b320bf0e712bd20133efb87980ead22f679b8d369be94e078e2c68ce83433e02

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 18.9MB
Sample260828-bemlvabe29
SHA256 b320bf0e712bd20133efb87980ead22f679b8d369be94e078e2c68ce83433e02
MD5 f7eeb277b549f982ad344f432dbb8c65
SHA1 1dc7532e8a3e1cc797089404058317ab742e7a57
SHA512 28aabb94d1d7dc1d59cacd955416b5a1d509d3c1489b05015b1f07bf6d6ee08038cd280ee3c114591e003de5c2779a5706f065b198cc0047ba066e35d65d2794
SSDEEP 49152:U+E9iw2A+E9iw2A+E9iw2A+E9iw2Jiw2j+E9iw2A+E9iw2A+E9iw2A+E9iw2Jiwd:DKjKWQckVgtev5mnlNLW
TLSH
T1FB171A0977FD0854F5B7723489B28669DAB2BC615B32C7DF5280923D4E73AE0AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4272	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
4712	svchost_CBBCBABCBBCABAACABCBABABBCCBBCAABAABACBBACBBCABCACABCBA.exe
2096	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABABCCCCCBBBACCCACCABCABCCACCCACBCCABBAACABCABBBAAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe"	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCABBCBBBABAABACACCCABACBACAABABACCBABCABBBACBBAABCBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBABCBBCABAACABCBABABBCCBBCAABAABACBBACBBCABCACABCBA.exe"	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4948	sc.exe
4788	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1128	cmd.exe
4388	cmd.exe
4248	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBABCBBCABAACABCBABABBCCBBCAABAABACBBACBBCABCACABCBA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1416	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1416	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1416	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4272	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
4272	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
4272	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
4272	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
4712	svchost_CBBCBABCBBCABAACABCBABABBCCBBCAABAABACBBACBBCABCACABCBA.exe
4712	svchost_CBBCBABCBBCABAACABCBABABBCCBBCAABAABACBBACBBCABCACABCBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4272	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
Token: SeDebugPrivilege	4712	svchost_CBBCBABCBBCABAACABCBABABBCCBBCAABAABACBBACBBCABCACABCBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3884	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4388	1416	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 4388 wrote to memory of 452	4388	cmd.exe	99
PID 4272 wrote to memory of 2924	4272	svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe	100
PID 2924 wrote to memory of 4480	2924	notepad.exe	101
PID 1416 wrote to memory of 4248	1416	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	105
PID 4248 wrote to memory of 4948	4248	cmd.exe	107
PID 1416 wrote to memory of 1128	1416	2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	108
PID 1128 wrote to memory of 4788	1128	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f7eeb277b549f982ad344f432dbb8c65_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBCCABABAAAAABACBBBCABCCBBCBBBBBABCCBCBBABCCBBAABACBBCBBCBCBCBBACBCABCBABCAACBBAABBACBBAAABABBBBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBCCABABAAAAABACBBBCABCCBBCBBBBBABCCBCBBABCCBBAABACBBCBBCBCBCBBACBCABCBABCAACBBAABBACBBAAABABBBBCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCCBBCBCCBCBBACBAACACACCCCCAABCABCBACCACBBBBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe" start= auto displayName= "UserDataSvc_ACCBCCBBCBCCBCBBACBAACACACCCCCAABCABCBACCACBBBBACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCCBBCBCCBCBBACBAACACACCCCCAABCABCBACCACBBBBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe" start= auto displayName= "UserDataSvc_ACCBCCBBCBCCBCBBACBAACACACCCCCAABCABCBACCACBBBBACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCCBBCBCCBCBBACBAACACACCCCCAABCABCBACCACBBBBACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCCBBCBCCBCBBACBAACACACCCCCAABCABCBACCACBBBBACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBABCBBCABAACABCBABABBCCBBCAABAABACBBACBBCABCACABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBABCBBCABAACABCBABABBCCBBCAABAABACBBACBBCABCACABCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
1⤵
- Executes dropped EXE
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c89b97d0b1b368bb9666534851b96c0e783ee575c5663fe22f967baed85b5b43
MD5 ec326f72498f57642fca4ae7d56f1de3
SHA1 eb935492f21761b527f2d2d8c5a573e6430fdaa8
SHA512 dc39a179d6ac3bc6f9fde113098f8044676d6e07af4f8bd542ffeffcca6a26f099f2a6af6cc72b4762bca28d353ab8a993fc52670a94dadb5b50e9207d4814dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 53bb0b04e37edea4467d272ed76cf5c69cf4b2476d9eb6c1015eeb9300349195
MD5 e51eb0f50866ca0506ed3069689a25e2
SHA1 0da865314fd328dbf975c1e624a0b17df2b6c1fd
SHA512 347e41ee290da12a217851ced54c52bfdb62b1472702b23a72f513316317e1ba0ff912e24dcff1a32aa2febe21f31ee86e7366dcfd8aa29fb472d7c8c89a7b21
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a7ac21371c647fb1a472668a934aa34841f0b83fa520e710e44cea79298c738
MD5 1652290ad4b7974f5e96ac71ddf2d0c4
SHA1 3171746b63dfb3585bf042ab2c99dec96817fff7
SHA512 f15b0898bae95781e1ce1f7dc7858908286aa4c5cca43d6959ace955a9628d6477399d586bbd7dc0370edd16f5994ae49c35bf521b085a73e5b38395e0ed6428
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cede4f8551f02c411cae80a570d17cfc9c074cc7d348fe9909060c7002df2cf6
MD5 fc88392a35d42a964d67b97018b1a01c
SHA1 95fd9661f35abfb1f09fa467fc15aafa2eae9ae6
SHA512 7a943157d4bbdf3c61792c0cf403517ca142cefb93241d54ca972b2d683208f981b7e2dbf0d3e725991772ce8c3132e02aaafa1c0651749c9e5510c58b88836f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7b2a433704f6784671fc69f3533a06a5f895bc2447ff7d6ff13fd3ec8db3e576
MD5 5a642b5e7063524e94fee257f2dcd536
SHA1 c43e76be47a677f8e7e5b2d6ed061adb0c4139b4
SHA512 57dd38b19c2af346b2f946e95606358c230587ebe840b0bd4cc23f48ebd2eff21f9ad8d5adebf02b343cc90c7ad72a403008202019ad69278da0f53bc8eac305
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 25307a4a82250556e814840927a3fbe84562ff4ffda8e3fcebff1eb4c27cceb9
MD5 34a0f3bf7b53d65d015555fbb9892286
SHA1 c355d8e2b60a173ffb8adbfc3af8239bb88cd8c3
SHA512 3c5c59af45d53b113934220413ff2cb10a7cec911ae176aaa424341a7eaf7e4b44bb2a69c5641af089625e91e9bd7cb29700abbed183f27e7ea84790ec567688
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6dbfc2b5ad74517e71cd75187baac4f3f6a93fbee5a3f78066a183df982229b7
MD5 29d5d9bcc4420ced97c6c405fc03cb4f
SHA1 4161388341c895742cc68c42fdcf53f24d44ae4f
SHA512 dd733417815f56f0d8bf01874d587d0d2a51893aab245f740446a12dcf8f6db606d957e6de45ffe913a067ccf75ea67ccc099df717f0f53767dfcfbc06f0ac42
MD5 SHA1 SHA512

