289d9cab58bca900287f2d6cbc45a43b02fdcd26da1d1691cc6bedf71ce62f30

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 14.2MB
Sample260905-yleada1gnd
SHA256 289d9cab58bca900287f2d6cbc45a43b02fdcd26da1d1691cc6bedf71ce62f30
MD5 022807946faf8993a4a1361757aea3c1
SHA1 1453f4c6e5b80d8ab36ffcddf53c31d17c6ee98e
SHA512 0d65025a35821c3a0666541d84579088d5470d7675bf2475db70ee6d662cb2ccd2136d619c931598185b5ac69de9ce46fb6ea72eade28a7c1a241df97ad23ca6
SSDEEP 49152:U+EZJ+ES+ES+Em+ES+ES+ES+Em+ES+ES+ES+EZohO0+ES+ES+EZJ+ES+ES+Em+Em:FccccccGKjKWQckVgtev5mnlNL
TLSH
T140E65C09F98700B1D87B51B04DDBD2BF8A30BA2587128DEFE649C75B6933BE16838715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3492	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
4040	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
1040	svchost_BCAACBCCCACACACCCBBAABACCABBBCBCAACABCCCBABABABABCCCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACAAAABCBBABCACCCBBBCCCBACBCCACABBBCABBBCBABCCCACAAAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe"	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABAABBABAAACCBACCACAABCCCACACAAABCAACAAACBBACBABCACBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACBCCCACACACCCBBAABACCABBBCBCAACABCCCBABABABABCCCCCB.exe"	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1848	sc.exe
220	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2248	cmd.exe
6096	cmd.exe
3596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACBCCCACACACCCBBAABACCABBBCBCAACABCCCBABABABABCCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5196	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4580	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4580	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4580	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4580	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3492	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
3492	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
3492	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
3492	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3492	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3892	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2248	4580	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	104
PID 2248 wrote to memory of 5196	2248	cmd.exe	106
PID 3492 wrote to memory of 2396	3492	svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe	107
PID 4580 wrote to memory of 6096	4580	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	108
PID 6096 wrote to memory of 1848	6096	cmd.exe	110
PID 4580 wrote to memory of 3596	4580	2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	111
PID 3596 wrote to memory of 220	3596	cmd.exe	113
PID 2396 wrote to memory of 4688	2396	notepad.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_022807946faf8993a4a1361757aea3c1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCAAACCABACAAAAAAABBCBACABBCAAACAACAABBBBCABCCAACBAACABCCCBBABBBBAACCBBABABBACACACABCAAABCCBBCCACACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCAAACCABACAAAAAAABBCBACABBCAAACAACAABBBBCABCCAACBAACABCCCBBABBBBAACCBBABABBACACACABCAAABCCBBCCACACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACACBBBBABACACAACCBBCCCCACABBBBCCCCCAABCABCBBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe" start= auto displayName= "UserDataSvc_ACACACBBBBABACACAACCBBCCCCACABBBBCCCCCAABCABCBBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACACBBBBABACACAACCBBCCCCACABBBBCCCCCAABCABCBBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe" start= auto displayName= "UserDataSvc_ACACACBBBBABACACAACCBBCCCCACABBBBCCCCCAABCABCBBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACACBBBBABACACAACCBBCCCCACABBBBCCCCCAABCABCBBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACACBBBBABACACAACCBBCCCCACABBBBCCCCCAABCABCBBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
1⤵
- Executes dropped EXE
PID:4040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCCACACACCCBBAABACCABBBCBCAACABCCCBABABABABCCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCCACACACCCBBAABACCABBBCBCAACABCCCBABABABABCCCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9fc6b7f30261c56599065b6517d52aad622b281063a6f2240fa99fbb043e023a
MD5 bf4b164e8f4b429885ded588fb5ee781
SHA1 b6e6655c1390147336202ee179ced15794c1f698
SHA512 0209958f5a06b112eebfb0c9cff2f71a47771bbb6441d20f6a678df647f68810aba48c4bfbbf90685d604d9073d9a89506c9c51b6e89cff38d8a3065ccffd358
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0e3f0bff9bb4a9c2f57a77d0b582836a99b6db62c3b2a2a6e81cb7ca8578cef
MD5 57219ca17cd8d8b4e00a8bb416f363a6
SHA1 8d25b07ec09df762b31e4c54ff9a024c7218e9ee
SHA512 42140b9bb7112f242c02e4b08a1f52c4b415da8cf944afd95c179b5e700472e358bb029768479d03f59bfe4f0e6bf827a1d51754c774902b30388e5ddbd68fc2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8e42877da672a1a6b2ae6f6cea1719d6cf0576edf472ef934f5c824eb6e712b4
MD5 ab8198c0361fca23b97c96dd443228c1
SHA1 fea383309063a215ab963a3a7d89a091c3ac26e5
SHA512 b844c123ebcabcf2959fac0fb96c434e746d994693f12f98a68d757bb47dfc69fd311b4a8dc9d349d8d0ff526a15a9eb255234fe81b12b9153bdeda9966ccc63
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0e6e16b49f8431d9f5af3ddf806faa73a02107081241536b883a6adec4e43c44
MD5 3e2fbfde647848dc17a3901b3b299b49
SHA1 235c8dbb839cb5671193fac25736916fed1c288a
SHA512 e970cb480c486fad87f27e6d9f35bc4b7922690ff2c4e2974ce8f3aead325af17fdf88f6a76473ccbf57a6876cb008db3160296f4997a7d3aeb67d8290561949
MD5 SHA1 SHA512

Submit Download

svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACCBCCBCBBBCACCAAABABACBCBAABCBCCBABABBBABBACAABCAA.exe
Size 14.2MB
SHA256 289d9cab58bca900287f2d6cbc45a43b02fdcd26da1d1691cc6bedf71ce62f30
MD5 022807946faf8993a4a1361757aea3c1
SHA1 1453f4c6e5b80d8ab36ffcddf53c31d17c6ee98e
SHA512 0d65025a35821c3a0666541d84579088d5470d7675bf2475db70ee6d662cb2ccd2136d619c931598185b5ac69de9ce46fb6ea72eade28a7c1a241df97ad23ca6
SSDEEP 49152:U+EZJ+ES+ES+Em+ES+ES+ES+Em+ES+ES+ES+EZohO0+ES+ES+EZJ+ES+ES+Em+Em:FccccccGKjKWQckVgtev5mnlNL
TLSH
T140E65C09F98700B1D87B51B04DDBD2BF8A30BA2587128DEFE649C75B6933BE16838715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2396-67-0x0000000003130000-0x0000000003131000-memory.dmp

Download

memory/3492-27-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/3492-40-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/4580-0-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download

memory/4580-8-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download