d942e6948e672fc9c7989bd5b9de5d6511db116393a60ae6f127713a3c55f5dd

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Size 3.7MB
Sample260818-y2maxsbb76
SHA256 d942e6948e672fc9c7989bd5b9de5d6511db116393a60ae6f127713a3c55f5dd
MD5 ad8f453d93892e472e87b3b210e62dc1
SHA1 a141d0b7f288b6da382394a8d47eec2d39eaf8ef
SHA512 d7b872adb0691bc860c8768389e7a8fdbe106f73b6b9f4ace09500af4810476d52808e75fe64213d1ee282bd072e1b41fcfc45c7a6f2d7e295196a6a31ee26d9
SSDEEP 98304:PKjKWQc+KjKWQc+KjKWQc+KjKWQc+KjKWQc+KjKWQcJ:0KWQcDKWQcDKWQcDKWQcDKWQcDKWQcJ
TLSH
T1B1069E09F98340B1D92B55B00CCBD3BF8A74FB3585128E77EB4DCB2B7A32B51941865A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3036	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
5772	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
2276	svchost_BBACCACAABBABCBCACCCAAACAABBACABBBCACCCBAAABAABACBCCAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCCBBBCBABBCABACACAABBCAACBCCCBABCCCCABAAAACCCBBBAABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe"	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCACCCCBBACCCCCACCCBABCBABBACBABACCCAABABAACBACCBABAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACCACAABBABCBCACCCAAACAABBACABBBCACCCBAAABAABACBCCAAC.exe"	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1496	sc.exe
1264	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4928	cmd.exe
1688	cmd.exe
1252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACCACAABBABCBCACCCAAACAABBACABBBCACCCBAAABAABACBCCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1004	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
1004	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
1004	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
1004	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
3036	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
3036	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
3036	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
3036	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
2276	svchost_BBACCACAABBABCBCACCCAAACAABBACABBBCACCCBAAABAABACBCCAAC.exe
2276	svchost_BBACCACAABBABCBCACCCAAACAABBACABBBCACCCBAAABAABACBCCAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3036	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
Token: SeDebugPrivilege	2276	svchost_BBACCACAABBABCBCACCCAAACAABBACABBBCACCCBAAABAABACBCCAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4928	1004	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 4928 wrote to memory of 1156	4928	cmd.exe	94
PID 1004 wrote to memory of 1688	1004	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	95
PID 1688 wrote to memory of 1496	1688	cmd.exe	97
PID 1004 wrote to memory of 1252	1004	2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 1252 wrote to memory of 1264	1252	cmd.exe	100
PID 3036 wrote to memory of 4088	3036	svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_ad8f453d93892e472e87b3b210e62dc1_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCBCAACBBABBBBBBAAABBBCABCBCBAAABBAABBABCCCBBBBABCCCABBACACABCAAABBBACBCBBAAAACBABCCCCBCACAABACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCBCAACBBABBBBBBAAABBBCABCBCBAAABBAABBABCCCBBBBABCCCABBACACABCAAABBBACBCBBAAAACBABCCCCBCACAABACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACABBBCAAACABCBBACBBACBCCACBCABCBBBABBCCBCCACACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe" start= auto displayName= "UserDataSvc_BBACABBBCAAACABCBBACBBACBCCACBCABCBBBABBCCBCCACACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACABBBCAAACABCBBACBBACBCCACBCABCBBBABBCCBCCACACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe" start= auto displayName= "UserDataSvc_BBACABBBCAAACABCBBACBBACBCCACBCABCBBBABBCCBCCACACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACABBBCAAACABCBBACBBACBCCACBCABCBBBABBCCBCCACACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACABBBCAAACABCBBACBBACBCCACBCABCBBBABBCCBCCACACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
1⤵
- Executes dropped EXE
PID:5772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCACAABBABCBCACCCAAACAABBACABBBCACCCBAAABAABACBCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCACAABBABCBCACCCAAACAABBACABBBCACCCBAAABAABACBCCAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9904dbb7c9af9eb04eb8cf4f2c20ff1058bc580d52549866fd2f929a63e7fb27
MD5 102d96118b92f1bd7688bc9a6a8c34cc
SHA1 aaefdb500fb565107fcb2487e06da18aa01b6dcf
SHA512 ee43da13c99f0e992da6cecc87e8ff52c6647b7d01cdc42909d65c47bf16b1aad51c901244509eea9a1a63571bf660d04776be6078261fbfe354f5dc713111a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a176adf65f3e7e185b08ad9a2356299cc5c3bb636d0a53a949832a8747659c2
MD5 946af5f9723cd6bbafcf646116530c87
SHA1 29f5ec81075d7cb6a22f2c75105c2289d0cd052f
SHA512 0d8d1f3ed74b34c6d5bd31c1dbf3057a0ce06d40390ca936511af7edfc7260f74ff7734bbac4ce243280fd03fa2598bfa057e95a3025de83e682509c9fa1c289
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 51029cdd9a0c19e816786ca2cda29ae7f35c15cb2d86bc9686e835aaeb5dde64
MD5 d010734eda4126d807ca41712ffca051
SHA1 5cb54fb268070b008d590d0ebcf165c7318d51fd
SHA512 cde8ee5c65594b010be1b2cf36a97cca39000c033d7554f4b0b4ca11f15bf412f709c3467da1920d91cf51ded2802bc904b34f07a642c1cd649581e346297f09
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cc0ac54511d19a280b17c0576f39a10d60ffb271d603c97fc9a3b131ea78fdfa
MD5 782ae164525f4718f2f25ef871b1879d
SHA1 d76eff9f4623bebe6380c4a59a545f4d02a4e2b1
SHA512 4f7d00ad35888d35949d47ba7f1d537cd88eb92e55353b411b89194629894664f2adc62b71d7de2992dba6e202ca6bc77cf6eace16c737e6736ad5981fe0eb9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef6ffb171b19c9597a8d7f9e910b729bc138a33e7a13b0020f8878e335dc664d
MD5 dc1582bbb96a714b6914283756c1c3b2
SHA1 0c94782d50c049cdac0a61adf422082ffd489a71
SHA512 ecd7c6e6262224a869548b811d41642d6e4b7da57b0fd18806903c0df63fb85bcb80a7612ff0ae719ca8aa56bf7727f1e51026af7fa2f86570241eb7b7fb7000
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 42ec48d55a08ed77da9fa338a65fed5effb79ca9bba429ccff821cae36c1abb1
MD5 cfe117fb7e0b18e404a0c1386e74b844
SHA1 9521c494668b291b3b3d8cb25b2234af2064ee86
SHA512 bec189a24f6fc10637c058d52b1733085603daa0f060a2ec3b131214a40b674b3245823dfc5d286c76bd5e73f0058d4aa51aaabe1f12cd6c9a3fbfbe64948f09
MD5 SHA1 SHA512

