28f6bbc6d3201a00166adc3a6443804b3b934627a57525f2be257394d0b993d0

General

Target
2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 51.3MB
Sample260819-eza1bsytdw
SHA256 28f6bbc6d3201a00166adc3a6443804b3b934627a57525f2be257394d0b993d0
MD5 cc719c5333bc6ce9e314861b64f8e484
SHA1 475947a1af5964d894cc5d2cd720bf3c1c66d6b7
SHA512 329d0ea96913460014449a21b5b73d34336b926f8caaaa1582d9d62c31ab56b6f134e7c67390fb3e5683685353f914fd2dc3d681e8cbd19a2e30c8650fc60411
SSDEEP 98304:QW1PszSW1PszSW1PszBKjKWQckVgtev5mnlNLL:5xsTxsTxsSKWQc0gEYnvLL
TLSH
T1A8C73B09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4892	svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe
4168	svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABAACAAACCCAABCABABCACBACBCBCABBCBCACCABABABACCBBAACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe"	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4808	sc.exe
4936	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1720	cmd.exe
3852	cmd.exe
2580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1780	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1780	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1780	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1780	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4892	svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe
4892	svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4892	svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 1720	1780	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 1720 wrote to memory of 5728	1720	cmd.exe	94
PID 1780 wrote to memory of 3852	1780	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	95
PID 3852 wrote to memory of 4808	3852	cmd.exe	97
PID 1780 wrote to memory of 2580	1780	2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 2580 wrote to memory of 4936	2580	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_cc719c5333bc6ce9e314861b64f8e484_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBCBCCCBBBCBCAACCCCABCCCBACACAABACCABCABCCCBCCBBABBABCBBACACCBBBBBCAABCACCCCBABAAAACABBBCCAAACCCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBCBCCCBBBCBCAACCCCABCCCBACACAABACCABCABCCCBCCBBABBABCBBACACCBBBBBCAABCACCCCBABAAAACABBBCCAAACCCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBACBBBBACBBABACBABCBBAABCCCACACCAABBBCBCCABCBCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe" start= auto displayName= "UserDataSvc_BCBACBBBBACBBABACBABCBBAABCCCACACCAABBBCBCCABCBCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBACBBBBACBBABACBABCBBAABCCCACACCAABBBCBCCABCBCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe" start= auto displayName= "UserDataSvc_BCBACBBBBACBBABACBABCBBAABCCCACACCAABBBCBCCABCBCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBACBBBBACBBABACBABCBBAABCCCACACCAABBBCBCCABCBCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBACBBBBACBBABACBABCBBAABCCCACACCAABBBCBCCABCBCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACAACACCBAABCBBBBCAAABCCCBCABBCCBABBCBBBABBCABACBA.exe
1⤵
- Executes dropped EXE
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d088159dc0358ff0c9fb70e8f0033a735a5030ac2474f1c6048ff1c1a7c4269f
MD5 eaa181efceda73782c70cd4e8c25793d
SHA1 6de1879c473794578c345313c56adf037dee0bc8
SHA512 d00f04ed93dd1bed0a81fc5fd90d5c90fa43fc6a5878b2e3e9aba96797443b62b63af9758207cdb563d548d21944cd0fea5ba308f60eee6a2e3a2d2e8abda39f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c8b857804ccbb2bfdd8282b79e5b5222a0c049f1746a9e1d6ccc09fafb95d69d
MD5 73758f2d7f55751a28496c70a375b0e3
SHA1 2d7d7d8aa644994e99f3f401224740ff394502e7
SHA512 8d2cdfdf647671c5045dd9f7ac8bf607e7fc1dc3ec93d0792c482262db8d2cd3e3bab72028aebf79022c4116ec306fdd94fad8d9756c0ccfcc955e989901c453
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1d24659edca86c2649c928f17e8288014e01a4f35551a94f432077816b542ec4
MD5 e41e444d1f0b179d7b29f3428ae1cd9f
SHA1 93462d51c1f417ac4dbbb0df3fee0e77d99be6a5
SHA512 d24fb5b726c0cb2ce57006a6e565a305bd400b9bc9dfb5adc6208b81ef76cedf0ddfc24f670817ed77a7698a563c8d8740f5450761b5c8c01a2f6cf8c36557b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 31a8f1ba85545b890e6e823e44a2798e921e751d8dea877838ce3f579ea3dec0
MD5 31a4940234feedf43597c92fc663a04d
SHA1 7078ec6f3b3a9693af76e8c7435793b397c4a0ec
SHA512 4173db2cfcc47bd7fad08a39df09491686c2f92607ef8041a8063d08d9b996cb54ae9c6987e1ef409f6520135f20b031141bae219f1fb8112e67ca077123cf83
MD5 SHA1 SHA512

Submit Download

memory/1780-0-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/1780-8-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/4892-25-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/4892-38-0x0000000000610000-0x0000000000631000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads