290ff23057daf000bfccd6140947b1b9d7d2d22ec780ec73800ef000eb7e23ca

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 26.4MB
Sample260819-ec1bpscg87
SHA256 290ff23057daf000bfccd6140947b1b9d7d2d22ec780ec73800ef000eb7e23ca
MD5 f4dda1891cf1afd5db8bb9ff4e2e0192
SHA1 2bc51aada6d6c982c210b80eb13bddcfa5edb247
SHA512 bd73ddd9a01fe597470b511ff13e1c5c0c998c19b87df8a9157571d399f98be9f034e73cebce555f5732072bb820270c7bc9f053720a151ed2fa29cf2c9006e2
SSDEEP 98304:frgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr:+KWQc0gEYnvLJ
TLSH
T1C757390F66EC00A6D87F8276E6D58166C670B031672159EBE150CB3D9F6FAD1A83DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2780	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
2532	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
2996	svchost_CBCCACACAABABCCBBCABAABBCBABCAAAAACCACCCAACCCACBACCABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCACBBBACBACCBCCAACCBCABABBABCCBCCABAABCCCABBBBBCBAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe"	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAABAACCBBCBACCAAACBABACACBACCAACBAABBAAACCACBBBAACCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCACACAABABCCBBCABAABBCBABCAAAAACCACCCAACCCACBACCABAA.exe"	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1464	sc.exe
5152	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5332	cmd.exe
3828	cmd.exe
5904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCACACAABABCCBBCABAABBCBABCAAAAACCACCCAACCCACBACCABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4228	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4228	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4228	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4228	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2780	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
2780	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
2780	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
2780	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
2996	svchost_CBCCACACAABABCCBBCABAABBCBABCAAAAACCACCCAACCCACBACCABAA.exe
2996	svchost_CBCCACACAABABCCBBCABAABBCBABCAAAAACCACCCAACCCACBACCABAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4228	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2780	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
Token: SeDebugPrivilege	2996	svchost_CBCCACACAABABCCBBCABAABBCBABCAAAAACCACCCAACCCACBACCABAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5332	4228	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 5332 wrote to memory of 6136	5332	cmd.exe	94
PID 2780 wrote to memory of 3052	2780	svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe	95
PID 4228 wrote to memory of 3828	4228	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	96
PID 3828 wrote to memory of 5152	3828	cmd.exe	98
PID 4228 wrote to memory of 5904	4228	2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	99
PID 5904 wrote to memory of 1464	5904	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f4dda1891cf1afd5db8bb9ff4e2e0192_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCACBCACAABBCAAACBACBCCBACBCBABBACAAAAABCCACACBBBCBCCBCAACBAABBACCAAABBCCACACBAACCACACABBCCCCCACCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCACBCACAABBCAAACBACBCCBACBCBABBACAAAAABCCACACBBBCBCCBCAACBAABBACCAAABBCCACACBAACCACACABBCCCCCACCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCABAACABBACBCABCACCACCCBBACCCBABAABABBACBCBAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe" start= auto displayName= "UserDataSvc_AACCABAACABBACBCABCACCACCCBBACCCBABAABABBACBCBAACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCABAACABBACBCABCACCACCCBBACCCBABAABABBACBCBAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe" start= auto displayName= "UserDataSvc_AACCABAACABBACBCABCACCACCCBBACCCBABAABABBACBCBAACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCABAACABBACBCABCACCACCCBBACCCBABAABABBACBCBAACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCABAACABBACBCABCACCACCCBBACCCBABAABABBACBCBAACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
1⤵
- Executes dropped EXE
PID:2532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACACAABABCCBBCABAABBCBABCAAAAACCACCCAACCCACBACCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACACAABABCCBBCABAABBCBABCAAAAACCACCCAACCCACBACCABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3eddaf217d1aef948558226b42bf4513bdaffb5a7c1197eb050744086cee8bd6
MD5 77c018f72a63e46c65bd2692b7f3fe2b
SHA1 d0b18f92b5f86da79a501b0e9f1c9b6f14b331d0
SHA512 a7935ce2941b7afb4fc31a39240c002c20b13f793c0889f5f1f50fef07e02bb616fe0609de80c5bf0f483af0af599f9a17dea16a66411b5126453b1fa5607228
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3245e8b6e749b8d683717545c9b7521759b2cd0d1a0124574bd20d9dc49d9e18
MD5 27832a6b7199784b5c5fcb2b99c390bc
SHA1 238bbd2b3a2223d201d5174f5c7e898f0617e03c
SHA512 5367465f61ae23d87b2a0e83c1a9769ced7cbe788e21dfb3bffa2d94a8a34650e43e91d39411b9f91205152de4fb3bb4beb7950c7fe5a1d52b4df1b82502ba97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2fd886d975194bcceace45df050c7ccd5544b91aa42ed873be331527192a4c25
MD5 5783f745c8651e73681bb5f42c7e9e4d
SHA1 a7e206288c3b5f645addd61f4825ac9ddbf167f3
SHA512 06f5bac4d07005761512eba9acbdb76e924edbeeadf5a43c6707500db8df903fce11f1549b90b42ddfcf4fa86857b68b003b54891f1147015743c90a471c1e9f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 934c7fca55b3a14c3cdf3855f00da2da80df7fc33184e0da3a60da379b18fc2c
MD5 1c9feae8e7f6725b99c4cf694195c2f4
SHA1 371b20a330703d74f1e301e73a06ea64f9816715
SHA512 914d755308b779d19980a96773225f42a2b4b0025f7855a32e3c5629200a204dbfd8c40eaef9406f466dde6ea98a86806187da9b57cf4580c4c587ee601a483f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be4a3c9bd19dc1f6f210fd3b5f464a19110140036657520fae6e526d0b13a9c9
MD5 40068be0752fdfe32aff0e9320704746
SHA1 09d4a8d431f92824b40fec7587e539c472a42bd9
SHA512 5d4a9b7723733cd4c8e8d44900e4ebbc79d3893da5b08d4dce921f8368857d0e0ff749d2de44fcb741a1e1b0acde67849d5474faa7290a6003cee813677b0057
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1de4d41dfbe99139f5f9d1cb17fbb9c8ad936bfdb81305e721d90960a238016c
MD5 9cad93317c7c0166d0f89b1a9c25d5ec
SHA1 96c9de294d08a5f23f20a5bb51242a525fdd0198
SHA512 147643803d9ae54c7c5f5e71d9964aa02c427b0cff7d842d023ed997f5f3725cf077f080ee17a4617ade5dabe3f2a6aaa81fb8a3394f7dde49f6501a65c346a0
MD5 SHA1 SHA512

