f1dd207c9d5987e02125c9d54e9ca9a908f3573d9e4afe3137a87aa24ca565c3

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 15.0MB
Sample260905-stj8psem3v
SHA256 f1dd207c9d5987e02125c9d54e9ca9a908f3573d9e4afe3137a87aa24ca565c3
MD5 2d1ce62b3be75304bf0d78087131a499
SHA1 184c6a0af5d8b4c1aa713e7ad19232135d91aec8
SHA512 be10407b31d970bfb59370e2b82a634aa6e7c13c9d3730d73a1ab8bb7b6683107b450b103a4dd8550e89b696f042c93551bce3dde5794bad98ef1ab3ef797e1d
SSDEEP 49152:U+ES+ES+EZohO0+ES+ES+EZJ+ES+ES+Em+ES+ES+ES+Em+ES+ES+ES+EZohO0+Ev:1cccccccGKjKWQckVgtev5mnlNL
TLSH
T186F65C09F98700B1E87751B04DDBD2BF8A30BA2587128DEFE649C76B6933BD16838715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5128	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
5548	svchost_CCABACCBCCABBCCACBCBACACAABBCBBBBAABCACACCBACCAACACCCCB.exe
4756	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAAABAACCACCCAAACBBCBAAACCACBACCABACABCCBABCCBBCABABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe"	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBABAACBCABCCCBBCBCACCBCCBBBCAAACCABCCBACABCCABACBCBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABACCBCCABBCCACBCBACACAABBCBBBBAABCACACCBACCAACACCCCB.exe"	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4184	sc.exe
5784	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5472	cmd.exe
1388	cmd.exe
5852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABACCBCCABBCCACBCBACACAABBCBBBBAABCACACCBACCAACACCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
708	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
708	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
708	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
708	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5128	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
5128	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
5128	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
5128	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
5548	svchost_CCABACCBCCABBCCACBCBACACAABBCBBBBAABCACACCBACCAACACCCCB.exe
5548	svchost_CCABACCBCCABBCCACBCBACACAABBCBBBBAABCACACCBACCAACACCCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	708	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5128	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
Token: SeDebugPrivilege	5548	svchost_CCABACCBCCABBCCACBCBACACAABBCBBBBAABCACACCBACCAACACCCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 5472	708	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	93
PID 5472 wrote to memory of 4860	5472	cmd.exe	95
PID 5128 wrote to memory of 2036	5128	svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe	96
PID 708 wrote to memory of 1388	708	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	99
PID 1388 wrote to memory of 4184	1388	cmd.exe	101
PID 708 wrote to memory of 5852	708	2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	102
PID 5852 wrote to memory of 5784	5852	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_2d1ce62b3be75304bf0d78087131a499_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCACBABCCBACAACBCBCCABBBCABCBBBBABCAACBCBCBCBACBABBBAAAABCCCCACCBCABBAAACCCBCACBBBBBBCCCACCACBCBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCACBABCCBACAACBCBCCABBBCABCBBBBABCAACBCBCBCBACBABBBAAAABCCCCACCBCABBAAACCCBCACBBBBBBCCCACCACBCBBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCAACACCAAABBCBCAAACABCCBBCCCBCACCCACABCBAAACBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe" start= auto displayName= "UserDataSvc_BABCAACACCAAABBCBCAAACABCCBBCCCBCACCCACABCBAAACBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCAACACCAAABBCBCAAACABCCBBCCCBCACCCACABCBAAACBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe" start= auto displayName= "UserDataSvc_BABCAACACCAAABBCBCAAACABCCBBCCCBCACCCACABCBAAACBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCAACACCAAABBCBCAAACABCCBBCCCBCACCCACABCBAAACBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCAACACCAAABBCBCAAACABCCBBCCCBCACCCACABCBAAACBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCBCCABBCCACBCBACACAABBCBBBBAABCACACCBACCAACACCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACCBCCABBCCACBCBACACAABBCBBBBAABCACACCBACCAACACCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
1⤵
- Executes dropped EXE
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 691856463023c34d484bc3a9908037f3fd48248d4a1eeda254f933592d9ee5e3
MD5 fc735cb181d20bf3d57a63ea658f0850
SHA1 4cca49aa6776c7eabc28d862b55b7201d88a7545
SHA512 004efb791bfa3f856a9c1ce444c99e7ff7c5e34827a9a8ddaf15c5e41383f71315654ef09aae47387ab763b9282d5675fc5100c9f15d7510f47bccb8a8150422
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60743c37a415172eb63346d34e263f799e15f7d6e86a0dddd0b951886309ddd3
MD5 19482ad628c37bfdf381680b5da5777b
SHA1 8e54903351573e97aa40947d62fc2d96b96980d2
SHA512 957d941024e8a3bdc101672966e62ee8b414a19802c2457f33b1be6867fb94deb661c7f839fa7fcfe8f86035d63ea81be37c4fd6adf6d39e2114e953c452ff38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48063083ed23d6b2ef08303d039d5bd84d4ecc0b0646f832a5842c1057bb18ee
MD5 b58c06085a78089ab4aca9f53682cb66
SHA1 dca995b0d0f61a841e0dd0dac5f11f8c9c0ccf5b
SHA512 98f057880c2391f01323f2be47e2cf9e96fac035b00bb875d61bf0898b88305d744d2b9e03c7686e9db169b7e1c175b619032fd531ce4bba171cf77125a719ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed84612b9b0fbddbc9634ce33cdbfcc7c900195da5c0ef15a3fa53e332c82b93
MD5 c980b8485e827078a3871b884255af99
SHA1 9d92dc14724f0990a04c887cef49bdfec1e93685
SHA512 80039b4d9b74db53dc5f240d17c45816385118b35040381dc72c28d6d109a222ca1d57258218c83774c2b00f8b4122114f529b9523b8a0b628deaac97da6cb4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0f5886a05c58d0c8c9f44352148d7adcc0c22881bae4a4561ec496d8ad73dd2
MD5 9e443f56a0c4a3b7e6eb47d6015f2561
SHA1 d2afdc658b59268a73e55b97b1e3bb3cd0040819
SHA512 d55ab00dbbb0f3cbe2940b1a95e5699fab8d46499cb896eaaad31600e6970b6ae040d1f979f803b0e30082823bfe1665682e72f97a7655e524989840203f37c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5773cc4775fca99477c431c79396da61a4a55d5f7d47d359999641482c231441
MD5 8f011ad9430699b351559f89da31c5a7
SHA1 87e2de2dadf4216baaca4f0833c79e6d6425ca6d
SHA512 a018a860acbbc46cec96a913e492e1496d2f7c642bacda1be405114ebbdfa583f52807563290c78895c61d48fb13f738dec5d3c43f22c8fe5a99316802640465
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 873493e6686c37f2286c6b36645a012568c8f70219cf3b9cf005d5dc08524b17
MD5 d9d5c21f98278bbf8e6632cd288255ef
SHA1 2d7580536c3e3cf277c114215581a83be7c3f4f2
SHA512 2f88edb76a6367406b8cac7f673560eaac9e111103a8747c8299d062ebb1d1a3ccef1e2a08168ad68b49628c22f1a10868585db1d4483eccbf2cc3acdf68c490
MD5 SHA1 SHA512

