCBBCCCACCABBCBBAABABCCBAACBCBABABCACBBABACCAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCABBACBBACBBBBACACBBABCABBBACACBBABCCBBAAACBCBCCCBCBBCCCACCABBCBBAABABCCBAACBCBABABCACBBABACCAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAACBBCCCBBCBCACBBCAABCCACCAAABAABAACBCBCBBBAAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe" start= auto displayName= "UserDataSvc_CAAACBBCCCBBCBCACBBCAABCCACCAAABAABAACBCBCBBBAAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAACBBCCCBBCBCACBBCAABCCACCAAABAABAACBCBCBBBAAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe" start= auto displayName= "UserDataSvc_CAAACBBCCCBBCBCACBBCAABCCACCAAABAABAACBCBCBBBAAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAACBBCCCBBCBCACBBCAABCCACCAAABAABAACBCBCBBBAAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAACBBCCCBBCBCACBBCAABCCACCAAABAABAACBCBCBBBAAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAABCCBABBCBABAAAAAABBCACACBABABBCBABACBBACACBCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAAABCCBABBCBABAAAAAABBCACACBABABBCBABACBBACACBCACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e2eeb11673a97e847b936b15a87adc255d6d86e76194bbdee6090cd866fca91
MD5 d2d1a3f692276b81e391cf7821f6a336
SHA1 622db2257bcf934d89f59e897ae617be0c499801
SHA512 bfe9aae6c5c5fde04de7ffa3d3b73d86b72e0af8e24243ddcb770a4ea3efb08186d939c60a7c3ed4c0dda9d33a4fee38d4ab70853a8af2ee9b00c5d6fde9797b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7dfc15aef61118616075359ae0a04d9af0afbb8691d1de8ee667b5185e5f3b3c
MD5 1161a55d13297a1c2120391faadfb83d
SHA1 1d421a943639f7aee8efd9cd7d617d4599743578
SHA512 0d902a66db5280d7c4da62f98b335b539c6c792a4c8cdc609aff3e8b92c0fa602a9e0b2686e9b69d6f813559b3f898c342ac5befdb48234140eb730539ee3d92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82a5f757b038ef46a9d86d9787a02014b65f714d5e5c7e9f5a63d5a797ca9eb8
MD5 d7fb39e869e2d6a2c0639941a5f2c2aa
SHA1 ac10e7434dc4f60663a8ab8cf9941d878c83f1a1
SHA512 f2f534fd2cc04e3a04cd2a66391961e8500e3678c5aab15a4b9742651b74ecb31a576e3f8057157630c3597444471c9944ac4568728cc17c6109da7efcd71c68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 11c920494f58265dc7bcab98e2f7e762e2b040f2ae6aeae5a03f8a80154ee1f8
MD5 8f85aec4f8163e354319615ef31f8921
SHA1 c8e2545ef5be02f84d45c3e8aa1888d28590862b
SHA512 3a2f5bbf311d12e443ca75e3e04efa5b613dd4c927e378962a86fac6d6b082c7358fd774c8b33b590d43289c25c77ebafc93a958374c6eb90a7fef8cdaf001a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9bad97f8a730487acf1fab3fc94ccbf08b67a40f2d35ff499b41d0b5e50b16df
MD5 c7fa5427fe886c75fd9444d5d3c8d961
SHA1 ad87e0968e02c5d7334a375a229b29677f2ca385
SHA512 9e681a808ce7e0611ae1497b3fe87f7b74b45f49412f4918a5787ab83c32c921136d684ca56679be5a9742f15cc4713858c5f2d33a640bcead59ccaec64633bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 244521c93639f8f59b06d1342b4ef01bbb1aaca41c190cd54a4e51a9790f3aa5
MD5 36623b87d311c1d91401c76723bc3fdf
SHA1 fa16e614b4059b1dcdbed0f867e80f6a1be8b140
SHA512 dec4077a115ae961424a1345abc191ca59e89d60f4e5f61aa640ce07e7ce72be2e7ce38b0ec4e7aae9a7e81251d6097c5988573eb995021138ac9db6b2866de4
MD5 SHA1 SHA512

Submit Download

svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBBAAAAAAACBABCBCACAABABACBBAACBAAACCCCBACBBABCBACA.exe
Size 1.8MB
SHA256 769885fcb7ef1a49f957274c80088076b5f75f277b9da660a2edb4115219fc0e
MD5 c02ec4d9089011536097e80ed003e6ef
SHA1 f915d9c5d55f4eb47141fa06814c31773f8a7d32
SHA512 eef0c3fc943cf5fc7d02ca2404a8955b826a8425e72a39dc57af741300913d33c5c2236d7f468b040dc32f54fa204300540c3126830127bf2c09b0e7afe529cc
SSDEEP 49152:U+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2vm:PKjKWQc+KjKWQc+KjKWQcZ
TLSH
T18F85AE09F9C340B1D93B55B00CCBD2BF8A74FA3585128E7BFB4DCB1B6A32B519818656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 13aad73f4e11fd9c06111f13057b3d3acc96225c39b4c5bbe86b09eaf5d199cf
MD5 ee1a4e40feee49b3b6de8a335387bcbe
SHA1 50910320f5fb54ad154a6d433a1c95f54747272c
SHA512 d85483cbdf587b9a31da76d87080fc87f24c4a454289f04c9d56083c3cac4e34626a3dfea17044ebdad13337e9259ec3b68457bf69c04d19115285ab95746971
TLSH
T19911C47278E6D867FC7368CBD519AB432C9835FB599CAA15131A822876CDC308E254A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4452-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4700-66-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5448-72-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5656-22-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5656-35-0x0000000000400000-0x0000000000421000-memory.dmp

Download