052b740accb768468473ff3ab028a4a952420796217d11637fea79e8516c33c9

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 44.5MB
Sample260826-e5ln1ssckb
SHA256 052b740accb768468473ff3ab028a4a952420796217d11637fea79e8516c33c9
MD5 e75580bfbaf88ce74adcb6441e759f9d
SHA1 7e39115cc3d248547c9eec831abe4bdf79635e81
SHA512 a61a790e1375a9dcdcd5b9458b88264c645bc98d2e9cc903c205b49de26082a4bfde243852f6533294e9cb90e0c290643dccc65e517c4084a161149e4f378378
SSDEEP 98304:oW1Psz2W1Psz2W1Psz2W1PszBKjKWQckVgtev5mnlNLN:RxsfxsfxsfxsSKWQc0gEYnvLN
TLSH
T13EA73A09F94344B1D92B51B04DCBE3BF8A60BB2583128DF7FB4DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
248	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
5056	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
1984	svchost_CCAABBCABCACCBABBBBBCCBCBAACBCCCBCCCBBBACBBABBBCACCAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABAACCBCCCACBCCBACACCCBCCBACCACABACBCACCCABCCAABBBBABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe"	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCABBACCACABABBABBABCCAACABCACBAAACBABCBCCBABBAAABBCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAABBCABCACCBABBBBBCCBCBAACBCCCBCCCBBBACBBABBBCACCAAAB.exe"	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5596	sc.exe
1700	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1404	cmd.exe
5972	cmd.exe
3460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAABBCABCACCBABBBBBCCBCBAACBCCCBCCCBBBACBBABBBCACCAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4364	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4364	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4364	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4364	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
248	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
248	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
248	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
248	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	248	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 1404	4364	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	95
PID 1404 wrote to memory of 1096	1404	cmd.exe	97
PID 4364 wrote to memory of 5972	4364	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	100
PID 5972 wrote to memory of 5596	5972	cmd.exe	102
PID 4364 wrote to memory of 3460	4364	2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	103
PID 3460 wrote to memory of 1700	3460	cmd.exe	105
PID 248 wrote to memory of 3448	248	svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e75580bfbaf88ce74adcb6441e759f9d_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCABBBBBAABBBBBBBBCABCAAACACAAABBAAABCBACACCABCCABBAACCBAABBBAAABBACACBCABCBBCBABACBAABCBCCBBACCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCABBBBBAABBBBBBBBCABCAAACACAAABBAAABCBACACCABCCABBAACCBAABBBAAABBACACBCABCBBCBABACBAABCBCCBBACCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBACBBCBABCABABABCAABBCAAACABBBCACBBAACAABCBAAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe" start= auto displayName= "UserDataSvc_ACBACBBCBABCABABABCAABBCAAACABBBCACBBAACAABCBAAAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBACBBCBABCABABABCAABBCAAACABBBCACBBAACAABCBAAAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe" start= auto displayName= "UserDataSvc_ACBACBBCBABCABABABCAABBCAAACABBBCACBBAACAABCBAAAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBACBBCBABCABABABCAABBCAAACABBBCACBBAACAABCBAAAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBACBBCBABCABABABCAABBCAAACABBBCACBBAACAABCBAAAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
1⤵
- Executes dropped EXE
PID:5056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBCABCACCBABBBBBCCBCBAACBCCCBCCCBBBACBBABBBCACCAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBCABCACCBABBBBBCCBCBAACBCCCBCCCBBBACBBABBBCACCAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62d63857149f8afba4a10752ba646f599b6889bc111975c1fdf9c81776f247b9
MD5 9e5daa4d430841a433e32c520996e688
SHA1 09f530f4a191100e706f542f83bcd353fe9dc0f5
