9cb67f7d1a029864e9b9765947f41231fc8068ea41e2faa00edf29f069ff9216

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Size 1.9MB
Sample260818-wweb1sfl5y
SHA256 9cb67f7d1a029864e9b9765947f41231fc8068ea41e2faa00edf29f069ff9216
MD5 336fd9e52bc78faf823b531437ca61ed
SHA1 4bd55b373bcc9f0c9565a3e30ff5e240c4d86657
SHA512 ed56f16299a4dd9db9da7fe3e619b89dc31ef262067414e3a109899cefd74833f1a543cbce8f5b869c0e7cf54f84b357a4a11ee89ca04dec03c3476f6a18d749
SSDEEP 49152:U+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2I:PKjKWQc+KjKWQc+KjKWQc7
TLSH
T1CF959E09F98340B1D92B51B00DCBD3BF8A74FB3585128E77EB4DCB1B7A32B51A41865A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2160	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
4560	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
5812	svchost_CAAAAAABCCCAABCCBBCACCAACAAAACBAACABABBABBAACCCACCCCCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCBABAAAABCAABCAACACBCBBCBCBACCACCABBACBCBACBABAAABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe"	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCABBAABBCBACCABACCBCBCABBCABABBACCCCCBCBABACCCBACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAAAAABCCCAABCCBBCACCAACAAAACBAACABABBABBAACCCACCCCCCC.exe"	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3520	sc.exe
2428	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2332	cmd.exe
3532	cmd.exe
628	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAAAABCCCAABCCBBCACCAACAAAACBAACABABBABBAACCCACCCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4220	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
4220	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
4220	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
4220	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
2160	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
2160	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
2160	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
2160	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
5812	svchost_CAAAAAABCCCAABCCBBCACCAACAAAACBAACABABBABBAACCCACCCCCCC.exe
5812	svchost_CAAAAAABCCCAABCCBBCACCAACAAAACBAACABABBABBAACCCACCCCCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2160	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
Token: SeDebugPrivilege	5812	svchost_CAAAAAABCCCAABCCBBCACCAACAAAACBAACABABBABBAACCCACCCCCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 2332	4220	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe	91
PID 2332 wrote to memory of 2988	2332	cmd.exe	93
PID 4220 wrote to memory of 3532	4220	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe	94
PID 3532 wrote to memory of 3520	3532	cmd.exe	96
PID 4220 wrote to memory of 628	4220	2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe	97
PID 628 wrote to memory of 2428	628	cmd.exe	99
PID 2160 wrote to memory of 5768	2160	svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_336fd9e52bc78faf823b531437ca61ed_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAAACCBCCAABAAABCBABBAACBAACCCBAABBCCCAAABBCABCCAACBBACBBBBABCAACCCACABCAABCCBBAAACCCCCCCABABBABABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAAACCBCCAABAAABCBABBAACBAACCCBAABBCCCAAABBCABCCAACBBACBBBBABCAACCCACABCAABCCBBAAACCCCCCCABABBABABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCACCACCCBBBCACBBBABBCBBACBCBBBCCBABCCBACCAACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe" start= auto displayName= "UserDataSvc_BCABCACCACCCBBBCACBBBABBCBBACBCBBBCCBABCCBACCAACBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCACCACCCBBBCACBBBABBCBBACBCBBBCCBABCCBACCAACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe" start= auto displayName= "UserDataSvc_BCABCACCACCCBBBCACBBBABBCBBACBCBBBCCBABCCBACCAACBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCACCACCCBBBCACBBBABBCBBACBCBBBCCBABCCBACCAACBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCACCACCCBBBCACBBBABBCBBACBCBBBCCBABCCBACCAACBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAABCCCAABCCBBCACCAACAAAACBAACABABBABBAACCCACCCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAABCCCAABCCBBCACCAACAAAACBAACABABBABBAACCCACCCCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cdceb800ee2ddb5dfec829f0e11604dce2ffed73d1c2bb289edb7dda6254b77e
MD5 87fa77ddc137212dbcb3bff0b41aac67
SHA1 51e1dd2c2ffe7ed05c8367666769a52467f39396
SHA512 f54913df3af24ddfc7931d2796035c61c343af5a76263f380ff69dbc03686fc7a1b327579d4bb2426eb29bfe80c4c70d1377ecdd0e693a00a928c859d6b85c80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4de59e3c22f529f91eac447fba8af2b62744ded379f777f189a38b6b277d8ec2
MD5 b828692f3b240b4be03973c9acfbb526
SHA1 8313b388c064e5cff8a18616140d4f25a1693384
SHA512 01b285af9c8537f2e6a118029cd5fea350a08a97499766295d7899ef05093b043648949917b5d7241c610db78cf37a78be0415682a640503da56da69ac76ae98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6a14574ed86e36ec5dc3bb87565f123e527992b8e94898d7d468b368aee8933
MD5 c528ef2a2e27e8694c7071ce6d211f55
SHA1 16575225942c30d0efe68beff20b431c02df47fa
SHA512 661cebc63523a744de6caef1edf7aee4e43ea5a401a57b3294750bea11665ca3d98db397c50390bf2ba90995bd5518020862c31ed4d216a229930ba7f49d65cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f972b1a57a69c27156918f2e823114ea5b8edfaf2ed1374255dad108b499c930
MD5 82ceade26479478a3bdd499dd8f291bc
SHA1 6250a7895352e82d7e00b4868a60cb781c4a2eb7
SHA512 3a887355704a8cceb38947982e5c25e82739b8b6056d2db3bde3de261db6e2e96a7da82beb74cecbecccb4d62d754226f8df87a8198a3373ac35e563669df7bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aeb9910af24bbad36aa936dcb63485b5ff5c2c62846912ceb8dc64cf428f62e5
MD5 5506f3e6ab22e181fe60ec38c68cca6b
SHA1 c00fc3ec9a1a862477758b7b42fd0bd18632f08b
SHA512 7bb97f789e8ecec221644b061c6273ac24f55e860d0271b232aebadcfbbcb0bfe0fd79cff1bb2adfd9154982003deb00da2ae0df04be1c4d1b79c21885e29d59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ae685873261e08f2cb8e9c6e9a60d3c53e750ddffffed2444ba31d3c5356e8ea
MD5 3f68fbdd613d3774b011ac0aa1f60b0d
SHA1 bfbe3ed4f67c4bad8d567148cc8cfc61dc75d4df
SHA512 a5c4aa9e7b9807fb8102450009a4f4bbff165f350a59786bb5b9a739b574bde4451fbb58322d0a00c2a3d096d89ab4aed3b05bbd7ddee920a2c7448421d9e133
MD5 SHA1 SHA512

