3da7abfd2a186c8491cd75cb7f65929824e3c8a00ea5ea5e4574b3d615a2f4d3

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 27.0MB
Sample260819-e7bltsdn7y
SHA256 3da7abfd2a186c8491cd75cb7f65929824e3c8a00ea5ea5e4574b3d615a2f4d3
MD5 ba6c70082aa706e10dfd4bdca0d2c1db
SHA1 83688560a90f81f7aa63748d9dfd09bf64a96c49
SHA512 40a1d52ce4f6499a42a9f9c902d28fc6de39b38babcc5a0451458be813ac30bef7ec0f99c9db3fe724079a4cf92232b88f26c3c4ad93d898f62caa60c1883c30
SSDEEP 49152:U+ES+E7+ES+ES+E2+ES+ES+EZu+ES+ES+E7+ES+ES+E2+ES+ES+E7+ES+ES+E2+5:0KjKWQckVgtev5mnlNLc
TLSH
T1EF575C09F94340F1D92B50B04DCFD3BF8A60BB2586128DFBFB4DCB5B6923BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3376	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
4656	svchost_BBACACBAACACCBACABBCCAACABCCACABBABCBCBCACCBBAABBBAAABA.exe
4460	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABACABCBCCBBCAACABABBBABACCBAACACACACBCABACCAACCBCBCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACACBAACACCBACABBCCAACABCCACABBABCBCBCACCBBAABBBAAABA.exe"	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABCBCACBCCCACCBBBAACBAAAAACBCCCBAAAABCCACAACACABABCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe"	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3372	sc.exe
3528	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
636	cmd.exe
2216	cmd.exe
2588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACACBAACACCBACABBCCAACABCCACABBABCBCBCACCBBAABBBAAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2184	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2184	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2184	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2184	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3376	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
3376	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
3376	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
3376	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
4656	svchost_BBACACBAACACCBACABBCCAACABCCACABBABCBCBCACCBBAABBBAAABA.exe
4656	svchost_BBACACBAACACCBACABBCCAACABCCACABBABCBCBCACCBBAABBBAAABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3376	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
Token: SeDebugPrivilege	4656	svchost_BBACACBAACACCBACABBCCAACABCCACABBABCBCBCACCBBAABBBAAABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4628	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 636	2184	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	95
PID 636 wrote to memory of 1908	636	cmd.exe	97
PID 3376 wrote to memory of 4600	3376	svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe	98
PID 4600 wrote to memory of 2432	4600	notepad.exe	99
PID 2184 wrote to memory of 2216	2184	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	103
PID 2216 wrote to memory of 3372	2216	cmd.exe	105
PID 2184 wrote to memory of 2588	2184	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	106
PID 2588 wrote to memory of 3528	2588	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBCBBCAACCAACACBCCCBBBAABCCCBABAAACACABBBCACACAACCCAABBCABCBBCCBCCBABABACCCBACACBBCBCACBAABBACABABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBCBBCAACCAACACBCCCBBBAABCCCBABAAACACABBBCACACAACCCAABBCABCBBCCBCCBABABACCCBACACBBCBCACBAABBACABABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCCCBCBBBBAABBAACAABCBCAAACBCCABABBABCAABBABBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe" start= auto displayName= "UserDataSvc_CAACCCCBCBBBBAABBAACAABCBCAAACBCCABABBABCAABBABBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACCCCBCBBBBAABBAACAABCBCAAACBCCABABBABCAABBABBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe" start= auto displayName= "UserDataSvc_CAACCCCBCBBBBAABBAACAABCBCAAACBCCABABBABCAABBABBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACCCCBCBBBBAABBAACAABCBCAAACBCCABABBABCAABBABBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACCCCBCBBBBAABBAACAABCBCAAACBCCABABBABCAABBABBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBAACACCBACABBCCAACABCCACABBABCBCBCACCBBAABBBAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBAACACCBACABBCCAACABCCACABBABCBCBCACCBBAABBBAAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
1⤵
- Executes dropped EXE
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13a656dd752d3ab358ff6c39e8dacb36cc06c9dbec771cdf2cd65c6abdb0e987
MD5 bfead59ccc86995ed1eb9e69332b9fcf
SHA1 da408b549312078e1758562aca09b99b90977567
SHA512 1d327ef7397d16899bb816be979eb0f547ebf385fa66f40d5a3995c4215b8af52eea3724841d44ffd7d41db121cce94893a474b763a2208b8e0c575a2f97a323
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21795ab3a33975839a5e55d4e3114457dc4d69538f1dc9c746694c8740f87e7b
MD5 9b61f955b02f4102f44d863a58298ba7
SHA1 172dd400d03bf45edc270a082258e61a16338613
SHA512 9a6c050d9cf102a706fce44b15ddfce4e0d279963367ec59ba5e572efdc5868fee7a6a1a2c0261ea7a88b99a909fc0e0a9fb14ff152344c5ab215f4dee09b393
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c1feb66dc1a8face5ec52e3ff70a8e7a1fa052a64242a38dd0dde68a3397040
MD5 238f930fd844da06a4d202cca7d47eab
SHA1 e469b5f93cc3f3e1282a6afb00cd8d84af952cb2
SHA512 44b3f00fc1361009bb123d73b616aaa850cfb9035a441ab9439adcc65a878d181a7bd0ac9184cab1f3adad81a87eae19a231162211914f5f65059f7ddb67f01a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ea6f4669f76068ab236f46517e2fc563656158fd9c09dcf94c7f70a9510e61af
MD5 5c9f4c9e7ac226f09c662a68cea3465b
SHA1 cf5a128023dc3b8191d93a72be471c21025563c9
SHA512 d2fb550f55b0f6068f4b82d0f4208bec6e511c321199a7e37f3337a12f05b89e307ac760baeb6a2fd473565c42e178b1cb78621b6a77f1a6f32c47b5486a82b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b42aa74b08387f997762c3e58d257681194d50dd6eeb78c652b0d3e7295d90be
MD5 a41b577a1f357c069a7e2992741d905a
SHA1 beef697fae5f0282d311d8e6285daa08e43bcca3
SHA512 a114422b846e641b1a37f0b4e61fd49088eb7066ef9191bb4e8f395ac2fe683bbaeabbf6f8846b654673193fd9747ef40eba3874d2ff74598ba21d0c26a1b88a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6b610581f553188bd003b10579322d4555fe4b0455bb91b067dd302bd8b86a19
MD5 e661738c8081e3b6c1260e2840a9e57b
SHA1 e91647fabd0f9d448c7f7411f1092c12e6d6bf4d
SHA512 ccbfbfab808c5fb74066d3d3bee27ea0f4c54aaee924061496fdb9cb5cbef114c4beca3765a961889fde7f8a655804f09d5889249f8f02df80026d7c91db3413
MD5 SHA1 SHA512