Submit Download

svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBCABBBCABCABCCCCCACAAAABCCCCACBAACBABCBCBAACCCAACCB.exe
Size 26.4MB
SHA256 290ff23057daf000bfccd6140947b1b9d7d2d22ec780ec73800ef000eb7e23ca
MD5 f4dda1891cf1afd5db8bb9ff4e2e0192
SHA1 2bc51aada6d6c982c210b80eb13bddcfa5edb247
SHA512 bd73ddd9a01fe597470b511ff13e1c5c0c998c19b87df8a9157571d399f98be9f034e73cebce555f5732072bb820270c7bc9f053720a151ed2fa29cf2c9006e2
SSDEEP 98304:frgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr2Brgryrgryrgr:+KWQc0gEYnvLJ
TLSH
T1C757390F66EC00A6D87F8276E6D58166C670B031672159EBE150CB3D9F6FAD1A83DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d6877dc1ebaa094a439e109d3f417f42f823a6bfccf2daab73a9fcfbf672e5fe
MD5 56076a792a3234728bd90aaa049131f2
SHA1 c99e6f83191bb4d8edf0fdc1a7a940603350c74b
SHA512 4bfe3492d3498507c0de79e295ee8997656b93c0000fbe71e3cb8b69447eba58261eea08e19496f38be0ec48332b4343ceef6a5d9215759868757c8ae215f2c8
TLSH
T1CD11BF60A8F69C73FD23288F122DAA824CF0369FDC5C6A59135D431CB7A5835CE294E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2532-66-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/2780-36-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/2780-23-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/2996-81-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/4228-0-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4228-7-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download