293ce37cd7f22d39404169df754b883c5a06302368e579300e9cba12c91973a2

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 15.0MB
Sample260830-2vrhva1grb
SHA256 293ce37cd7f22d39404169df754b883c5a06302368e579300e9cba12c91973a2
MD5 fcf802af7ccd9111a3133440b8833834
SHA1 686b5d7002cfd4fc9ed499c39b10d1206e7cec85
SHA512 a238da0bc10b0f1f76eff2bf477284cb5a03343c95362f92f053adeb604de3df9ffce65537c14482ad8b402000c66e2eaef631e16a593e4bcb166c6ab9eb3f0b
SSDEEP 98304:Y5H5H5H5H5H5H5H5H5iKjKWQckVgtev5mnlNLa:Y5H5H5H5H5H5H5H5H5PKWQc0gEYnvLa
TLSH
T155F64B09FAC71071E97755B04CDBD2BF8D30BE2187218EEFE649961B6932BD0A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5840	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
2016	svchost_ABBBBABCABCBCBBBAABACCBCCBBCAAABCCBCBAAABABABCABCCACBAA.exe
5556	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCABCACBCCAABBCACCBCBCCBBBABCABCBBBBCBCBABBBCCBBCCCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe"	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAACABBBBAACBBBBBCBBACACCBCBBCBABABCCCBAABACABBCCACBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBABCABCBCBBBAABACCBCCBBCAAABCCBCBAAABABABCABCCACBAA.exe"	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5420	sc.exe
2804	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5608	cmd.exe
2788	cmd.exe
5604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBABCABCBCBBBAABACCBCCBBCAAABCCBCBAAABABABCABCCACBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6060	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
6060	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
6060	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
6060	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5840	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
5840	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
5840	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
5840	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
2016	svchost_ABBBBABCABCBCBBBAABACCBCCBBCAAABCCBCBAAABABABCABCCACBAA.exe
2016	svchost_ABBBBABCABCBCBBBAABACCBCCBBCAAABCCBCBAAABABABCABCCACBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6060	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5840	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
Token: SeDebugPrivilege	2016	svchost_ABBBBABCABCBCBBBAABACCBCCBBCAAABCCBCBAAABABABCABCCACBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6060 wrote to memory of 5604	6060	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	93
PID 5604 wrote to memory of 2068	5604	cmd.exe	95
PID 5840 wrote to memory of 2776	5840	svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe	96
PID 6060 wrote to memory of 5608	6060	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	99
PID 5608 wrote to memory of 2804	5608	cmd.exe	101
PID 6060 wrote to memory of 2788	6060	2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	102
PID 2788 wrote to memory of 5420	2788	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_fcf802af7ccd9111a3133440b8833834_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACACCCCBACAABAACBBBBCCABBBAACABAACBCABCCABACCCABBACCBCBCBCBBBBBACCBACACBBACABACBBAAAACBABACCABBCCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACACCCCBACAABAACBBBBCCABBBAACABAACBCABCCABACCCABBACCBCBCBCBBBBBACCBACACBBACABACBBAAAACBABACCABBCCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBACAABABCBCBBCABBBCBCABBBABAAACBABBACABBCABABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe" start= auto displayName= "UserDataSvc_ACBACAABABCBCBBCABBBCBCABBBABAAACBABBACABBCABABCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBACAABABCBCBBCABBBCBCABBBABAAACBABBACABBCABABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe" start= auto displayName= "UserDataSvc_ACBACAABABCBCBBCABBBCBCABBBABAAACBABBACABBCABABCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBACAABABCBCBBCABBBCBCABBBABAAACBABBACABBCABABCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBACAABABCBCBBCABBBCBCABBBABAAACBABBACABBCABABCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABCABCBCBBBAABACCBCCBBCAAABCCBCBAAABABABCABCCACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBABCABCBCBBBAABACCBCCBBCAAABCCBCBAAABABABCABCCACBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
1⤵
- Executes dropped EXE
PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 66bd86de002c4287e05cea07cde3dbe2c7bf203414628d181d9f4ca4b5e3655e
MD5 7caaa5cbc162a2b1e58d05d5850deccb
SHA1 4b059a1df934ed0d476feb7c04eaaeddbde85c83
SHA512 131c10c7fd9c61fa7fa11134af3395f47c6122bfdf4ce0276fc1fcbc54db73a62d8e775198b655c85b80a7fa02219d66ae0a193bb691b17db1186fa0aac1fcf5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 156f395f588b82c1406b26fda06da0f533ec87380950cd77b25043e910e842d1
MD5 334c203432432362f31ccee3f96dbd0a
SHA1 b01cd1b59bb5102df6d61c25b199028e2762d850
SHA512 41119629ff8e72193a6993913dfe3e121d30b5b8e31d36836039b994d5f1281d7a5569e232456224374beef3c6e7c752e08b5ac165993a33259746bc8026226a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e63176930676169a060a8eae9d6d899cdea0d5f0495d3511ccf330d80420a992
MD5 77463f813d0b4b821ecb980e53c6a572
SHA1 cdb180a9cd577c62c3aaf0f790e3edb7570a835e
SHA512 97175b425f008f9375c1b041f722fce0c8943ba2538cdb3bec08be2c0ec833b1359ff81389bb6b7404aeee270f3f9afd91cc9f73c97d267fae42d97723ac9961
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4f37e9a9af5c386b8afd6c8ae61e872b57606bce979f82404cb14de77140548b
MD5 65d5130c099c7876ea1cb9a3f95b18be
SHA1 c38445f8c097181b85fb8739ccddd2710b732313
SHA512 03f5016ff2a017c7e732da844145ec2d0e58957ca106d978d3e06806d7085d49393023a4736f3b9e6fabcdd5a64908c2bcffe1c6f99f64f9b89ebe8091a210f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8230528d671106c6cc56ba4868ef4bc9afee1e275fff2a11308223356841258c
MD5 8781db0ec80f7d43ca16c745296b1d8d
SHA1 a313f1c24d82a3c35d33a7d7aafd80ab8f2b73bb
SHA512 6325ccf9bd4b43dde18034ca1021d9a211976b2d48ac323568b46777a1449dc286a1d6a85c622becb24a65c5c520851cde0a690992e7dd89b25ae4c237d8ac5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 23c03e40274b9bbf2691d049a046be19fa815f4c6dcd2e1f85f88f6c3e77b679
MD5 38f7096c190284e199e906670dc3c9af
SHA1 f77ccb5ffcd6fce0601aec94a8162aa5e176d272
SHA512 46c1e90090f81ddc6e78207ebd9c872a745b26c74c15028093b5d56ccf37c549f1c8f133f89d37b58a17340237344ea55797117975168bc03efbfafd4cd1f462
MD5 SHA1 SHA512