Submit Download

svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACAAACCBACABBCABCCABBCBCBCCACACABCBABBACCBBBCCCAAAA.exe
Size 3.7MB
SHA256 d942e6948e672fc9c7989bd5b9de5d6511db116393a60ae6f127713a3c55f5dd
MD5 ad8f453d93892e472e87b3b210e62dc1
SHA1 a141d0b7f288b6da382394a8d47eec2d39eaf8ef
SHA512 d7b872adb0691bc860c8768389e7a8fdbe106f73b6b9f4ace09500af4810476d52808e75fe64213d1ee282bd072e1b41fcfc45c7a6f2d7e295196a6a31ee26d9
SSDEEP 98304:PKjKWQc+KjKWQc+KjKWQc+KjKWQc+KjKWQc+KjKWQcJ:0KWQcDKWQcDKWQcDKWQcDKWQcDKWQcJ
TLSH
T1B1069E09F98340B1D92B55B00CCBD3BF8A74FB3585128E77EB4DCB2B7A32B51941865A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a30a6d22dd82c26ae60a8d0b5963a6ee36c93b1a14cb856e62358a878aad822c
MD5 2bbffaae783972f81706efe9b732703d
SHA1 37965cbdf8ea67c94d5dbecf4f55723944deab34
SHA512 a5d5d77f56fb4a564a52927f90c123b9e786148cd8d3d477853af835e79f43ee946221750c273aec065ee84a9daaa2c0d2832a3a5daf6003c1e6ca586bf6eb5c
TLSH
T18A11EB66A4E99C17F832389B691DEB520DB0355FAC9C6A55231C52186FC1C32DE298F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2276-72-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3036-35-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3036-22-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5772-66-0x0000000000400000-0x0000000000421000-memory.dmp

Download