64e6d0abba76f6f726b39769951f13e04c8db717c6c73420f9e7065dfc43f985

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 10.3MB
Sample260901-2tzg3afb49
SHA256 64e6d0abba76f6f726b39769951f13e04c8db717c6c73420f9e7065dfc43f985
MD5 fb80c8e645b92b5be81cf1d94067ac2a
SHA1 a59bc1a06f926bfc187b5fcebd2e56d9a5921fde
SHA512 20fdb41816adb384a13b63aa94664734e16f9688e0717760e7dfcc406fce4a344b26df7d20f8cdad1edbb579246d43a9701fe1516a57313330118313dcecfcfe
SSDEEP 49152:U+E7+ES+EV+ES+EJ+E7+ES+EJ+E7+ES+E5+ES+EJ+E7+ES+EV+ES+EJ+E7+ES+Ew:QKjKWQckVgtev5mnlNL
TLSH
T132B66D09F94350B1D92B50F04DCFD3BF8A60BB25C6128DF7FB8D8B5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5344	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
5424	svchost_ABACACABABCBBABCBCBCCBAACACBACCABBBABAABACCACAABCCBBACA.exe
4588	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACCABCABBBABCCACABACCBCACABBAACACACBACABACBBACCBBABBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe"	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBCBACCBCBAACCCAAAABBACCAAABBBABABBBCBACBABCCBBCAACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACACABABCBBABCBCBCCBAACACBACCABBBABAABACCACAABCCBBACA.exe"	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5640	sc.exe
4608	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1292	cmd.exe
5836	cmd.exe
5652	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACACABABCBBABCBCBCCBAACACBACCABBBABAABACCACAABCCBBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5532	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5532	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5532	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5532	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5344	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
5344	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
5344	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
5344	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
5424	svchost_ABACACABABCBBABCBCBCCBAACACBACCABBBABAABACCACAABCCBBACA.exe
5424	svchost_ABACACABABCBBABCBCBCCBAACACBACCABBBABAABACCACAABCCBBACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5532	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5344	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
Token: SeDebugPrivilege	5424	svchost_ABACACABABCBBABCBCBCCBAACACBACCABBBABAABACCACAABCCBBACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 1292	5532	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 1292 wrote to memory of 4868	1292	cmd.exe	94
PID 5344 wrote to memory of 4556	5344	svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe	95
PID 5532 wrote to memory of 5836	5532	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 5836 wrote to memory of 5640	5836	cmd.exe	100
PID 5532 wrote to memory of 5652	5532	2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 5652 wrote to memory of 4608	5652	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_fb80c8e645b92b5be81cf1d94067ac2a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCACBBACCCBABCBBCACBBBBBBAABAABCCCAACCBCCBAACBBBBABCABABBCCACCBCCBCAABCBCCAAABAAABCABBCCCACCAAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCACBBACCCBABCBBCACBBBBBBAABAABCCCAACCBCCBAACBBBBABCABABBCCACCBCCBCAABCBCCAAABAAABCABBCCCACCAAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAABBBCBACABAAABBAAAABACAABAAAAACACABCCCACACBBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe" start= auto displayName= "UserDataSvc_BAAABBBCBACABAAABBAAAABACAABAAAAACACABCCCACACBBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAABBBCBACABAAABBAAAABACAABAAAAACACABCCCACACBBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe" start= auto displayName= "UserDataSvc_BAAABBBCBACABAAABBAAAABACAABAAAAACACABCCCACACBBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAABBBCBACABAAABBAAAABACAABAAAAACACABCCCACACBBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAABBBCBACABAAABBAAAABACAABAAAAACACABCCCACACBBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACABABCBBABCBCBCCBAACACBACCABBBABAABACCACAABCCBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACABABCBBABCBCBCCBAACACBACCABBBABAABACCACAABCCBBACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
1⤵
- Executes dropped EXE
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e45f9ce55e823dbc74e01312a266e849a01ea5d7d993cbc4524d08a31641e850
MD5 9acc930d7f8a324c5ea135c162817579
SHA1 82afb24fea73e8b6503f1782cf6367697992cf61
SHA512 fc031f8a01f5437e03b6e5a3fdb3e5d0855b8288f359fb08f07eed6af86dc1e7552d3ba75c8a0d6f8d4deafc0be1985685b497d50e1ffeab62cba1f0e5d21fce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f41b2e387012df0c6b09f009e6ec7e079c13614804421d8b06eb49c7e328cabc
MD5 81e21d7dcb5902bd83aee99fdf82a1f6
SHA1 fdec84de4d2c802f1f0ae4a9a73ca403b7f29b5f
SHA512 300906a9fc9450cc99153ebe5e32007b530595abe948ec6392a95a7c526809fbe05dffb11328eb980bfecb4ec93e52baab67fead2dc4f409836a0ebf82a2686c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e1f9271771d8937551819b32a863d42c1a5fcdca9834f7d01a7157fd1e05eff7
MD5 ec0ca6a94074058c4d1e3449d87cb13c
SHA1 1f0571475fc94275ac17f470e40e176d8c24d301
SHA512 44f2b3840eea87233a61a73594b2ea428df9b506026516d9f39c4a38f7f3c55965b9fe1be86dc0cc447c5279c5b19a9dd2c6ade7f3337893185d2d408d21497a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9af34b0604f1e6874f57117fcfc43bc84174a3581fc5b1b2b0f1874bb4c83e44
MD5 73e2698a7493232ae3c8de012931e7f5
SHA1 953b87255ed12dc65c64823d2034137efaa46ff6
SHA512 008ae9dfe29c1810773b44aadf0c999d2a67f7ff1bc4d969322e12a432cef9f702f1c01178d3facc32d50ac424284e769bcabeb0b985b2b330a2c4f090bef6e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 69c8a06b74a7a908dd53c751e2760276e42726e445976e702005590019cc172d
MD5 ea9c742e279310d970a599e3ac9ec83a
SHA1 55050d64dad6fa7cda8053bc53cc32c4e5113d6b
SHA512 e9654f6e4e24dd9d27f7ef1ac43015ed0f2008ad82b9b0a0cae35e881e8e9472cd57ac46f60be13866dc67b0db9f7cf5288e7bf6774c31f922ee4d090accfee3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b74a981943d14cbbfdc3f82f95ab25f723a04e95c86de4f981b8ef7f6d7885d1
MD5 18022466235717914671b58e04097fe6
SHA1 0ef17e362f51cf9a9fd15ce5d36e45568c3d3450
SHA512 a4a4628ff00ea3c3cda3918706ea747e64b7e4009d5fe25a40bd5336c9a3c5e28cdc5ce94820041b0b8306928a0932adc03aa273bf4a9598750bae2f0c818b05
MD5 SHA1 SHA512

