Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe
- Size 433KB
- Sample260905-dalvvsstgt
- SHA256 9fdaa2b770b7bca77e33317c945efa817664d6a3b7f8e21fe0f2f31c7d66527d
- MD5 97814cd41755885fc7c22cd3cc3b6ec9
- SHA1 f708d5da90f86c522833aa9734ab9d9fa2d8cfec
- SHA512 6bda25435f39ef440a51c03f063c3039481a693cb06f3255caf906298714b98e5566026003c893c6e79bf77f7446ee9aad89692c68fc1d54d71ceb3ddcf256ce
- SSDEEP 12288:oG8LjBTqKT60jr2Ybtre5MAgZQK9ZBnRNhcvp:oGw8Ku29ZZhqp
- TLSH T1DD94AF06B9C1C479F0768479187A9BB56A3FF9220B4087C72B54D6795F316C08E3EBB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2668 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.sho - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Shohdi.hdi 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification C:\Windows\SysWOW64\Shohdi.hdi 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\VideoLAN\VLC\uninstall.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\VideoLAN\VLC\vlc.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.sho 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.sho Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2668 1488 2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.shoC:\Users\Admin\AppData\Local\Temp\2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.sho2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.sho
- Path C:\Users\Admin\AppData\Local\Temp\2026-09-04_97814cd41755885fc7c22cd3cc3b6ec9_amadey_cobalt-strike_elex_hellokitty_luca-stealer_nymaim.sho
- Size 140KB
- SHA256 a09f012723c5425bb928399302eb90362116855b3d0612347e76e8b7c82127b7
- MD5 9c98d1a23efaf1b156a130cea7d2ee3a
- SHA1 947a300323ce1b2468422ad62316cb5da039e423
- SHA512 f74396ce284ca7f02f51474ddec39629310451743e7ca08deda9f43cb314d97c7671ea3c504f3f09495e733a6b9bc196ae971553e9e3c4741b287e613be6ef6f
- SSDEEP 3072:1JEXiJu7COG12zuf9AxnPKiadKSUoxzWCtnRPF9EVnb43jaI5grI2v0:0K9J2JPT/SUxCtnRPF9cCGrI2v
- TLSH T198E3AF13BAC1D475F671083428769A91CA3FFC815F615EAB3B98357A4F342C09932EA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Shohdi.hdi
- Size 433KB
- SHA256 491921beff9452b7c5ad1880c2f4f00e429ee05b1b91fd27b79268499f7764f4
- MD5 60264f8f320426b0a295a52be1ec5263
- SHA1 413cfd36851d99e57d0c46218163f8199269b3e5
- SHA512 8e74614911a5fe19a7719680600c96e460c0b7519ddec4d714a13a36a43ca53758e01d0d0edcf58e1e2f8c4ddba2926301326add3df2f0f7274bd4bddab83928
- SSDEEP 12288:pG8LjBTqKT60jr2Ybtre5MAgZQK9ZBnRNhcvp:pGw8Ku29ZZhqp
- TLSH T1D094AF06B9C18479F0778479187A9BB56A3FF9220B4087C72B54D6795F316C08E3EBB2
- MD5 SHA1 SHA512 SSDEEP TLSH