5dac9f305108984bc79f09226dd18f1a66acff76649ad9210eff39590ad6fb71

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 18.4MB
Sample260907-wqmq7sseqc
SHA256 5dac9f305108984bc79f09226dd18f1a66acff76649ad9210eff39590ad6fb71
MD5 705e4402a70c749f87baf5665c2f129e
SHA1 c826fae86543d9d913b0052565bfd31c38ac10df
SHA512 92d52af6c5d13d50e1cb53c67b20b6fe1864b6ff1d336bbcacd14687ec0f61092f31010470afcd42f5392f9b76d3797c5f2ee4958e2b51aaf38e6e46f57286d2
SSDEEP 98304:JKjKWQckVgtev5mnlNLRKjKWQckVgtev5mnlNL4:WKWQc0gEYnvL+KWQc0gEYnvL4
TLSH
T1C1175D09F98704B1D87B51B04CDBD3BF8A70BA2187228EEBE649C71B6933BE15834755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
776	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
4696	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
5032	svchost_CCCBABBBCACCBCBCBABBBACBAAABABBAAAABACACBBACCCCAACACABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBCBACBAAACCBABACBCCBBACCCBCACACCCAAAABAAACBCBCCBCBAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe"	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABBBBCCCBACAACBAACCAABACAACBBCCCABBBACACBAABBACCCABAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBABBBCACCBCBCBABBBACBAAABABBAAAABACACBBACCCCAACACABA.exe"	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4448	sc.exe
5024	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
916	cmd.exe
4300	cmd.exe
4500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBABBBCACCBCBCBABBBACBAAABABBAAAABACACBBACCCCAACACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2340	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2340	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2340	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2340	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
776	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
776	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
776	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
776	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	776	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3928	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4300	2340	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	109
PID 4300 wrote to memory of 816	4300	cmd.exe	111
PID 2340 wrote to memory of 4500	2340	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	114
PID 4500 wrote to memory of 4448	4500	cmd.exe	116
PID 2340 wrote to memory of 916	2340	2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	117
PID 916 wrote to memory of 5024	916	cmd.exe	119
PID 776 wrote to memory of 1244	776	svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe	121
PID 1244 wrote to memory of 868	1244	notepad.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_705e4402a70c749f87baf5665c2f129e_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBCCCABCBBCBCBACCBBAABCCBBBBCCABCAAAABCBBBCBBCAAACCCCACABAABBCABABCCBCCABBCCCBABAACAABCBACCABBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBCCCABCBBCBCBACCBBAABCCBBBBCCABCAAAABCBBBCBBCAAACCCCACABAABBCABABCCBCCABBCCCBABAACAABCBACCABBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAABBACAABCBBCBBABCCAAABBACACACABBCABCBCBBBAACABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe" start= auto displayName= "UserDataSvc_BCAABBACAABCBBCBBABCCAAABBACACACABBCABCBCBBBAACABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAABBACAABCBBCBBABCCAAABBACACACABBCABCBCBBBAACABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe" start= auto displayName= "UserDataSvc_BCAABBACAABCBBCBBABCCAAABBACACACABBCABCBCBBBAACABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAABBACAABCBBCBBABCCAAABBACACACABBCABCBCBBBAACABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAABBACAABCBBCBBABCCAAABBACACACABBCABCBCBBBAACABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCACCBCBCBABBBACBAAABABBAAAABACACBBACCCCAACACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBBCACCBCBCBABBBACBAAABABBAAAABACACBBACCCCAACACABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cdeac1d9aa14cb76c377cf97a1c897655686ebb2e1111e25adcd0c6bfbe79549
MD5 71ea4fc5106ad826cbf82cfd583db6a0
SHA1 fa79d39cc79528599cb19777a74c56f9c89e27cd
SHA512 3804352228307635f85fe825d8051c0b1f63360940d38ee68ae01c74f938f306cd6fb0ef567195cdcfdc6ae9d47ef644715eac77e89320c21d1b65267ea6292f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c58126b1c00af9b08b99bba299bd0837c95ad54a1bbb0d99d7fc42fedbf5a31a
MD5 7fd2b9f01f232dbbe8ec8534d7ab4264
SHA1 29d7c10ab39af0be5ca3c0e236240d63b6cf94d5
SHA512 8f0fdce7e4e514efce165a0595e4b6afc68564510111afbf86af9882590bac4be041d91944037ab2183f5361aa74353d26e78580aab02ae65b86e0152f3647ef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1539363ac14bc72f9784584404d6ec5b00a4cf3ae5b25b85c79f4cc2aa82915a
MD5 679272bef76a6e99557633ab15bf7433
SHA1 a3e226809151cf0f0f6409408cb98ac1bec71592
SHA512 77a01c32ec5b0b1a0937fd6a29626a9fad04f82f47d2632340138ca302e98cfc1727bf2015b768c7904449c87135db6429ad5a4c47ae6de83f3680a65b204d14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d954f547e3f34ed7cfdcd132f6101d649a352d91acda285a2e53bc14454be517
MD5 37d422929324e8c9aac9d36e82c4d406
SHA1 d9bfb08eef79edfa9175df6b6aac09d96c13ec99
SHA512 4fe8492a3f6c4b80135de782b9a0acf063ff3e50dcb2688fceda58c75c390000e9ff08c2008ed8dcc281339713124849372bbeea74f957ae13bb99c5fc8c3bda
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7761724bdcc20f4bdc03c33230d91ef7a3e23a6562a1f9d91b1969e8317c1414
MD5 ad6da07271c49b9427aa6e2c9c966acb
SHA1 641f38d8e8f74843deac17d9419f318117d36684
SHA512 86fb4697111a48f3de5062dbce20fe055dfd8c4721b198d64128e0f41671d4f6f1641db66fd8697989e990f7668c0cf16685fb5ad7bd927abb50171edcf643dd
MD5 SHA1 SHA512

Submit Download

svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACAACABCBCBBBBCBBCCAACCBCBCAACCCCABBCCBCABBBCBCCAA.exe
Size 18.4MB
SHA256 5dac9f305108984bc79f09226dd18f1a66acff76649ad9210eff39590ad6fb71
MD5 705e4402a70c749f87baf5665c2f129e
SHA1 c826fae86543d9d913b0052565bfd31c38ac10df
SHA512 92d52af6c5d13d50e1cb53c67b20b6fe1864b6ff1d336bbcacd14687ec0f61092f31010470afcd42f5392f9b76d3797c5f2ee4958e2b51aaf38e6e46f57286d2
SSDEEP 98304:JKjKWQckVgtev5mnlNLRKjKWQckVgtev5mnlNL4:WKWQc0gEYnvL+KWQc0gEYnvL4
TLSH
T1C1175D09F98704B1D87B51B04CDBD3BF8A70BA2187228EEBE649C71B6933BE15834755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/776-25-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/776-38-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/1244-67-0x0000000005450000-0x0000000005451000-memory.dmp

Download

memory/2340-6-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/4696-73-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/5032-80-0x0000000000780000-0x00000000007A1000-memory.dmp

Download