Submit Download

svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCBBBCACBCBAACCACCCACBABCABBABCBBAABBBCCBBABBBBBCBA.exe
Size 27.0MB
SHA256 3da7abfd2a186c8491cd75cb7f65929824e3c8a00ea5ea5e4574b3d615a2f4d3
MD5 ba6c70082aa706e10dfd4bdca0d2c1db
SHA1 83688560a90f81f7aa63748d9dfd09bf64a96c49
SHA512 40a1d52ce4f6499a42a9f9c902d28fc6de39b38babcc5a0451458be813ac30bef7ec0f99c9db3fe724079a4cf92232b88f26c3c4ad93d898f62caa60c1883c30
SSDEEP 49152:U+ES+E7+ES+ES+E2+ES+ES+EZu+ES+ES+E7+ES+ES+E2+ES+ES+E7+ES+ES+E2+5:0KjKWQckVgtev5mnlNLc
TLSH
T1EF575C09F94340F1D92B50B04DCFD3BF8A60BB2586128DFBFB4DCB5B6923BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 d808818530f75b8f8a8bb15c4e741b8ea0c8dbb0621db16ada938e106ce8e32a
MD5 07cb60430770512b1a93031f8e360c35
SHA1 84d5b7cfa4c013b1ffec78195130a3c3b97dd187
SHA512 f3ae80ae0c8c8366b3583fcc94a90e1bbc8bddce01c3de26f69bca8bf8c8b2e3b6cc9d2c3290e702ea395c6f305cef9b995f4f41ace70dea55db14af6e14a6d0
TLSH
T182112E51ECD5D877EA3224CB662F9BD28CE4374FACDCDA0423084508EB85D729D594F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2184-0-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/2184-7-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3376-36-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/3376-26-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4460-89-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4600-60-0x0000000005A30000-0x0000000005A31000-memory.dmp

Download

memory/4656-78-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download