1dab8372657009409df6778afda267ae929d2984d5dcb8b66d2a2c00ff2a7547

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Size 39.4MB
Sample260906-2kl6dade89
SHA256 1dab8372657009409df6778afda267ae929d2984d5dcb8b66d2a2c00ff2a7547
MD5 90d44ce63eb40aedbcda9ec654eefe00
SHA1 d5b09ad93f9af8791a5e875cef7d67a478f7e1c2
SHA512 d9d5f6ada487dd25d93846ba32588aba0b3c8a8f00117549eec525666c82a75aace53dc9f1572cc72ffbf11250b0377b371284fb53a7dfada0be6fdd7dc70fda
SSDEEP 98304:RK7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7Vf:PKWQc0gEYnvLfjW
TLSH
T1AF972A09F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933B916428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2460	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
2916	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
5004	svchost_AABCBBCCAACCACACCACCCCBBAABCAAAABBACAABBABCABAABBCBACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCBAACBBBCCABCBCABCBAACCCABCCBCAAAACCBABCACAABABBCACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe"	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACABABBABCACAAACACBACCBCAABBAABCCBBCBBACBBBBBBACBBBBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCBBCCAACCACACCACCCCBBAABCAAAABBACAABBABCABAABBCBACAB.exe"	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
392	sc.exe
3468	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5192	cmd.exe
640	cmd.exe
1460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCBBCCAACCACACCACCCCBBAABCAAAABBACAABBABCABAABBCBACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2984	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
2984	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
2984	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
2984	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
2460	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
2460	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
2460	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
2460	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
5004	svchost_AABCBBCCAACCACACCACCCCBBAABCAAAABBACAABBABCABAABBCBACAB.exe
5004	svchost_AABCBBCCAACCACACCACCCCBBAABCAAAABBACAABBABCABAABBCBACAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Token: SeDebugPrivilege	2460	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
Token: SeDebugPrivilege	5004	svchost_AABCBBCCAACCACACCACCCCBBAABCAAAABBACAABBABCABAABBCBACAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
768	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 5192	2984	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	100
PID 5192 wrote to memory of 3684	5192	cmd.exe	102
PID 2460 wrote to memory of 4644	2460	svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe	103
PID 2984 wrote to memory of 640	2984	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	104
PID 640 wrote to memory of 392	640	cmd.exe	106
PID 2984 wrote to memory of 1460	2984	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	107
PID 1460 wrote to memory of 3468	1460	cmd.exe	109
PID 4644 wrote to memory of 2548	4644	notepad.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCABCACCACBCCBACBCCBCCBBBBBABBCAABCBACCAABBBBABCBAACCCACBCBCBCCAABACCBBCACBCBAABAAABCACAAAAAAABCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCABCACCACBCCBACBCCBCCBBBBBABBCAABCBACCAABBBBABCBAACCCACBCBCBCCAABACCBBCACBCBAABAAABCACAAAAAAABCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBABACBBACABBCACACACBBBBABABACAAABAABBAACCAAAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe" start= auto displayName= "UserDataSvc_BCCBABACBBACABBCACACACBBBBABABACAAABAABBAACCAAAABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBABACBBACABBCACACACBBBBABABACAAABAABBAACCAAAABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe" start= auto displayName= "UserDataSvc_BCCBABACBBACABBCACACACBBBBABABACAAABAABBAACCAAAABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBABACBBACABBCACACACBBBBABABACAAABAABBAACCAAAABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBABACBBACABBCACACACBBBBABABACAAABAABBAACCAAAABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
1⤵
- Executes dropped EXE
PID:2916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBCCAACCACACCACCCCBBAABCAAAABBACAABBABCABAABBCBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBCCAACCACACCACCCCBBAABCAAAABBACAABBABCABAABBCBACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d196ad1419085a8ded021ee56d49c7db40bbf85b1d38129acc955e5414363500
MD5 d332ba90df54737766154c449e5f3429
SHA1 250f57bbd690e1ebf2fcdac8c95139e355f40f5a
SHA512 afe17a83a74ee293eea30bfbd18924d6c3ebf9503bf795d07c85d423b182a92ffd50613cc6f37bc6f652185983a213839b1d8c92d2ee6c63ef09d2339cfcf8c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d24575d787553b439d059600f4b1b63f40ac34b17c647e18f679032cf8b94bed
MD5 4d593e1f563450de775f139708d64625
SHA1 86ad3566335e5f1431380a1d57842f9a02efc811
SHA512 e50b006e3effbd2d8d6be7211e20523432732144a630c03b3659a259ae7d7836be9abd8b0a19c881e3feb13d0da682960810a6fbc9c1e5b5d8ebd2e0ba853996
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23ca44e987b51c3a9c3b62d671cfb119894e2c63a120396fbb570f0dfe754756
MD5 d7dd2f9975d5ace2b714e7830bc50501
SHA1 2d2d1c2525512f5f044a1edb4177c08e9a43180d
SHA512 f6597412f98d2c09d455fb86db1765ea199a21ce65b8dcfe7b5a4b7a7638573f895c2802988036e2852c13158b59bf0be64555d1bf4ea2612ca50d9cd94c99ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e24d2bf8da8ecc9e1648d10ca03b796a93db0390355fe092d7514bfa07b5bd6
MD5 f437bd779f46ef81728d3943e4226102
SHA1 5064f3be129b18d0df9d426fa98b18d6a23da91c
SHA512 42f72ab11a8c48d9a02f782c73463489f5f06b4b9c47051f879efdeb64af016b299553e26de01dcb15c6b0b400e2fe45b5f8a00afe2cec61300966c057c80f30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb274091013ee6e65182cc8224ec5be44a1faf826f9bfb7a77a1bea4ebd76895
MD5 ccd9694e00a2be3581a0a08575b280b2
SHA1 fab19927fb30a2c6d7ff921723f4df00dca77910
SHA512 6823840d6bd825c04ce493449bc948882ba8819521c290cc972b18a7d7e2b7f0f04cc8fe7748c006c79d849bf657a07e0924f9fa4a9aa2d51fa8435b3e576388
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 39a6aba2b0179408ac8cd419518c1ed357dac9d1de657baaff992f8b1cc1c30e
MD5 baa9e4dc6d8ec446fefd635ed0b7964a
SHA1 0156819245bdadb35a93ce638dae48ac93743be5
SHA512 2b56ac789c336b155bdbbc60abf924001e251413d7018f84e60f8ba2f5de061188173ebc4edbc6165ab3064661993b60f2685158447c2701ac163de63e22ea2f
MD5 SHA1 SHA512