Submit Download

svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCACAAACBBCAACACAAAAACBCCAACBCBBBCBBACBABAAABBACBBB.exe
Size 10.3MB
SHA256 64e6d0abba76f6f726b39769951f13e04c8db717c6c73420f9e7065dfc43f985
MD5 fb80c8e645b92b5be81cf1d94067ac2a
SHA1 a59bc1a06f926bfc187b5fcebd2e56d9a5921fde
SHA512 20fdb41816adb384a13b63aa94664734e16f9688e0717760e7dfcc406fce4a344b26df7d20f8cdad1edbb579246d43a9701fe1516a57313330118313dcecfcfe
SSDEEP 49152:U+E7+ES+EV+ES+EJ+E7+ES+EJ+E7+ES+E5+ES+EJ+E7+ES+EV+ES+EJ+E7+ES+Ew:QKjKWQckVgtev5mnlNL
TLSH
T132B66D09F94350B1D92B50F04DCFD3BF8A60BB25C6128DF7FB8D8B5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b070fdf4edd00f4567a108382c2687278b6407f40151cee8caa73c93c4674f9d
MD5 6ab195fab95884209028893cccae25cd
SHA1 18e08d72cdabc5519c387622b4ac0752dc556918
SHA512 8899d8e681a5a391aaf5e720e3b1926a36d8fbb9e0249fd5049d12c50224a5be0baaffcd6798c65b8808388574cb2f9fff5237c220a5f61f2e21a850adf22b2b
TLSH
T17211C862B0F5DC27F13224C39615DBC70CE63BD75858AB58274D921C7719879CD254E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4588-81-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5344-33-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5344-23-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/5424-79-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5532-0-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/5532-7-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download