44827c627b09a3904487aff79ae0ddd0b0f848a9287d998209c63e3806bb0ce2

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 16.4MB
Sample260908-sgrf9adn3z
SHA256 44827c627b09a3904487aff79ae0ddd0b0f848a9287d998209c63e3806bb0ce2
MD5 8476c3dec19935d27f1a0888ab65241a
SHA1 9ea47b436fa7fad5f3bc3a17be9c937862f4d0e0
SHA512 56f135a4c7991e6832b8f99a94a2837d77d44bfba34cffbae353481ed4422d7fdced9615fb5d7dbe261879ce441af52edc945aad797479525610ee43ffd49fc9
SSDEEP 98304:v5M5M5M5M5M5M5M5KKjKWQckVgtev5mnlNLc:v5M5M5M5M5M5M5M53KWQc0gEYnvLc
TLSH
T1BE077D18FAD30872D57B50B04DD7D2BE4D30BB25832589EFFA8D8B4B6923BD0542A752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
272	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
2344	svchost_CCCBCACCCCABBBBCCCCCACBCCBBCAACABCBBCABBCAAAACACACCABCB.exe
5228	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCBACBAABABCBBACACCACBABBACBBBAACCACCCACBBCCABBAACABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe"	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAAABBBAAABBAAACBCABAACBACCBCCCBCAACBACACACACCBBBAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCACCCCABBBBCCCCCACBCCBBCAACABCBBCABBCAAAACACACCABCB.exe"	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5044	sc.exe
3520	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4804	cmd.exe
4604	cmd.exe
3156	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCACCCCABBBBCCCCCACBCCBBCAACABCBBCABBCAAAACACACCABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
932	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
932	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
932	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
932	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
272	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
272	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
272	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
272	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	272	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 4804	932	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	91
PID 4804 wrote to memory of 3440	4804	cmd.exe	93
PID 272 wrote to memory of 3028	272	svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe	94
PID 932 wrote to memory of 4604	932	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 4604 wrote to memory of 5044	4604	cmd.exe	99
PID 932 wrote to memory of 3156	932	2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	100
PID 3156 wrote to memory of 3520	3156	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_8476c3dec19935d27f1a0888ab65241a_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCAABABACACBBAAACAACCAAACBCBCBBACACAABABCBAACABAAAABBCACCAABCBAABBBCACACBABAABCBBABCCBAACBBCBCBABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCAABABACACBBAAACAACCAAACBCBCBBACACAABABCBAACABAAAABBCACCAABCBAABBBCACACBABAABCBBABCCBAACBBCBCBABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBAABABCABCABABCBCBAAABCAAAABBCACACAACBABCBABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe" start= auto displayName= "UserDataSvc_BCBCBAABABCABCABABCBCBAAABCAAAABBCACACAACBABCBABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBAABABCABCABABCBCBAAABCAAAABBCACACAACBABCBABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe" start= auto displayName= "UserDataSvc_BCBCBAABABCABCABABCBCBAAABCAAAABBCACACAACBABCBABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBAABABCABCABABCBCBAAABCAAAABBCACACAACBABCBABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBAABABCABCABABCBCBAAABCAAAABBCACACAACBABCBABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCACCCCABBBBCCCCCACBCCBBCAACABCBBCABBCAAAACACACCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCACCCCABBBBCCCCCACBCCBBCAACABCBBCABBCAAAACACACCABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
1⤵
- Executes dropped EXE
PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9a5e39ef443f3997fe406607c5d99a9851b434030e37da2a589ecbb1eb02a5d
MD5 95f0ead53cb3ada2225bdc0da9ed8b8a
SHA1 8e9be0b27cbecadc37cbaf6e4ef7332fdbebc3ee
SHA512 835779581da17c25156eba3cceeeee852f4382baa4b89723ec7b844c186936ec2551285a420e892596defd4dffb40dd8a3a88d9cfa1c4989cc993a3290596419
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac08cb53e71e079fd512633af3945ed5e208f0a50a0d3bf83286751b2c1647f7
MD5 1ccd58cbf50e20b1ca904f2a5ac59b23
SHA1 096078062bc91af90a3d8e3fac6d540583d415ad
SHA512 ab4d70f065abe77519f3026a05e8942d9951c4b2f9f51a4366ad22f5ea49b54243ca046861278a0702fe96060d092b15e99d1ef3ee3aaa558ef80bc122268ec1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fad10a95481dc2c9e914a3526853948062a02f77c51310256a16cc370a63019d
MD5 8efb3b5894e646b581497c4ab1e863a1
SHA1 6bfde7a90865e1d459c5d8583a475f6717325b6c
SHA512 5961715f4850f0b8eae77c749c3f6e7fdfdd057a1581fd0ed3f956b0f144911fec7c4b70c80a071921560b369a86e07846d047542184241f085c6362d9372be1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6ea6e926d4af49a9756529fa3c11997111d4d1bb2a569fd9efa14efb0c3284a0
MD5 2dfd43b90c3898e492d6acdddfb49b85
SHA1 9d9da19947b6b8b8e9f7e0706ae86c67ceea6f0b
SHA512 503989b962c4fcdacdd4b28831040ba7ac1ca3d80be66d944c2bf4313b2735f5cb8ca9330fdd5870e1fb25792081e185e729ada84626e6208737118363c4ee6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ff8d1023913dc3a37c850f1cb0d07a4805e965e4a39bfc5084642427e4cd67c1
MD5 075858993edeeec862e0081752dac223
SHA1 5e3941858baf05db7543d77d6154d8d8413a73c7
SHA512 786d254f441829cddd520b64f4e354ef9a3c7249f4752d91288270caf092b758ab32ebea89c831293c3cf834fdcf1e62399a6a3928563df91a50261d8f843138
MD5 SHA1 SHA512

Submit Download

svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBAAACBABAAABBBCABABCACBCABCAABACBABABACAAACBBBBCCBA.exe
Size 16.4MB
SHA256 44827c627b09a3904487aff79ae0ddd0b0f848a9287d998209c63e3806bb0ce2
MD5 8476c3dec19935d27f1a0888ab65241a
SHA1 9ea47b436fa7fad5f3bc3a17be9c937862f4d0e0
SHA512 56f135a4c7991e6832b8f99a94a2837d77d44bfba34cffbae353481ed4422d7fdced9615fb5d7dbe261879ce441af52edc945aad797479525610ee43ffd49fc9
SSDEEP 98304:v5M5M5M5M5M5M5M5KKjKWQckVgtev5mnlNLc:v5M5M5M5M5M5M5M53KWQc0gEYnvLc
TLSH
T1BE077D18FAD30872D57B50B04DD7D2BE4D30BB25832589EFFA8D8B4B6923BD0542A752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/272-24-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/932-0-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/932-8-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/2344-70-0x00000000001E0000-0x0000000000201000-memory.dmp

Download