d63e2e93751c7bfa1f5475b7a05ccb9144846fe1c9672ebae036d5186b5dadac

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 2.3MB
Sample260905-ph937sthjd
SHA256 d63e2e93751c7bfa1f5475b7a05ccb9144846fe1c9672ebae036d5186b5dadac
MD5 46d1a29c166ffc6d3f06fe68575064e2
SHA1 a5ef844c6b0edd4f36dd9d83fc2d181091e36662
SHA512 46ad1f8701ff5eae9c0bb30635455f1bd52c065725ef7a271cd11555228223a9706ba717f697aae528bac5b1423211d5923e404a44cdf7c8497553fa6300e4d6
SSDEEP 49152:U+Eu+Eu+Eu+Eu+Eu+Eu+Eu+Eu+Eu+Eu+EBKjKWQc2b1FVgbjrjxPe1pbPSQm1Fla:EKjKWQckVgtev5mnlNL4
TLSH
T1BBB5C009F98340B1D92B51B04CDFD3BF8A64BB2586128DF7F74ECB1B6932BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4332	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
1516	svchost_CAAABCABCACCABACBACBAABCCABCBCBACBCAACABCABCACBCAABABBC.exe
1760	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCBABCBBBBCACABACCAACACACAABABBBABBBCBCBBACBBBACACCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABCABCACCABACBACBAABCCABCBCBACBCAACABCABCACBCAABABBC.exe"	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBABAACCCBCCACBBCBCACBCABCABCBCCBBCCCBCCCBBCABBCBABABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe"	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1120	sc.exe
3632	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1224	cmd.exe
3336	cmd.exe
1836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABCABCACCABACBACBAABCCABCBCBACBCAACABCABCACBCAABABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1048	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1048	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1048	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1048	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4332	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
4332	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
4332	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
4332	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4332	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1224	1048	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	91
PID 1224 wrote to memory of 3864	1224	cmd.exe	93
PID 4332 wrote to memory of 6016	4332	svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe	94
PID 1048 wrote to memory of 3336	1048	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	97
PID 3336 wrote to memory of 1120	3336	cmd.exe	99
PID 1048 wrote to memory of 1836	1048	2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	100
PID 1836 wrote to memory of 3632	1836	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_46d1a29c166ffc6d3f06fe68575064e2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAAACBAAABAAAAAACACBBCCBBBAAABCBACACAABAAAACCBACACABBAAABACABABBAABACAAAABAACBCBBACCBBBCBCBCBAAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAAACBAAABAAAAAACACBBCCBBBAAABCBACACAABAAAACCBACACABBAAABACABABBAABACAAAABAACBCBBACCBBBCBCBCBAAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCAABAACCAACCACBBBCCBACBCABCAACCBBCACCCAAAABACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe" start= auto displayName= "UserDataSvc_CCCCAABAACCAACCACBBBCCBACBCABCAACCBBCACCCAAAABACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCAABAACCAACCACBBBCCBACBCABCAACCBBCACCCAAAABACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe" start= auto displayName= "UserDataSvc_CCCCAABAACCAACCACBBBCCBACBCABCAACCBBCACCCAAAABACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCAABAACCAACCACBBBCCBACBCABCAACCBBCACCCAAAABACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCAABAACCAACCACBBBCCBACBCABCAACCBBCACCCAAAABACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCABCACCABACBACBAABCCABCBCBACBCAACABCABCACBCAABABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABCABCACCABACBACBAABCCABCBCBACBCAACABCABCACBCAABABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
1⤵
- Executes dropped EXE
PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 294c51c56d35d08fe711c3a9183b55a5cf8569885a07879b376b457e3e422534
MD5 92221c20ddec232c323dea679d25356a
SHA1 5d90aac1f3e7c9df556fee2d500e00d7a6456c08
SHA512 530c5d5ef854396d9c36f593d060b91c6a972094aae92c4c2f2c603878b5c21006dff6b70023f869d60eb3b5fa0da0b107da9642545825dbc02f86b933ce53a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13986770e29fe36a8ffa2174c9309de15e49d57c5cd1c561c0e32f089b0c3509
MD5 921fb35814f4418b16b53cebe69985d8
SHA1 a5dfbdde9dfc4e0ce5e630d282d4271098d807b7
SHA512 1748d2af1ef6357bb109a6efa7c9b3259fae5d03e434ebb874b1eba92e5cace7affb1aff294746a051da0b9a1fbbe4bfaba382e5bfe52223a7566f9dd12434bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec84fff5add102eac7f5f42cb610c86aa1c4c3f33b10c2cd8627a0ac2f82f7da
MD5 01bc12e86554ac61835e62e6472215ca
SHA1 713f1f8ec333528038de6d087d74c905cdb88ec5
SHA512 e0fc9af69b4c9a4fd34d7d55947082acaefb1ce77317d327806e7883ad187a745d56cc7febd7c345d81a2e3d6b147f6c55f8300b8f2d6874cd4811e27e7a5234
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6b50bde0b848658a1a269d4a1bd89e957aed78ae804a49d1caed91b94bace9e4
MD5 d83d22aaeab607efcec2ab9e136234ba
SHA1 dffb0aa68d103773cad80b1016f38e8f0bf698b8
SHA512 5c21ffe031605f21d49d349c9743edf37b57358eb3d8e19a9b58342cfc2236a03bbe29561b897084e69a869028199ff35ffe8c8cc2b65da640a6219313774c9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2ea0d6f9ce4bbef208385d98d87f4ddd1a604d34889617d9d000d0db2bfab9b9
MD5 39f8aa25ef9232bf93785ea8cb1ace0d
SHA1 742afa478f45761695666c97bcaaa0c196c1a93e
SHA512 3274fe2d37d8e80550da54db6c683fcd960e342bea531983a9a7c23976826590744d8926db349f823a3d0de6bcef3ba41908fdec2e5f072ce9bf897a11e03920
MD5 SHA1 SHA512

Submit Download

svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCAACAACCCCCCBBCAACCCBCCBAABAACCCBABAABAABBACBCA.exe
Size 2.3MB
SHA256 d63e2e93751c7bfa1f5475b7a05ccb9144846fe1c9672ebae036d5186b5dadac
MD5 46d1a29c166ffc6d3f06fe68575064e2
SHA1 a5ef844c6b0edd4f36dd9d83fc2d181091e36662
SHA512 46ad1f8701ff5eae9c0bb30635455f1bd52c065725ef7a271cd11555228223a9706ba717f697aae528bac5b1423211d5923e404a44cdf7c8497553fa6300e4d6
SSDEEP 49152:U+Eu+Eu+Eu+Eu+Eu+Eu+Eu+Eu+Eu+Eu+EBKjKWQc2b1FVgbjrjxPe1pbPSQm1Fla:EKjKWQckVgtev5mnlNL4
TLSH
T1BBB5C009F98340B1D92B51B04CDFD3BF8A64BB2586128DF7F74ECB1B6932BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-0-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/1048-8-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4332-24-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/4332-34-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download