290ff23057daf000bfccd6140947b1b9d7d2d22ec780ec73800ef000eb7e23ca

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 26.4MB
Sample260819-ec1bpscg87
SHA256 290ff23057daf000bfccd6140947b1b9d7d2d22ec780ec73800ef000eb7e23ca
MD5 f4dda1891cf1afd5db8bb9ff4e2e0192
SHA1 2bc51aada6d6c982c210b80eb13bddcfa5edb247
SHA512 bd73ddd9a01fe597470b511ff13e1c5c0c998c19b87df8a9157571d399f98be9f034e73cebce555f5732072bb820270c7bc9f053720a151ed2fa29cf2c9006e2
SSDEEP 98304:frgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr:+KWQc0gEYnvLJ
TLSH
T1C757390F66EC00A6D87F8276E6D58166C670B031672159EBE150CB3D9F6FAD1A83DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2104	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
3532	svchost_BCAACCACABCACBCACBBACCBACABCAACCCACCCABBBCBCBBCCAACBACA.exe
4244	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAAACABCCBCCABACCCBCAABBBABACCCCAAAACCAACACACAABAAAABCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe"	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACBCABACACBBACACCAABBABCBBCBBBCCBCBBCABBABCCACBCCABCCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACCACABCACBCACBBACCBACABCAACCCACCCABBBCBCBBCCAACBACA.exe"	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3420	sc.exe
4256	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
900	cmd.exe
3712	cmd.exe
1348	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACCACABCACBCACBBACCBACABCAACCCACCCABBBCBCBBCCAACBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
396	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
396	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
396	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
396	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2104	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
2104	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
2104	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
2104	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
3532	svchost_BCAACCACABCACBCACBBACCBACABCAACCCACCCABBBCBCBBCCAACBACA.exe
3532	svchost_BCAACCACABCACBCACBBACCBACABCAACCCACCCABBBCBCBBCCAACBACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2104	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
Token: SeDebugPrivilege	3532	svchost_BCAACCACABCACBCACBBACCBACABCAACCCACCCABBBCBCBBCCAACBACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3872	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 900	396	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	96
PID 900 wrote to memory of 4228	900	cmd.exe	98
PID 2104 wrote to memory of 4880	2104	svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe	99
PID 4880 wrote to memory of 2340	4880	notepad.exe	100
PID 396 wrote to memory of 3712	396	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	104
PID 3712 wrote to memory of 3420	3712	cmd.exe	106
PID 396 wrote to memory of 1348	396	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	107
PID 1348 wrote to memory of 4256	1348	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBCBABCAACCBCCCCCAACBBBBBBCBABCBBBCBBABABBBAACCBAACCACBBCCAABBBCABABAACACBCCCBBACAACCABBBCBABCBAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBCBABCAACCBCCCCCAACBBBBBBCBABCBBBCBBABABBBAACCBAACCACBBCCAABBBCABABAACACBCCCBBACAACCABBBCBABCBAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBCCBBACCBCABCBCBBCCABABBCCBBCCBABCACBCBBABACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe" start= auto displayName= "UserDataSvc_BACBBCCBBACCBCABCBCBBCCABABBCCBBCCBABCACBCBBABACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBCCBBACCBCABCBCBBCCABABBCCBBCCBABCACBCBBABACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe" start= auto displayName= "UserDataSvc_BACBBCCBBACCBCABCBCBBCCABABBCCBBCCBABCACBCBBABACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBCCBBACCBCABCBCBBCCABABBCCBBCCBABCACBCBBABACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBCCBBACCBCABCBCBBCCABABBCCBBCCBABCACBCBBABACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2340

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACABCACBCACBBACCBACABCAACCCACCCABBBCBCBBCCAACBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCACABCACBCACBBACCBACABCAACCCACCCABBBCBCBBCCAACBACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
1⤵
- Executes dropped EXE
PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af27c060ea82af1cb9575dcf9857b7e92d2b8445e0d6087fe13835391fdd1168
MD5 c65fce4af11220983170c5a7d9102556
SHA1 2c70b7eb8606f0efbdcdc8c4a677be9b988064d7
SHA512 bdd24ee2145e770e68a2df3eb4bb6680bc5206b5aadb123a24942fe5d714bbcb430e49ddb1b10949b1cbafa93ef7e4da591cd24bc6791988e8bf201a66a4a81e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18fdfd66e95389f3f595361972ea9b2133d85f822782ca1fa91dd51bc7d3aef3
MD5 5e9b87a5cc8d72d190e89025a048d8fe
SHA1 0d4da94947ab2ffdc58fd3c0007f7232505895fe
SHA512 2b98073cfb75fe981fc9c5999c023460f0046f8808f634dedc057a3ca5f4279406300b6a8c853803430a3996d48bc4cc40efff28bf4dea4da63154b20dd7d399
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 183ea3034020d026f46d53f76056d52667623734fcba0cde5826ec3cc8752621
MD5 752ab03f787965c1f06b333111e200b0
SHA1 76d00cea776d08a48e66d65bbd202f3cba8c3188
SHA512 b007e11af507f04e67915f6a0ff2b349bec3949f439a7b5e635f214eb7791b1097528778ea46311516953c87f17369968dce71ce85f308346b8d516834ea6481
MD5 SHA1 SHA512

Submit Download

svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBAAACCCAABACBBAACCABBACAAACABCBBCCBBACCBBACBBBCCA.exe
Size 26.4MB
SHA256 290ff23057daf000bfccd6140947b1b9d7d2d22ec780ec73800ef000eb7e23ca
MD5 f4dda1891cf1afd5db8bb9ff4e2e0192
SHA1 2bc51aada6d6c982c210b80eb13bddcfa5edb247
SHA512 bd73ddd9a01fe597470b511ff13e1c5c0c998c19b87df8a9157571d399f98be9f034e73cebce555f5732072bb820270c7bc9f053720a151ed2fa29cf2c9006e2
SSDEEP 98304:frgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr:+KWQc0gEYnvLJ
TLSH
T1C757390F66EC00A6D87F8276E6D58166C670B031672159EBE150CB3D9F6FAD1A83DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 a23d7879b990ccaaac34151227eb144a2385975e78cb6074c384117958303fff
MD5 be037a42cd9c7647e64ffe19cfe324bd
SHA1 ff6f7c2234aebbf869b0041c5b1396714fd0dd7e
SHA512 7a562ef27c278350b6c22fd9ab53e63dbf0bd329fdb131f3d75e8d5948b268ba7b74c214157beabcc4ebbceae687089bb8edec0a00717b041d4b16f8123a58b1
TLSH
T12D11C840C4EA982BF9322A4E962EDF83CCE4774F9C589A64234C4318BB61C778D150D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-0-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/396-8-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/2104-35-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/3532-87-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4880-58-0x0000000005A00000-0x0000000005A01000-memory.dmp

Download