643b3c0b5c7746a19a0e5dd76cb747fb05c65dbfb5dc09cc722959de8b174885

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 10.6MB
Sample260828-ptbpsaxgra
SHA256 643b3c0b5c7746a19a0e5dd76cb747fb05c65dbfb5dc09cc722959de8b174885
MD5 8a3e096c0f09296674b805c7acae3687
SHA1 8a09b4c06cafaddfd106e704bd125c1ebd860513
SHA512 f1ad78f0dd98c94b83052f7ed5daedcbf05b5771a5358a535ae00b1437fc60d1a94081342dbae176fad89a4b123784c9b518945f58480076d2086616dccfc542
SSDEEP 49152:U+ES+Ex+ES+ES+ED+ES+E7+ES+ES+E7+ES+Ef+ES+E7+ES+ES+E7+ES+E6+ES+E:dKjKWQckVgtev5mnlNL
TLSH
T16DB64C09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4ECB5B6923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1700	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
4804	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
2268	svchost_BCCACBAAAABACABBBCCBACCBBBBBBCABAACBBBAAABCBCCBBABACBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBABBBBACBAAACBBBABBBABCABABAACABAABCACACBACAACCBBBBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe"	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABCAAAAABAACCCABCBBAACACAACCBCABBBCCCABABBBBAACAAAACCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACBAAAABACABBBCCBACCBBBBBBCABAACBBBAAABCBCCBBABACBAB.exe"	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2484	sc.exe
3512	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
760	cmd.exe
3168	cmd.exe
4872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACBAAAABACABBBCCBACCBBBBBBCABAACBBBAAABCBCCBBABACBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
372	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
372	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
372	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
372	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1700	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
1700	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
1700	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
1700	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
2268	svchost_BCCACBAAAABACABBBCCBACCBBBBBBCABAACBBBAAABCBCCBBABACBAB.exe
2268	svchost_BCCACBAAAABACABBBCCBACCBBBBBBCABAACBBBAAABCBCCBBABACBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	372	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1700	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
Token: SeDebugPrivilege	2268	svchost_BCCACBAAAABACABBBCCBACCBBBBBBCABAACBBBAAABCBCCBBABACBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3160	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 760	372	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	95
PID 760 wrote to memory of 744	760	cmd.exe	97
PID 1700 wrote to memory of 800	1700	svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe	98
PID 800 wrote to memory of 560	800	notepad.exe	99
PID 372 wrote to memory of 3168	372	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 3168 wrote to memory of 2484	3168	cmd.exe	103
PID 372 wrote to memory of 4872	372	2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	104
PID 4872 wrote to memory of 3512	4872	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_8a3e096c0f09296674b805c7acae3687_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACAACAAAABCBBACCCACBBBBAACACCCABCACACBACACCCACACACACACCBABCACCBCBBBCCABCCAABBAAAABBCCACCBBBCCAABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACAACAAAABCBBACCCACBBBBAACACCCABCACACBACACCCACACACACACCBABCACCBCBBBCCABCCAABBAAAABBCCACCBBBCCAABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABCBBBCABCACBACABCCCBCBBBBBCAAAACAABBCCABBBBCBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe" start= auto displayName= "UserDataSvc_AAABCBBBCABCACBACABCCCBCBBBBBCAAAACAABBCCABBBBCBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABCBBBCABCACBACABCCCBCBBBBBCAAAACAABBCCABBBBCBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe" start= auto displayName= "UserDataSvc_AAABCBBBCABCACBACABCCCBCBBBBBCAAAACAABBCCABBBBCBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABCBBBCABCACBACABCCCBCBBBBBCAAAACAABBCCABBBBCBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABCBBBCABCACBACABCCCBCBBBBBCAAAACAABBCCABBBBCBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
1⤵
- Executes dropped EXE
PID:4804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAABACABBBCCBACCBBBBBBCABAACBBBAAABCBCCBBABACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBAAAABACABBBCCBACCBBBBBBCABAACBBBAAABCBCCBBABACBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73c9a10c96917eb3fd18253262a5cf7ebf1231f085abe3286c6bbc816c097834
MD5 74cde3a99f9e2583e7206c15cdcd05cc
SHA1 11f1ec5c58faf47ced269b3425ff9adbb9635b87
SHA512 a286ab785a1e03c8bbf8b7e04911b3742d2f73975e9ca99acc96b8f8bdd3206a68e4eb7a943b45d4c6c897f7dfe7db841af12c3b1648283abb875d865df47e31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0be5dbaee3858ae55bed011d71be0d4dbd6c44833c6c8e7b2a4e7e4a653122c3
MD5 69157dd9dcf05c0a3d2faf2d2e88290d
SHA1 4388d55f32c67a72cb3b84a864a4ea0aae43a059
SHA512 2bee322c1237e2b4e07512e657c3219988e96b2c606b776226421c958dda65e55dc55d2b17e5d1b785791427d4ec8fbe5dcf31ea4f38ef3ee86cefe66b376407
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c65a6a61d4973a4af24f800bd531d81aef91d6e6fb28c881574826a6e8aea2f7
MD5 50370efaf6f2d093608361740152c6a9
SHA1 ef8211c184aa97532a6ab3cd0be571d20a34a7d4
SHA512 8d46b882a62b4624a23a2bf7cef0c3606653917339caed0e1fcfb8b825c446dd08c84260b112d66ef19db28ce115a89a44bac830e6ca2c68a766fc91eb05affc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b984f16691ec932022af76773603dbbe8ebf01fab85a82aa5875dac2d0dd306
MD5 594e33398d53a87ceeb5ff2cc0ce222f
SHA1 d3a4a18701a3a0fbcc027e0c03f0ebb54a962695
SHA512 db9fa267b1641b14919cc4de78de397ebff41992e1282a75f7220fd915427d25da77d269a7d186d62ca72c58241e908cf365505bad49f318dad7ae1beece1666
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 95d87f1acec87d912bad9a0fc6107738d578096f95691b23664bbbea0df1b4fb
MD5 c09c822ad5e16d1637c2f8a00594cee9
SHA1 d5d2d15d23d26b141d253732b569f03c8dff481f
SHA512 fce382897f8f82f0af2a07dade7c3c1645c48452510e1130cfcce0ebf22e53ab401a2d304cac544b3dcb1c110900578a4772e254e5d0dd4c00ae3eddaa863315
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7a28a7f926ef29529f895431c06da0311785bf4741fef804c90c0a7110a6c3ec
MD5 cea8c899a9047c071503cffc9434cc5f
SHA1 ee65ba097efc8efcd0805a82556c9316c5b5b42a
SHA512 fada8c62cf520d0fd8bbc3081b1d2ed9a93151a2f481d44155b7acb7eabeb3e2123f724ffadfd472ebcad8903ba22197402ae24454bb583c5b718c90d0bdce3d
MD5 SHA1 SHA512