Submit Download

svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABBCACCCCCBAABABABBCACBACBBCBAACCCCCABABBACACBACABB.exe
Size 15.0MB
SHA256 f1dd207c9d5987e02125c9d54e9ca9a908f3573d9e4afe3137a87aa24ca565c3
MD5 2d1ce62b3be75304bf0d78087131a499
SHA1 184c6a0af5d8b4c1aa713e7ad19232135d91aec8
SHA512 be10407b31d970bfb59370e2b82a634aa6e7c13c9d3730d73a1ab8bb7b6683107b450b103a4dd8550e89b696f042c93551bce3dde5794bad98ef1ab3ef797e1d
SSDEEP 49152:U+ES+ES+EZohO0+ES+ES+EZJ+ES+ES+Em+ES+ES+ES+Em+ES+ES+ES+EZohO0+Ev:1cccccccGKjKWQckVgtev5mnlNL
TLSH
T186F65C09F98700B1E87751B04DDBD2BF8A30BA2587128DEFE649C76B6933BD16838715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 96b48b24fe03ae5f88bae3b6730b5d095e2f55f255b781f28cc4ac80daa56451
MD5 9fc00dcaf79d2103b14e0d1ef149dd93
SHA1 9636c5b5f6e06be4d6052cafbb38f9e3f5bfdfa6
SHA512 c105275c5eb170914ed4d8621d56274d58ea883aa6514733c3f9bcdc74b4f8acf52532621a1c513ef2bbdb10c44785f57ca7763d9efcc9cb90ef256bbcdc689e
TLSH
T141117191F0D2D853E03164C766299BC749E43BDE9C5C9B647308421C7B55C37DD4A8E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/708-8-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/708-0-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/5128-34-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/5548-64-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/5548-82-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download