48e324c57982a288d9d795f9f9600958fc611d03b9bb93f14490e994288cbac8

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 10.1MB
Sample260831-vr856adn8t
SHA256 48e324c57982a288d9d795f9f9600958fc611d03b9bb93f14490e994288cbac8
MD5 8f7083990e3f25560793355327ad63ee
SHA1 77269f8091972515aa3e09e9c20f403afdac08d5
SHA512 098fab8f904e08a6475d0443f73b6927c8b8130dbde0833e28fbffe4f45898e6ac784682d4a288f44cc2e690520ec882747eca01609cab90d7490b574db7eb7d
SSDEEP 49152:U+En+EO+EM+ECiw26hO0+En+EO+EM+ECiw26hO0+En+EO+EM+ECiw26hO0+En+ED:jwwwwwwwwGKjKWQckVgtev5mnlNLH
TLSH
T1F4B65E09F6DE04A4E5B7617089A7C27ACA72B8615731CADFD284C63E5E33BD4AC34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
5832	svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
4192	svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAABACCCBBCCCBCBAABCACABBCBBCCABACBBCBCABBCAABCBAAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe"	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3000	sc.exe
3468	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3156	cmd.exe
5916	cmd.exe
2324	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5872	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5872	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5872	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5872	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5832	svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
5832	svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
5832	svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
5832	svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5872	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5832	svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 5916	5872	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 5916 wrote to memory of 5828	5916	cmd.exe	94
PID 5832 wrote to memory of 4348	5832	svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe	95
PID 5872 wrote to memory of 2324	5872	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	96
PID 2324 wrote to memory of 3000	2324	cmd.exe	98
PID 5872 wrote to memory of 3156	5872	2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	99
PID 3156 wrote to memory of 3468	3156	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_8f7083990e3f25560793355327ad63ee_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABAAAABCBCBACAAAACACBBCCBACABCCBCBABAACCACCCABCACBBABCBCACAAABCCBCCCAACBBCCACCBBBCBCCBACACCAACAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABAAAABCBCBACAAAACACBBCCBACABCCBCBABAACCACCCABCACBBABCBCACAAABCCBCCCAACBBCCACCBBBCBCCBACACCAACAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABAABCCBBAABCBBBCCABBCBBAAAAACBAAAABBBBCABCBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe" start= auto displayName= "UserDataSvc_CBBABAABCCBBAABCBBBCCABBCBBAAAAACBAAAABBBBCABCBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBABAABCCBBAABCBBBCCABBCBBAAAAACBAAAABBBBCABCBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe" start= auto displayName= "UserDataSvc_CBBABAABCCBBAABCBBBCCABBCBBAAAAACBAAAABBBBCABCBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABAABCCBBAABCBBBCCABBCBBAAAAACBAAAABBBBCABCBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBABAABCCBBAABCBBBCCABBCBBAAAAACBAAAABBBBCABCBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
1⤵
- Executes dropped EXE
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a57857b1bf59014f531a55e720e7e3de788f39360b9f843bc0fa67a5744b264e
MD5 f00012e05751f55b7468589215b5693a
SHA1 756c82138dc9b2baee339dc19417c3d4af4d03e1
SHA512 40f48438dee1211bf5742e6489051db8453596bb2f7839bc5e161e5045f57dc06a92134962c90536f22a0310c69b1bed0993ffbf5219b3571dae1dd3a97b4c01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e716986ef84e717ab832b9c80bcd9f7745bdf06aabe4c3bad76a9cfc492b6416
MD5 8ee3f3263f1872ec07f84d9eeb064237
SHA1 0afee8de1c2da3332a6b2543849ef642b6578da0
SHA512 a9517e1f2f88aff12e448039538249aa77b707ccff9d3264a36c49a46d95b99c0244f171ba07e7e7117a41b49e63d90c44073b4cb24e73fbb089b2a7ca0a466a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6984906ebf08b96aaf0db7c265f5dc1742508ff0ea2e048e33e131921d814dc
MD5 f73eb5e1cf3cacb1717e445c0b3935af
SHA1 c679a718cb7621885303f3fa3d21d8f4b1af354f
SHA512 7a96e8da2fd626b68996da887bebefe2af8968096e8a46606498ee7346c73e4cbe4655526b9cbf6b4f64491f36916c5605cc77c654e9db6b6f4236b85af475f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d96f71455d0fedfef2f4575440abc8dbf4a1de4bf2e6e2250681bd9f36fe4955
MD5 a59ab8a3af73f95d0773b956d8487cdf
SHA1 78d656f6a5addfab22f15aa88ca0bf8fa9c77000
SHA512 00791a65899cbdc6e88c7372801ca772f5566f216534e5ec59bd72ded3e0b1bbab2b71fdfc15fb59353db79469b0345e00e10d6e725b4b9655567caa12387748
MD5 SHA1 SHA512

Submit Download

svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACACBCABCCACABCBBBBBBCACBBACBCBCCACAAABCCACBCAAABBB.exe
Size 10.1MB
SHA256 48e324c57982a288d9d795f9f9600958fc611d03b9bb93f14490e994288cbac8
MD5 8f7083990e3f25560793355327ad63ee
SHA1 77269f8091972515aa3e09e9c20f403afdac08d5
SHA512 098fab8f904e08a6475d0443f73b6927c8b8130dbde0833e28fbffe4f45898e6ac784682d4a288f44cc2e690520ec882747eca01609cab90d7490b574db7eb7d
SSDEEP 49152:U+En+EO+EM+ECiw26hO0+En+EO+EM+ECiw26hO0+En+EO+EM+ECiw26hO0+En+ED:jwwwwwwwwGKjKWQckVgtev5mnlNLH
TLSH
T1F4B65E09F6DE04A4E5B7617089A7C27ACA72B8615731CADFD284C63E5E33BD4AC34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5832-24-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/5832-37-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/5872-0-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/5872-8-0x0000000000550000-0x0000000000571000-memory.dmp

Download