Submit Download

svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAAAAABBABBCCCACACCBBCABBACABCCBAACBCCBBAABBAAABACC.exe
Size 1.9MB
SHA256 9cb67f7d1a029864e9b9765947f41231fc8068ea41e2faa00edf29f069ff9216
MD5 336fd9e52bc78faf823b531437ca61ed
SHA1 4bd55b373bcc9f0c9565a3e30ff5e240c4d86657
SHA512 ed56f16299a4dd9db9da7fe3e619b89dc31ef262067414e3a109899cefd74833f1a543cbce8f5b869c0e7cf54f84b357a4a11ee89ca04dec03c3476f6a18d749
SSDEEP 49152:U+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2I:PKjKWQc+KjKWQc+KjKWQc7
TLSH
T1CF959E09F98340B1D92B51B00DCBD3BF8A74FB3585128E77EB4DCB1B7A32B51A41865A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e8c5616a4a7954cb3ada7544e06eb58dccf197cf4ebf152e7ff92ebc721be4f3
MD5 6c5403bae70a3c0a456d7abb6c64ed28
SHA1 1ba62257289cf48d6f9f31cd7e42bda802298005
SHA512 a474dbbd0b5567a7d2dca3592b87ced84ed065728d1ae57977e647a9a06ff38f52f299012353481fae98d2aca0480d6d0eb8c50a36240cae3cf909da25b5f6e1
TLSH
T11D11E771ECE59CA3FD73289F563E9B431CE436EFAC5CAA1A12154319A791C31CE118E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2160-35-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2160-22-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4220-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4560-66-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5812-72-0x0000000000400000-0x0000000000421000-memory.dmp

Download