f08731c2d2ce5c493af2c8c6ec06043219fbc966264e939f0cffa70cae3a2320

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
Size 1.9MB
Sample260818-ynk6psgn2s
SHA256 f08731c2d2ce5c493af2c8c6ec06043219fbc966264e939f0cffa70cae3a2320
MD5 d7c9c48d6c756632e0992440e3039761
SHA1 9e65d1c7a8ea2ee526d037b90bbcc476d359d0ec
SHA512 087632ae167068a86831fe8f4dce7f205344973b573a725667dd606d903c0e3d06b73330a3493a175a8191f43e4346a590067d3ad68524744eaff125be9e7780
SSDEEP 49152:U+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2/LZ5zot7UcV9CUh1N+lVHrjc:PKjKWQc+KjKWQckLZ1opDbSVHrjc
TLSH
T16595D022F4824072DA7600725D4AD27A9E38FF3446118D6BF7C8EF1F7E31A91A637256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3020	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
5824	svchost_CABCCABAAAAACAAAAAAABACBCCBABBBABABCBAABABCCCABBCAACBCB.exe
3796	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABAAABBBCABCCABBAABCAAABCCBCAABBAABBBBBBBCBCCBAACABCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe"	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABABBCAAABCBBCBBACBAABACBBABCACACCAACAACABBBAABACBCBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCABAAAAACAAAAAAABACBCCBABBBABABCBAABABCCCABBCAACBCB.exe"	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1036	sc.exe
5656	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2348	cmd.exe
5672	cmd.exe
1588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCABAAAAACAAAAAAABACBCCBABBBABABCBAABABCCCABBCAACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3584	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
3584	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
3584	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
3584	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
3020	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
3020	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
3020	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
3020	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
5824	svchost_CABCCABAAAAACAAAAAAABACBCCBABBBABABCBAABABCCCABBCAACBCB.exe
5824	svchost_CABCCABAAAAACAAAAAAABACBCCBABBBABABCBAABABCCCABBCAACBCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
Token: SeDebugPrivilege	3020	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
Token: SeDebugPrivilege	5824	svchost_CABCCABAAAAACAAAAAAABACBCCBABBBABABCBAABABCCCABBCAACBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 2348	3584	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe	91
PID 2348 wrote to memory of 2952	2348	cmd.exe	93
PID 3020 wrote to memory of 3260	3020	svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe	94
PID 3584 wrote to memory of 5672	3584	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe	97
PID 5672 wrote to memory of 1036	5672	cmd.exe	99
PID 3584 wrote to memory of 1588	3584	2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe	100
PID 1588 wrote to memory of 5656	1588	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_d7c9c48d6c756632e0992440e3039761_amadey_coinminer_elex_hellokitty_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCACAAAAACCCBACCAACBBACACACAACCBBBBAAABBAAACCCAACCCBCAABAABAABACABBBAABACBBCABCCCAACACAACAABBBCCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCACAAAAACCCBACCAACBBACACACAACCBBBBAAABBAAACCCAACCCBCAABAABAABACABBBAABACBBCABCCCAACACAACAABBBCCBAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAAABAACCCBAABABBACABBAABABBCABAAACCBCAAAACCBCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe" start= auto displayName= "UserDataSvc_ACAAABAACCCBAABABBACABBAABABBCABAAACCBCAAAACCBCCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAAABAACCCBAABABBACABBAABABBCABAAACCBCAAAACCBCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe" start= auto displayName= "UserDataSvc_ACAAABAACCCBAABABBACABBAABABBCABAAACCBCAAAACCBCCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAAABAACCCBAABABBACABBAABABBCABAAACCBCAAAACCBCCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAAABAACCCBAABABBACABBAABABBCABAAACCBCAAAACCBCCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABAAAAACAAAAAAABACBCCBABBBABABCBAABABCCCABBCAACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABAAAAACAAAAAAABACBCCBABBBABABCBAABABCCCABBCAACBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
1⤵
- Executes dropped EXE
PID:3796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad366dfaf9f10172f580e1d5ab4b83968bd63bb5e8d2b5d0ba17c3cc0f4b1b67
MD5 8d97742653eae7b07e31bbbc70a9c0e0
SHA1 b0c1a59279e2a40173cf09652e9df43cfe7122e4
SHA512 81f2ae2202b8cd96d54db5dc1236d5e3684640cbdf7a326e33ac25b3f7ea221c07523cd2a10f4c78ab9d0c06b7635caa0c5729d6076ae35455ddd28c9f83ca99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d36465b5a82cc5d229edacdab7abc433b46f0ba85e8c34090c84cebc7273e210
MD5 35a38c5288566e0d610adf8b5f28f851
SHA1 40c6efb3ff5778a8a68e703f8e5ea6255e002bf9
SHA512 34e6039a4eafc42d5e7548b419c10feeab6bc43450ef6c25d54a6fc069d1881f497cff618b85eead24c872aa123368289df19e1fbbd23919211dc9068bed2619
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f28a7fd2d3a07d655b0ecead3925688f9e2ccc30058ddf2541924601c20382f3
MD5 22fd0ac195e426c99a9362dbd02f942d
SHA1 626784c0a7c595d97fe21f3ae4a8e4e93d1bb7d4
SHA512 58486fff0075c49d745d94c0b33fab8b1182e2f4798a22eb7ddb243021d8b00d694f469b89aa466cdc0069d8117bf4a2aea66db6e3c65f83d8634834ef321149
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a4a17158699db297917f6bad1760c392cc20f14133c5fa742ee38835aae41121
MD5 56f7e1843baa9ef892f9facb404d52ee
SHA1 1a580be18b07e23167851371f17742395700b7c2
SHA512 899e534183e9ed3e55b78b1bd218d43aa7a443b7e550d5a760127c29abff17b43420d6ded910dc04010b547e4e60cca476ffecaa7aa5340b92197fe4f50455f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af9760ab92570d8112bd274ae10d919f52c8dc3682fb09550507509d38f9572f
MD5 09f9f1ec05f48dbe822bf84fa588fb16
SHA1 a4e85e22375ac62268beee1dfef2c47af745acb8
SHA512 467709985f8ecef434a409af1da4628bd2e01ad0e60bf7e5ed1c927b920579e8999d46bf5028370d24c723ed2977cf66404e80b028861ea9e6d5d87a0abd40bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 85bfbac96bb4de586dd4337a273fbfdba91345b077b03d22aefcbeeab18463dd
MD5 35101e8d4ba579795d820df665491335
SHA1 055cde5281722ffa05ed4d79cdc23eb16afad849
SHA512 ecde77c7287680cf3a9bb18e9d9fbb5037abf41b196d79edc017540534b877d131b059a41d38ebd5224a35202fb0d0654af9a5508f9a12319b30f4c169e2384f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fb9928dcebc44c9db644c04e39a0a313d23027bfa624f3685291078f042e6a99
MD5 4da5997ea53fef04d5c73f121be1512e
SHA1 781fed2074612e2a3999c881ec0d7efdd20288c7
SHA512 21d7e40fbcf7db575dc57f6f9d45777ba15018b7b2b4e1b5a85c476ea038b221ebe2aca13e0c484ad9786c7850f66e460456eeff57746fefd35d0073b888399b
MD5 SHA1 SHA512

