0cae5bc4dc7e9b68fad06355f398ec31da5eee4a9c2ac1a1b0bc62c7aee87001

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 17.4MB
Sample260905-c3dvaadm8v
SHA256 0cae5bc4dc7e9b68fad06355f398ec31da5eee4a9c2ac1a1b0bc62c7aee87001
MD5 99a05f4f02e2257fc97bfebf9f02f641
SHA1 2dd17769e963edc3a0481a33bf1823900308ff31
SHA512 f8be33857b7380f955a532917a4f55c1262066f5d81650ddd8d38f3b296efcb1064c7e3eb9ba91ed0c552f887b61d342cfd5e7f26bddb41f5d5f013276c11664
SSDEEP 98304:G1MbQ01MbQ01MbQ01MbQ01MbQQKjKWQckVgtev5mnlNL/:G1t01t01t01t01tlKWQc0gEYnvL/
TLSH
T15A076C09B7ED0464E9B7A13489A6C67ADAB278514731C7DF9291C73E1F33AD0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
608	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
5024	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
4116	svchost_BACACCCCBBAACCCCBCBBACCAABACBBBACBBBBBCCAABCBCBABAAACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBACBCBCACABBBBACBCBCACACCCABAABBBBBBAAACCABBBBBCBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe"	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAACBBACCBBABBCACCAABABAABCBBAABABBAAABAAABCBABACABBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACCCCBBAACCCCBCBBACCAABACBBBACBBBBBCCAABCBCBABAAACBC.exe"	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2980	sc.exe
4744	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5440	cmd.exe
688	cmd.exe
1072	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACCCCBBAACCCCBCBBACCAABACBBBACBBBBBCCAABCBCBABAAACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5064	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5064	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5064	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5064	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
608	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
608	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
608	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
608	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	608	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5440	5064	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 5440 wrote to memory of 2832	5440	cmd.exe	94
PID 5064 wrote to memory of 688	5064	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	95
PID 688 wrote to memory of 2980	688	cmd.exe	97
PID 5064 wrote to memory of 1072	5064	2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 1072 wrote to memory of 4744	1072	cmd.exe	100
PID 608 wrote to memory of 3380	608	svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_99a05f4f02e2257fc97bfebf9f02f641_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAABCBABBBACCBBCBBBBCAABBCAACABACBAABBCCBCACACCBBAACBAACCABACAABACCAABCBCABBBBCCBCABCABCCCCBABBACCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAABCBABBBACCBBCBBBBCAABBCAACABACBAABBCCBCACACCBBAACBAACCABACAABACCAABCBCABBBBCCBCABCABCCCCBABBACCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBBACCABCCBBACCCCCBCAAACCABBACAABBAAACABBABBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe" start= auto displayName= "UserDataSvc_CACCBBACCABCCBBACCCCCBCAAACCABBACAABBAAACABBABBBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCBBACCABCCBBACCCCCBCAAACCABBACAABBAAACABBABBBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe" start= auto displayName= "UserDataSvc_CACCBBACCABCCBBACCCCCBCAAACCABBACAABBAAACABBABBBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBBACCABCCBBACCCCCBCAAACCABBACAABBAAACABBABBBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCBBACCABCCBBACCCCCBCAAACCABBACAABBAAACABBABBBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
1⤵
- Executes dropped EXE
PID:5024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACCCCBBAACCCCBCBBACCAABACBBBACBBBBBCCAABCBCBABAAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACCCCBBAACCCCBCBBACCAABACBBBACBBBBBCCAABCBCBABAAACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f2cceec87e8936068ea5588b30b32f929fa4d7829f0f9e44b8b341694770014
MD5 7dae68da98150edaee8ca6d5c6c3607e
SHA1 fb8b4050ac4fda656cbd3bbaf85e88cde2afd00b
SHA512 6ddb5fc660ca6b95d3fcede123f87684da9c5115841f22432d0dfdad41516b7fa4026abe454634ecfb4e849f7fe3dfa0f5c42624487b2af8f1be981eed94469c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9f64b59890ca937182304e94498bff2e722819196e70a3c603571a352d04a390
MD5 901768c54512b579651b45a26da4931c
SHA1 28a53036efc86156fb5bd20099351a6133badc57
SHA512 51f89ed2b8968c3343fb0c2d69bee643b8dbfbe4bb0b16b318751c163ee6dc13a6fb82b4c5ac5215687a7615a094e22252bbf9ae0bde2cf6d84eb410d99178c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2facc0440a5ae529d19dbbf9bd2751f8eeff37cbc585bc98ff48d8ec00426c57
MD5 b27dfabc91479c3cdbf2999a7fb32d65
SHA1 c7ac8641980882d58ecab0e42cd9a2757894a2c1
SHA512 f80a12ef344d5bc21a9028f4705c057c1364c784be1f2324db7b928a323b8c7ae3c00abf82979b5b6e11a1dd08f675b14c9e0bef874e245143831ad6c3b5add4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f0bdb2da77b06ad25ef65782179d87d115a5eb08599514f68fa1a8cb1d039f2
MD5 9c87586161bf0bdb778585ae831d9d89
SHA1 278e4aebebe81993d18bf80be40631c4fa3a6d48
SHA512 9da8e7541a696b19d840548a2fb4dec249a34cac7a5817f91610bca46ef6032f29d31ba9dd091754f84f99ef535da46c6bafdd638e8e8db8824d0d1cfc114568
MD5 SHA1 SHA512

Submit Download

svchost_BACACCCCBBAACCCCBCBBACCAABACBBBACBBBBBCCAABCBCBABAAACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACCCCBBAACCCCBCBBACCAABACBBBACBBBBBCCAABCBCBABAAACBC.exe
Size 15.0MB
SHA256 d3cf16e48a14333c273e58b7c3abb54d63664150f1d115a75a261ddcc2360125
MD5 e55a3b4ba4b447223fa2aa7fb5258574
SHA1 b3d5d2358b65d65c1cddae7612577698f681ed58
SHA512 d78f04571d0a18c8f8f041bdb9f5bcf592a5b400bf8aa8a8870898abc9646c6582ca54558dfc8edc5fa18bc37c0c950d0a00e8135229fa143eb95574c015e0e6
SSDEEP 49152:U+EPiw25+E5+Ef+EPiw25+Ef+EPiw25+Ef+EPiw25+EjozMlTzQ/7YGsTjnL+EPI:G1MbQ01MbQ01MbQ01MbQ5
TLSH
T111F64B09B7ED0464E5B7A17489A6C67ADAB278514731C7DF9281C73E1F33AE0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBACCBBABACABBBBABBCCCBCABBACCCCCABCCCBBCABACABA.exe
Size 17.4MB
SHA256 0cae5bc4dc7e9b68fad06355f398ec31da5eee4a9c2ac1a1b0bc62c7aee87001
MD5 99a05f4f02e2257fc97bfebf9f02f641
SHA1 2dd17769e963edc3a0481a33bf1823900308ff31
SHA512 f8be33857b7380f955a532917a4f55c1262066f5d81650ddd8d38f3b296efcb1064c7e3eb9ba91ed0c552f887b61d342cfd5e7f26bddb41f5d5f013276c11664
SSDEEP 98304:G1MbQ01MbQ01MbQ01MbQ01MbQQKjKWQckVgtev5mnlNL/:G1t01t01t01t01tlKWQc0gEYnvL/
TLSH
T15A076C09B7ED0464E9B7A13489A6C67ADAB278514731C7DF9291C73E1F33AD0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/608-24-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/608-37-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/5064-0-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/5064-8-0x0000000000780000-0x00000000007A1000-memory.dmp

Download