261c0e1ecd03a0df6f7eaa4315cdaeb70bbff004cdb6173b4e22f11426ad53d9

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 18.7MB
Sample260828-csph2abf28
SHA256 261c0e1ecd03a0df6f7eaa4315cdaeb70bbff004cdb6173b4e22f11426ad53d9
MD5 ef9e3d742b2b24734b41b21cfba1c65f
SHA1 5ebc080deb662f86a10d1cc1bfb4689bdf246c71
SHA512 b6364f2be7362c4cbeac716efc42a7b0802edad775d77e313e112d51438eb2a4e78289ba41d3357dfd12acd970887a4604481f912d2e4428e73ba423de3ea965
SSDEEP 49152:U+E3+E3+EI+E3+E3+EI+E3+E3+ERiw2U+E3+E3+EI+E3+E3+EI+E3+E3+ERiw2Uc:/KjKWQckVgtev5mnlNLm
TLSH
T145174B05BADA84A1E97601704C97C2F9A571BC218F12CAEFB684B33F5E337D0A535B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4836	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
4696	svchost_BCCAAACABACBCBCBABCBACBCACCCBABCBAABABCCBBAACABCBBCBCCB.exe
1592	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCCAAABAAABBCCCCAACCCBCCCACCBCBCBABACABCCBAAACAABCCACCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe"	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAACAACBBBCACAAACAABBCCCAACCBBBABCCCBACBACACCAAABACBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCAAACABACBCBCBABCBACBCACCCBABCBAABABCCBBAACABCBBCBCCB.exe"	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2076	sc.exe
4308	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1260	cmd.exe
4460	cmd.exe
4628	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCAAACABACBCBCBABCBACBCACCCBABCBAABABCCBBAACABCBBCBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1348	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1348	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1348	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1348	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4836	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
4836	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
4836	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
4836	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4836	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 4460	1348	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	105
PID 4460 wrote to memory of 3472	4460	cmd.exe	107
PID 4836 wrote to memory of 5064	4836	svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe	109
PID 5064 wrote to memory of 2984	5064	notepad.exe	110
PID 1348 wrote to memory of 4628	1348	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	114
PID 4628 wrote to memory of 2076	4628	cmd.exe	116
PID 1348 wrote to memory of 1260	1348	2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	117
PID 1260 wrote to memory of 4308	1260	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_ef9e3d742b2b24734b41b21cfba1c65f_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACBCBBABACCBBCACCAABABCCABBBCBABBBBCCAABACACBAAAAAAABBABBAABBBBCCBACACBCCCABCCBCBCBABAAABCCACBCAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACBCBBABACCBBCACCAABABCCABBBCBABBBBCCAABACACBAAAAAAABBABBAABBBBCCBACACBCCCABCCBCBCBABAAABCCACBCAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCABCCACBBBBBCCCBBAABACCCCBAACCABCCBCABCBCCBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe" start= auto displayName= "UserDataSvc_ACBBCABCCACBBBBBCCCBBAABACCCCBAACCABCCBCABCBCCBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBCABCCACBBBBBCCCBBAABACCCCBAACCABCCBCABCBCCBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe" start= auto displayName= "UserDataSvc_ACBBCABCCACBBBBBCCCBBAABACCCCBAACCABCCBCABCBCCBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCABCCACBBBBBCCCBBAABACCCCBAACCABCCBCABCBCCBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBCABCCACBBBBBCCCBBAABACCCCBAACCABCCBCABCBCCBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAACABACBCBCBABCBACBCACCCBABCBAABABCCBBAACABCBBCBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAACABACBCBCBABCBACBCACCCBABCBAABABCCBBAACABCBBCBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
1⤵
- Executes dropped EXE
PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PushJoin.exe