Submit Download

svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBABAAACCACBBBCCCCCBAABCAABBBCCBCBCACCBCBBCBACBAAAB.exe
Size 1.9MB
SHA256 f08731c2d2ce5c493af2c8c6ec06043219fbc966264e939f0cffa70cae3a2320
MD5 d7c9c48d6c756632e0992440e3039761
SHA1 9e65d1c7a8ea2ee526d037b90bbcc476d359d0ec
SHA512 087632ae167068a86831fe8f4dce7f205344973b573a725667dd606d903c0e3d06b73330a3493a175a8191f43e4346a590067d3ad68524744eaff125be9e7780
SSDEEP 49152:U+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2/LZ5zot7UcV9CUh1N+lVHrjc:PKjKWQc+KjKWQckLZ1opDbSVHrjc
TLSH
T16595D022F4824072DA7600725D4AD27A9E38FF3446118D6BF7C8EF1F7E31A91A637256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 516100d5bc7dcc6bee7605f8be53c66404f028a47a373c047793252b9bad534a
MD5 43d5770abfd6d97e9df82c14c4731c4e
SHA1 af3c48e426bd2b403d2608d7b13a19402a81b160
SHA512 0e1adba0589fb451a06fa1c6f23c4a85a48c0004a42897a2a5d2238e92f1bfafef6a93147236b9369c091698219c5be35298e1c52ae542e9f5227da1ec8e447f
TLSH
T11111E37078F5DC53FD3328CB922EDA878CB4279B6C5C6A15131A922C6AC9C31DD594F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3020-34-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3584-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3584-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5824-80-0x0000000000400000-0x0000000000421000-memory.dmp

Download