Submit Download

svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABABCBCCCCCAAACAACCBABBABAAACACACAAABCCBBBBBBCBCA.exe
Size 10.6MB
SHA256 643b3c0b5c7746a19a0e5dd76cb747fb05c65dbfb5dc09cc722959de8b174885
MD5 8a3e096c0f09296674b805c7acae3687
SHA1 8a09b4c06cafaddfd106e704bd125c1ebd860513
SHA512 f1ad78f0dd98c94b83052f7ed5daedcbf05b5771a5358a535ae00b1437fc60d1a94081342dbae176fad89a4b123784c9b518945f58480076d2086616dccfc542
SSDEEP 49152:U+ES+Ex+ES+ES+ED+ES+E7+ES+ES+E7+ES+Ef+ES+E7+ES+ES+E7+ES+E6+ES+E:dKjKWQckVgtev5mnlNL
TLSH
T16DB64C09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4ECB5B6923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 175df92ebcc170de16c6b9fcb26b78cb047fbb8620566719656bf2ecc5553fc5
MD5 50fa9bbfe03f6fdee55889bf7b6afe90
SHA1 760319b4a19db03e9669acb42cabba6e657854b6
SHA512 9b735a8e071e8a104a6864f84ebe817dab231d8fc8d91baf36819eae3fb568498aaba927510881ece9a7a8cd5e336b2100cc5575fcca3396c854e695edbaf1c9
TLSH
T18301F954B4F5DC67E93368DBC3119AC23CD836776598FA16230956187794C70CE894A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/372-7-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/372-0-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/800-60-0x00000000054B0000-0x00000000054B1000-memory.dmp

Download

memory/1700-26-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/1700-39-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/2268-89-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/4804-84-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download