8a0db2a15289c583c812426f6336cebaac6585e9a84a4a2da5fbc495105a4c28

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 13.5MB
Sample260905-ghkvbavsdy
SHA256 8a0db2a15289c583c812426f6336cebaac6585e9a84a4a2da5fbc495105a4c28
MD5 7cb9135865bc723cee3dfbac455d86e5
SHA1 227fd4859f5cad6a184bf59a17c727c5db7439a5
SHA512 d99cf083d4af2d6e3a395cefa70d1f9121c58c97ea51ee4b6f2cd56f6e54028fed76560621c2b80761b09f8186363c9fb3601d174ab58956c67e433bee40720d
SSDEEP 49152:U+ES+Em+ES+ES+ES+EZohO0+ES+ES+EZJ+ES+ES+Em+ES+ES+ES+Em+ES+ES+EST:YccccccGKjKWQckVgtev5mnlNL
TLSH
T1A8E65C09F98700B1D87751B04DDBD2BF8A30BA2587128DEFE649C76B6933BE16838715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1840	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
2556	svchost_BCBACACAABCABCAAACABABACBBBBBABCABACACAACAAABCABACBCACC.exe
5092	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABBBCCCAABAABABACCCAAABAABBCCABCAAAABCCCAAABBBCACBBAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe"	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCABAABCBCBBCBABCAAABCCBCAAABBCCCAAAACBBCCABBABCAACAACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACACAABCABCAAACABABACBBBBBABCABACACAACAAABCABACBCACC.exe"	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4472	sc.exe
4124	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1132	cmd.exe
3544	cmd.exe
1148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACACAABCABCAAACABABACBBBBBABCABACACAACAAABCABACBCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1928	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1928	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1928	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1928	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1840	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
1840	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
1840	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
1840	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1840	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2024	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1132	1928	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	103
PID 1132 wrote to memory of 2596	1132	cmd.exe	105
PID 1840 wrote to memory of 4756	1840	svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe	106
PID 4756 wrote to memory of 2248	4756	notepad.exe	107
PID 1928 wrote to memory of 3544	1928	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	111
PID 3544 wrote to memory of 4472	3544	cmd.exe	113
PID 1928 wrote to memory of 1148	1928	2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	114
PID 1148 wrote to memory of 4124	1148	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_7cb9135865bc723cee3dfbac455d86e5_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAABBAACAAABCBABCBBBAABACBCCCAABACBCAACBACCBBCBCBACCBBAABCBACBACAABCAACAACBCABACCCBCCCABAAABABAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAABBAACAAABCBABCBBBAABACBCCCAABACBCAACBACCBBCBCBACCBBAABCBACBACAABCAACAACBCABACCCBCCCABAAABABAACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABAABBBCCABCCABCABBBABABBACBCAACABACCACBCAABBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe" start= auto displayName= "UserDataSvc_CCAABAABBBCCABCCABCABBBABABBACBCAACABACCACBCAABBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABAABBBCCABCCABCABBBABABBACBCAACABACCACBCAABBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe" start= auto displayName= "UserDataSvc_CCAABAABBBCCABCCABCABBBABABBACBCAACABACCACBCAABBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABAABBBCCABCCABCABBBABABBACBCAACABACCACBCAABBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABAABBBCCABCCABCABBBABABBACBCAACABACCACBCAABBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACAABCABCAAACABABACBBBBBABCABACACAACAAABCABACBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACAABCABCAAACABABACBBBBBABCABACACAACAAABCABACBCACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
1⤵
- Executes dropped EXE
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07d8b2f3e071878da3078784dbdf482f7e6f9c9f51593b9d47c6afc2c2eb2b0f
MD5 fee312b244607365a88ea99931da8983
SHA1 2e0d3acd3f21616d4797aa3c2b5b1a8dd6a7fdac
SHA512 5eecf2ccbc080c05d36fc8713f594f4e3c9887183f08681befbc9ff657a8243c482b2a37ace519cc690adfe77fd18501c673b3b0ab28a8b0fcf3c02a043e371d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f747919d7c8a04936d6c277aefc68cc5dc4cb97b95ea86f4c382e953fc3779a6
MD5 ba3f6919128bcf1c06427c7bd01a3e99
SHA1 4bee4a578b9f966091aba6a7b8288b265188984c
SHA512 d09bc5699a828d2283a436cd4dd4f44842f9f6552708c3bbfe1d04b85d56e770aec3e00c6b9a5128eed33dfb16959412eb3c0f04ed28b58b9c146c30c47b50ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 39259ea092725902f0dbd38bb56a25a758e508d2ae05605f9336d91fe2b4d77a
MD5 f49f0dab1460da8f51e5b14b3511d34d
SHA1 ec4738b93c0ff951d62d7c0fad61b331383580c6
SHA512 a47c0527771110b383b83e089aff2f27d1a9de6d69ea2d6318635b4667ef67590934d0b472abb1c671bd5f1be1be8586c47a179bdea757a8c51ddc1f121f7603
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79d5333f92df7032c3879bbaf59a401a50bc0cb069852edc124621290f2adc64
MD5 aaec61a67f3f292c853810ebaa2e6d5f
SHA1 9d2f596500c5e136c6f304791e6de2522e8cb063
SHA512 07c386f997c7469fa150d5e5dfb1206057e94d47aee0bc1d9d1db603c7703342eaa30a73d1ceb928b9d2e2bc2605b466010aa6e4c4fc06d01fd1797713b66d2a
MD5 SHA1 SHA512

Submit Download

svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBABACAACBCCBCCABCBBCAACACCCAAAABABBCABACCAAACABABABB.exe
Size 13.5MB
SHA256 8a0db2a15289c583c812426f6336cebaac6585e9a84a4a2da5fbc495105a4c28
MD5 7cb9135865bc723cee3dfbac455d86e5
SHA1 227fd4859f5cad6a184bf59a17c727c5db7439a5
SHA512 d99cf083d4af2d6e3a395cefa70d1f9121c58c97ea51ee4b6f2cd56f6e54028fed76560621c2b80761b09f8186363c9fb3601d174ab58956c67e433bee40720d
SSDEEP 49152:U+ES+Em+ES+ES+ES+EZohO0+ES+ES+EZJ+ES+ES+Em+ES+ES+ES+Em+ES+ES+EST:YccccccGKjKWQckVgtev5mnlNL
TLSH
T1A8E65C09F98700B1D87751B04DDBD2BF8A30BA2587128DEFE649C76B6933BE16838715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1840-27-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/1840-37-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/1928-0-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/1928-8-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/4756-61-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download