Path C:\Users\Admin\Desktop\PushJoin.exe
Size 37.9MB
SHA256 85776ff300a1f0881ef9c5753eff7a7fba03900cb9715598cb55ba6f81125674
MD5 39d6025f9404f877a43bee6b0a4bfdf0
SHA1 ebade50babfb0eb3f9d1450ae01207e7c55f47a1
SHA512 f107dbff1e70e9ef79cd119fb2ffd7d32eea292352085203dfa9233a44c4eb4fd5609466b0588ddeec073d998504cd45255ae9c3d9894d501854d5605cfd2131
SSDEEP 98304:/KjKWQckVgtev5mnlNLyKjKWQckVgtev5mnlNLBi6lE:EKWQc0gEYnvL/KWQc0gEYnvLBiyE
TLSH
T1FE975B05BADA84A1E97601704C97C2F9A571BC218F12CAEFB684B33F5E337D0A535B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3285a3cdcb0dd17d98946faa737a9233b89156caa4d73357a0651ccc72a02682
MD5 7dde22e09d0b690131f2ea93c58e54a5
SHA1 307e01b42b48a693df77439474a595e31c2db66d
SHA512 8c5ec428b0c52d7961001a964a694690a5fc3ae6ece271b65e6c1beeea4d8dd1ef7ee51016510f8c2b3b593a0f550667075f9449baf82aeef57a6a77cbfac146
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebd9b079d6f430b235730469f8ae0b464cf67ddbab9fbfdf7220202b99c04d96
MD5 bdb26bb5505f222f63bcafc8405f5b58
SHA1 1fcc3f91f1b641aef296e44d90c2e544a21e9f2d
SHA512 78a4ad15cc75e5c534af5e390cb0219a1069420ce0d8e2e1ad97250792ad6a61b0c829409a6a31531d7d6eadeda603e542984cbc330b0ececb949a001e255d35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 10cd95a62919a318fef1752734e61ed5a54f7d4021159cacc59f3c4d3fa02b6e
MD5 6bc786704fa70fa57b307c5ad957c613
SHA1 febc06fca000aaec332c1eed5322e4d312cb068a
SHA512 c26fad5784647614b7c046826f7a59d8f2ccffe8c2dbc505b2ed3a562fe13386ed69f2e91eae16ad42894154a902af827989349c2cbd1eec8dddcf2dc3872694
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c62ce29462d052d280a0fa78f80115152cb0bef32b14d6e21421eeef6a0b9be3
MD5 7e3d0b98d8bf4c5574444fdec3ec84a4
SHA1 da743170f72f75d0f8419cdc11462614efc1daea
SHA512 4f076688cccac54cc829e69dac8f7aa9c100def104b2d8bd1d856c5be5abecdd9698e0cdda2ca342bff43db41e0c55b75779eeb7c995ac0a956347cf7bf68c01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 047e538a031537e04ee3d31e0885d16b73f61a92eea25c9cd595d039e1429cb3
MD5 d3d6f5b6b318416aa2aba879d86743da
SHA1 d22be8ed2e3769d01336bd163a86a69ffab2abfb
SHA512 f058eb6d0f3d187a1fb12fc61e58b4944e86b9ed1c3803ce865cf7546e29d113b65438651bafac3f8bd8a70960b021e50814c6c3b6333c5a6269047b4e2ef86c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 effb8cd75edc86263ad53f0ba604b870c2c1f01343469fcaa2f628af07424209
MD5 1912f670ce6faee6bc397acdff35a368
SHA1 6946b6b15c61b7f5857494f351023894906aca36
SHA512 eafab19480aa50e7e74bf506869ca9adda87ee2e6d1f0b3b51fa9f3387860702ce78c917113be5be98c1db6ec40cd5d43e509e31c514a37f5e28fbb2fb18f76b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 20c5acb744e08c4e1ecb298b5149ee1ce18b575ad260b60948ddd97bc0184a46
MD5 382b71e4ab5d7bec4a7e1f3af8dfc3d1
SHA1 38de7e8423ef04e64323b4d64d37c7fa1b2e2cd4
SHA512 78f60e7180b2199edcfcd0545340e77c1248cec1ec69a799db8da53342dc941d70d42ee46089b5b31081c20673e23411e1f34ed17371b0be83a4bed9a590e6ff
MD5 SHA1 SHA512

Submit Download

svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAABCCAACAAACCBAABCAACACCCABCCBACBACCCCBCCBAAACAABBB.exe
Size 18.7MB
SHA256 261c0e1ecd03a0df6f7eaa4315cdaeb70bbff004cdb6173b4e22f11426ad53d9
MD5 ef9e3d742b2b24734b41b21cfba1c65f
SHA1 5ebc080deb662f86a10d1cc1bfb4689bdf246c71
SHA512 b6364f2be7362c4cbeac716efc42a7b0802edad775d77e313e112d51438eb2a4e78289ba41d3357dfd12acd970887a4604481f912d2e4428e73ba423de3ea965
SSDEEP 49152:U+E3+E3+EI+E3+E3+EI+E3+E3+ERiw2U+E3+E3+EI+E3+E3+EI+E3+E3+ERiw2Uc:/KjKWQckVgtev5mnlNLm
TLSH
T145174B05BADA84A1E97601704C97C2F9A571BC218F12CAEFB684B33F5E337D0A535B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1348-53-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/1348-81-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/1348-0-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/1348-32-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/1348-16-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4836-67-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/4836-47-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/4836-95-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/5064-98-0x0000000005610000-0x0000000005611000-memory.dmp

Download