SHA512 e604c9ec49262e14a096321cbe7e56e0f189d64df607f7afb2aa808386698ba2a075f5f0c6b6f5b9a85fa67ca7aeff8049f1138306ce5f1fa38392bc9545fe62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6dba02e9cab0acdda6595dbe2e1a2c0ed6614042891df87c86836330f133cdb
MD5 972f75a8d78af7465b5f5b7fed571b96
SHA1 27fe86eb4fbf47cfc8347c9876f3ff6734472c76
SHA512 4b3f0acb4f712e0d30120ce3fab4a29ee00f93702b0d942c23413528663083346893c50962880e10dd5570b56c2e5c66cb078b28ada8582a5cbf715ff9df1bee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fcc4fdaac7e255fe22c250edc4e21de6d20d63ca10f5d150e275cf50ed95c7cb
MD5 eae2b510dd8b794b9de7d18348ef52f0
SHA1 b8c50d0dd53b6da757e15bb8cc2630fe2b4ffab2
SHA512 e456de70f58b76a560c053023c8f9a5725eed0564ebea13ad43593d5a10f095caa403d32e2b2584869b2d51351e102ce729713463ab17a6a96064f4d2948444b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 29ecad828fbf733f1b9291e9e761d12058e40bd28cc05a721b298f326f1e3ad7
MD5 7f9a1a064d27e8915cac3655f6c11a84
SHA1 0812370cd2755f05c61301b99ccbb797a4b40442
SHA512 db7a26d535e000d7165158c80a7da4faf0c7d58b12cc2f5cb58502f3513a3d7b8a8ed3008d3a861d3b1c10e47bc3a74182d298751ccd3a0349b15135c2d2ceda
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 909735df418d23e9508d6796cc27051f5f444b7acf6f1aec05c114bc8f567688
MD5 34383c58905a3a1a366732a2df1dc7fa
SHA1 c83606c795dad104c1c21e063dac84cea445d2a4
SHA512 e58a0395cabf97b792990be9ed62ea4be0fbf19f9ad4fd72c383ed65fae12eae811ea4f3ed65cedec542f37975380f3006533055f9a8c5276cacafde5aadd8ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 860abcb0b8d68f7e7c2e231c33673612df31555ec73f971aca5355d99f2195e1
MD5 a02ef7635987e223822a91ea82812915
SHA1 db27c5ab1dbf9dd31d97cf7f0fa7da6c2c5c2f9d
SHA512 fe1629fcdebd6e40886886cedaa21524142988daa8adb8df67491e4307bd7a505a27afc1963e041b0c9fa91b1ef1f84ffef33beba9f39ebeafedf20388da79e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1c2b6ca9583c42ebb2e4447e2c73b822b4b626dd19dc4eae3c118619dbf595d7
MD5 ab9ab0399a62bbb1a38ff960964fd86f
SHA1 c3c30a8a2adbf872933a990b0e8723bdaf7ef103
SHA512 2a3e0d0ad498c796262888460ce05fa68dc7eee8d26fc56b0a316013286fef3956fa12a7e0e73581f51b593666712b1ac668af92a1d14219a4a71edff2e38f6c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f91a3564a2aac9699d12741e8acd78c6408f7692d36cf5944120fbeced510e34
MD5 ac565383cff1852dc8d88bc6a6ed6a23
SHA1 165e5ad7f71c3c926ceb77ba3d57c90301e63f74
SHA512 6bf55d3accd22e9189b57ba9e31723b6f396dd5a2862e7e14afc9daab7cac408607276f9387fddf8ff1d33997d65a5b308285d5df7a3931834a61c6c00585795
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b5d2fa12e5cd1d8e58b0cc31f87b88d9be1fd3b5a3459e508c90f8b0562da0bd
MD5 68ef01fc6aafd2e89097a35e24bcfe41
SHA1 8c72528c4125d3784224ec85976a902242ace769
SHA512 fce0b6c6d7819bcad818c57d94de7588292d5754d585bdfc711920733fd49cacd227e461ad8a6462fed963349cc21ed7f9c6459112b76ce9c5f9555db3ad76c3
MD5 SHA1 SHA512

Submit Download

svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABACABABCBBBAACCCAACACCBABCBCCABCCBCCBCBBBCBBCAABBBC.exe
Size 44.5MB
SHA256 052b740accb768468473ff3ab028a4a952420796217d11637fea79e8516c33c9
MD5 e75580bfbaf88ce74adcb6441e759f9d
SHA1 7e39115cc3d248547c9eec831abe4bdf79635e81
SHA512 a61a790e1375a9dcdcd5b9458b88264c645bc98d2e9cc903c205b49de26082a4bfde243852f6533294e9cb90e0c290643dccc65e517c4084a161149e4f378378
SSDEEP 98304:oW1Psz2W1Psz2W1Psz2W1PszBKjKWQckVgtev5mnlNLN:RxsfxsfxsfxsSKWQc0gEYnvLN
TLSH
T13EA73A09F94344B1D92B51B04DCBE3BF8A60BB2583128DF7FB4DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-96-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/248-50-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/248-30-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/248-71-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/1984-89-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/4364-21-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4364-82-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4364-10-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4364-59-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4364-33-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/5056-87-0x0000000000370000-0x0000000000391000-memory.dmp

Download