151bcfff6934acfe073edb88468a1f32ef01ad9377dfac9d1d54b3ff66a810ee

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 22.9MB
Sample260827-3gatlsbc65
SHA256 151bcfff6934acfe073edb88468a1f32ef01ad9377dfac9d1d54b3ff66a810ee
MD5 08c521c3d5cac5ae885299af10da086e
SHA1 65c7ca7231553614e0da1b0db62bf6bd08ae6cb6
SHA512 a9e1cf5de81ad8bef16cc77facd727c1e0d935eaee631a2c36c5d738c830b80b8b8e3b2f2d7924b003c7973a0cc78ea372501cfe9d7751bdcf36409c854e2b8d
SSDEEP 49152:U+Ed+ES+EZu+ES+Ed+ES+EZu+ES+Ed+ES+EZu+ES+Ed+ES+EZh8+Ed+ES+EZu+EE:vKjKWQckVgtev5mnlNLV
TLSH
T107375A05FACA54E5E47752B04DAB817A8631FD258721C9EFF688831E5D33BD0AE34722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2832	svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe
4476	svchost_CAACAAABBBCABCBABBABBCCAAABCBBAABBBAACBCBAAABCAABACBAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCACCAACAACCBABCAACABBCBBCAACBCCACACABABCACAAABCCBBBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe"	2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBBBAABBBAAACCCBCBBCBBBCCAABBCBACCCCCCBCABCCCCAABBBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACAAABBBCABCBABBABBCCAAABCBBAABBBAACBCBAAABCAABACBAAB.exe"	svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3592	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACAAABBBCABCBABBABBCCAAABCBBAABBBAACBCBAAABCAABACBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3704	2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3704	2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3704	2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3704	2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2832	svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe
2832	svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe
2832	svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe
2832	svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3704	2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2832	svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3020	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 3592	3704	2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	112
PID 3592 wrote to memory of 3624	3592	cmd.exe	114
PID 2832 wrote to memory of 2428	2832	svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe	115
PID 2428 wrote to memory of 3156	2428	notepad.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_08c521c3d5cac5ae885299af10da086e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAACACABCABCBABCCABBBBBCABAABCBACCABACAACCCBCBABCABACABBCACAABBCCBBBCBCACAAABAACAAABCCCACAABBCBCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAACACABCABCBABCCABBBBBCABAABCBACCABACAACCCBCBABCABACABBCACAABBCCBBBCBCACAAABAACAAABCCCACAABBCBCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBCABCBABBABBCCAAABCBBAABBBAACBCBAAABCAABACBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAAABBBCABCBABBABBCCAAABCBBAABBBAACBCBAAABCAABACBAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a6863df768f6dd632763b2303fed8c93eefee6a9da8de4d0d7313f5bac528afb
MD5 f2cfd040cc626f75d5187e0ef4759257
SHA1 1ec0a4c490fa574b592cf9e40aaad5870038af59
SHA512 d51493d0f29afd627b63eb139fada0d892b2f593261a8aab72ddb6645d839c4a562c4d96c579d8b354c539022c73ac715744d5892774c673a8b5118c6cd37804
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 de3fbc240903aff145e2c33721291d9a982cb97ab87252263c60b54da654dffd
MD5 4b8c2869f74e56fab8bb952c7c5daff4
SHA1 ec78239b516ac65d4ef12db4c6729645fd1de7b7
SHA512 15a61ab9a0ee590a640795ff54d79144ee93ec9dd37133077b3cf111e42af2cfe1a7d268b71a3e17c7033b0020702004b6e0119ad20f35fb883b25192fee5ce2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad4f81889264c5cd25228d2e2c3f33a398ad24c8bff43cc1e898acb25e42b198
MD5 2fcdbfbb853911fd982e4850e439dc9a
SHA1 8aca0466be1de1332c93f77f683baf3743a5509a
SHA512 7a5303b45e60bec0ad97f994f63ac3095370c3c517c47db9af29b67da672d22f60dba60c136caf232a960cba14c72e5a308183aa391dfcfccf5e833bedda089d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b41d4786c7bf317a79c256c45cc4946024a26bbf792adcbfa8e36a8267ef008
MD5 18ba56cc6501d7dfd050b4ebec8ce515
SHA1 962dcc94f3f064e08ea871cf2506a60491d8a056
SHA512 635f5e96e913abc514aede4bb02a8daba936821351429ab441d8e33f58362bf82661ce0cc1d265d14b00ccff978040853d84c5adaa622a8649a6ed1fe452d736
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 354a91ded30f6847a6f289ef9f50a714006912e812ce68968199bed8333ce596
MD5 92d0e297cbde7235a39e54729f19df81
SHA1 30f6a5d57186303fa4e1b7bfd1cc9b6a8188737a
SHA512 00d0eefcd4923d85a2f9904828c878fd5b970d2a72008de350789f910e1964f3384a15da9bc2b15843393cb6240944f1e01925dcb8a34266785f505a4580bc1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60cc98817692e2d02458b7eb70a2e0bb8e1d6d7d5f5d1f09f7c4ef2108ebe8d7
MD5 1af55debd18a2641dd7dc692ec7563f1
SHA1 e692557e787fdc111fb5d0a8bb4f762facd2a819
SHA512 77cdb7af6227110a55b096d2e0f704977bfbd6530f371fa512b8fcd00adfab9780ef754ebcc9519459189a2224db7509096e0babfaf681095b8aabf9c3cf33ca
MD5 SHA1 SHA512

Submit Download

svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCBBAAACBBBABBCBCBACCAABACAACBCBAABBBACCCAAABBCBBACC.exe
Size 22.9MB
SHA256 151bcfff6934acfe073edb88468a1f32ef01ad9377dfac9d1d54b3ff66a810ee
MD5 08c521c3d5cac5ae885299af10da086e
SHA1 65c7ca7231553614e0da1b0db62bf6bd08ae6cb6
SHA512 a9e1cf5de81ad8bef16cc77facd727c1e0d935eaee631a2c36c5d738c830b80b8b8e3b2f2d7924b003c7973a0cc78ea372501cfe9d7751bdcf36409c854e2b8d
SSDEEP 49152:U+Ed+ES+EZu+ES+Ed+ES+EZu+ES+Ed+ES+EZu+ES+Ed+ES+EZh8+Ed+ES+EZu+EE:vKjKWQckVgtev5mnlNLV
TLSH
T107375A05FACA54E5E47752B04DAB817A8631FD258721C9EFF688831E5D33BD0AE34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2428-61-0x0000000002920000-0x0000000002921000-memory.dmp

Download

memory/2832-38-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/3704-0-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/3704-8-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/4476-73-0x0000000000980000-0x00000000009A1000-memory.dmp

Download