Submit Download

svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBCBACCCABBCBCABACBCABBCCAACBACCCACBCAACAAACBABACAC.exe
Size 18.9MB
SHA256 b320bf0e712bd20133efb87980ead22f679b8d369be94e078e2c68ce83433e02
MD5 f7eeb277b549f982ad344f432dbb8c65
SHA1 1dc7532e8a3e1cc797089404058317ab742e7a57
SHA512 28aabb94d1d7dc1d59cacd955416b5a1d509d3c1489b05015b1f07bf6d6ee08038cd280ee3c114591e003de5c2779a5706f065b198cc0047ba066e35d65d2794
SSDEEP 49152:U+E9iw2A+E9iw2A+E9iw2A+E9iw2Jiw2j+E9iw2A+E9iw2A+E9iw2A+E9iw2Jiwd:DKjKWQckVgtev5mnlNLW
TLSH
T1FB171A0977FD0854F5B7723489B28669DAB2BC615B32C7DF5280923D4E73AE0AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 23c1e68571bd40dcd52b6c1c759bf56aa6e1041ab220c2241518537ef4fb4381
MD5 63ed2838b24a2535c1a6218bcee93c4c
SHA1 2fe95557174342ed36be43465339588b947b41ec
SHA512 1ecf15f26e75a5192f65d4d2d39fe8a120a463d0e7ff04b53129ead33b3b9af6ccdbb719999c76cf12ac60021f8bb3489fa3e21928a005128c62c964e44fbe13
TLSH
T159110E31B4F5EC13E533B4CB5611CBC7ACE5329AAC5C6A51634D8208EBD8832CE558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1416-0-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/1416-7-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/2096-92-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/2924-59-0x0000000005A80000-0x0000000005A81000-memory.dmp

Download

memory/4272-36-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/4712-72-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/4712-90-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download