Submit Download

svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBCCBCCCBABBABCCAACBABCBBCBCCBCCBBBCCBACBABBCACBCA.exe
Size 15.0MB
SHA256 293ce37cd7f22d39404169df754b883c5a06302368e579300e9cba12c91973a2
MD5 fcf802af7ccd9111a3133440b8833834
SHA1 686b5d7002cfd4fc9ed499c39b10d1206e7cec85
SHA512 a238da0bc10b0f1f76eff2bf477284cb5a03343c95362f92f053adeb604de3df9ffce65537c14482ad8b402000c66e2eaef631e16a593e4bcb166c6ab9eb3f0b
SSDEEP 98304:Y5H5H5H5H5H5H5H5H5iKjKWQckVgtev5mnlNLa:Y5H5H5H5H5H5H5H5H5PKWQc0gEYnvLa
TLSH
T155F64B09FAC71071E97755B04CDBD2BF8D30BE2187218EEFE649961B6932BD0A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f361588c941b2948711b89e4c1f4a9bbb1adf49799f73cfe29afd365394935dd
MD5 5462e624781df5151dc295b2b9f9e650
SHA1 88e7d20979413116a061b6eb8bd3498c7c4e850f
SHA512 9429665558a9ceb71a1e1d2cdda5069641e76a67e8f16df03b8bc052f684288edb09ad135a0a68aa20e1b92bb82ff3c5fd3a81b539b516b41d440f48fe61e262
TLSH
T1FA119150F0F9D897A93364CF9226CDE60CE4379B689CAB58131E411CABD98338D6D4F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2016-70-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/5840-32-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/6060-0-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/6060-8-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download