767b7bbc658a7d3a53fb564ad82f0de261d8055e7a133e9ca2ce8333afad4f73

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Size 1.9MB
Sample260818-zzy3dasvfv
SHA256 767b7bbc658a7d3a53fb564ad82f0de261d8055e7a133e9ca2ce8333afad4f73
MD5 46c40506e69d268357385db19d186c6e
SHA1 e1656fcc7f005ade42dc2d97ed54490ef502fddc
SHA512 3840d98726f064761c85fcc4e86a4909daaf118602b70e907941e8e7428ad8379be08ebec0816b0ffa437bb8ddb722f53dfa631e97837e8f47216fcb6d257b05
SSDEEP 49152:U+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2VhOC:HKjKWQc+KjKWQc+KjKWQc49
TLSH
T1A295A009F5C340B1D93B55704C87D2BE8A31FA3586218EABE749C63FAE33B91A434B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5728	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
4936	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
2376	svchost_ABABBCBBCCACAABCBBBABACCABBAABCBAACAABCABCBAAAABCCAAABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAAABBCCAAABBBBCABBAABBBBABCBABCABACBCCACBABCCCABCCCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe"	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBCBABACBBCBBCCBBAABBAABBCCCBBAABCAACABBABBBBCBACAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABBCBBCCACAABCBBBABACCABBAABCBAACAABCABCBAAAABCCAAABB.exe"	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5096	sc.exe
2948	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5580	cmd.exe
2332	cmd.exe
2708	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABBCBBCCACAABCBBBABACCABBAABCBAACAABCABCBAAAABCCAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5108	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
5108	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
5108	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
5108	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
5728	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
5728	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
5728	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
5728	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5728	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 5580	5108	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 5580 wrote to memory of 5740	5580	cmd.exe	94
PID 5728 wrote to memory of 4200	5728	svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe	95
PID 5108 wrote to memory of 2332	5108	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	96
PID 2332 wrote to memory of 5096	2332	cmd.exe	98
PID 5108 wrote to memory of 2708	5108	2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	99
PID 2708 wrote to memory of 2948	2708	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_46c40506e69d268357385db19d186c6e_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBBBBAAACCBABCBCBACABCAAACAABCBBBCBCBCBCCBAACBCABCBAAAAABCCBBCACCCBBACCCABBAAAAABCBCCACCABCCBCABACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBBBBAAACCBABCBCBACABCAAACAABCBBBCBCBCBCCBAACBCABCBAAAAABCCBBCACCCBBACCCABBAAAAABCBCCACCABCCBCABACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABAACCAACBBBCCAAAAACAACAAABCBCAAAABCAAACAACAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe" start= auto displayName= "UserDataSvc_AAABAACCAACBBBCCAAAAACAACAAABCBCAAAABCAAACAACAACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABAACCAACBBBCCAAAAACAACAAABCBCAAAABCAAACAACAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe" start= auto displayName= "UserDataSvc_AAABAACCAACBBBCCAAAAACAACAAABCBCAAAABCAAACAACAACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABAACCAACBBBCCAAAAACAACAAABCBCAAAABCAAACAACAACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABAACCAACBBBCCAAAAACAACAAABCBCAAAABCAAACAACAACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
1⤵
- Executes dropped EXE
PID:4936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCBBCCACAABCBBBABACCABBAABCBAACAABCABCBAAAABCCAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCBBCCACAABCBBBABACCABBAABCBAACAABCABCBAAAABCCAAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6e6df20d16c60691aa5deccc3cbf26ad0a587765a1e59ae130cbba576ef5fac
MD5 ab390ff88d756caf4352309b9c05cb02
SHA1 113d840cf78a6d6dc02234ffff46e1afcc53b65b
SHA512 475f2e3e80911f6ea8ed104b16e32930b8b29c90bdf3f8dc8a7c7e78c68927cf31732b694f6bb1ca27c7e8d39d12244e2215b3777b24cc287e1872d7c5908a8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a67537f921cab93929b10539121b2cd0667f9ab7d351f69e348fbafd478dea4
MD5 06860a44206fcd7b2291af31efec248b
SHA1 976725cbfc74fb19af956eaceb97b10d896cc497
SHA512 6f25c9042c46a0b6523f64be945587724540997e7e10934a28e337b56ae7be2d65e9e774e518a1148e4da190c493ab255f2b8cb5a95506b570fd661bf091210e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ed20aef66551531ad5381f7e2778f9a460cfa0331345dfac96be027ea01b993f
MD5 41618fbc49dda2280f0108f4bef8c18e
SHA1 c9be0b7775369d0e709a84090241658b33273094
SHA512 b29aef47b2df7bf62dcd4ed0b61aa28eb60f72e26caf01874548d60b4993f965ef0b8ebe105e89ee9c80ac6f83272bc1759ced16d66293e359cbc45f1ed9d0f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 378e9ffbda2dff8487c9f74ebe221dc6ba050088917e994da7cc2e33c011e489
MD5 6a1afed08e694331debdefa0f017bf1d
SHA1 94f2ddea226a7cb5ea35912eac3262b684f462b5
SHA512 e30e34db53140e171a094337020d4150f746cc8eb109e5943d5b982d14a1d5e551710e010bf2e70aec1f6d89d5a358f230af5769f1bfc94de1f35239f6a81e1c
MD5 SHA1 SHA512

Submit Download

svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACBBCCACCCBAAABAAACAABBAAACCAACBCBBABABABBABCACBBBBA.exe
Size 1.9MB
SHA256 767b7bbc658a7d3a53fb564ad82f0de261d8055e7a133e9ca2ce8333afad4f73
MD5 46c40506e69d268357385db19d186c6e
SHA1 e1656fcc7f005ade42dc2d97ed54490ef502fddc
SHA512 3840d98726f064761c85fcc4e86a4909daaf118602b70e907941e8e7428ad8379be08ebec0816b0ffa437bb8ddb722f53dfa631e97837e8f47216fcb6d257b05
SSDEEP 49152:U+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2VhOC:HKjKWQc+KjKWQc+KjKWQc49
TLSH
T1A295A009F5C340B1D93B55704C87D2BE8A31FA3586218EABE749C63FAE33B91A434B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5108-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5108-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5728-24-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5728-34-0x0000000000400000-0x0000000000421000-memory.dmp

Download