Submit Download

svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABACACBABBBBBCAACCBBBCBACBCCBBCBCCABCACCCABAACBCBBA.exe
Size 39.4MB
SHA256 1dab8372657009409df6778afda267ae929d2984d5dcb8b66d2a2c00ff2a7547
MD5 90d44ce63eb40aedbcda9ec654eefe00
SHA1 d5b09ad93f9af8791a5e875cef7d67a478f7e1c2
SHA512 d9d5f6ada487dd25d93846ba32588aba0b3c8a8f00117549eec525666c82a75aace53dc9f1572cc72ffbf11250b0377b371284fb53a7dfada0be6fdd7dc70fda
SSDEEP 98304:RK7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7Vf:PKWQc0gEYnvLfjW
TLSH
T1AF972A09F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933B916428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 03f57cf50fb9e2b1dd9a96a8d5b12474a6ac6ea07030faa41eae8c9145c8d01f
MD5 ff310db809bcc9ea74f53cfa97e43993
SHA1 006943f341cc96fd8a7c677f3d6d0e6219aea71e
SHA512 de558fd99187882199043377df0369cbd2a6ee0ef2218bdf6899558d05f88719cc30e7ef3dbd6becdc5359162b28da019504cbbf8a604a7c7cdb7d4525f178e9
TLSH
T1EF110B11F0F59C53F031788B4229DF8B1CE53B8BEC5C9F786359820AAB4587DCE190A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2460-25-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/2460-38-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/2916-74-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/2984-6-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4644-66-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/5004-80-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download