f9c31c95d24d392990db0f2af656d30650a2b2f21590276a7458d5918ca639b0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 16.7MB
Sample260910-df2hhadp81
SHA256 f9c31c95d24d392990db0f2af656d30650a2b2f21590276a7458d5918ca639b0
MD5 c14b85175373d055b2e2bd0399802f29
SHA1 14336f28ad9d7e1d25d5ffd5ad5f40dbda2b8d6e
SHA512 f2827821dc0304756ffb7e8f774b67424db5c3f5107b59aeb1035f7d28eac3817533af811fab38c26d028346b21a1444e803272b429d603bcb520c074f346484
SSDEEP 393216:FO4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4H:Uhasshasshasshasshasshasshasshay
TLSH
T14207193CADE841A6D472C671C9A2A5DDEA31B8127B005ECF21D2534E4D3BBD26D70E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3308	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
2712	svchost_BCCABCBCAABBCCAACAACAABCBBABCBAACBAACBCCACBCCBABAACCAAC.exe
4280	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCABCCACACAACBCAACABAAACCCBCBBCBCCBBCABCCBBABCCAAACBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe"	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBCBABAABCBACCBBACACCBACACAACCBACABCCCCAACBBAAAACABCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABCBCAABBCCAACAACAABCBBABCBAACBAACBCCACBCCBABAACCAAC.exe"	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3124	sc.exe
3496	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4048	cmd.exe
4216	cmd.exe
3916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABCBCAABBCCAACAACAABCBBABCBAACBAACBCCACBCCBABAACCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3668	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3668	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3668	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3668	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3308	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
3308	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
3308	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
3308	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
2712	svchost_BCCABCBCAABBCCAACAACAABCBBABCBAACBAACBCCACBCCBABAACCAAC.exe
2712	svchost_BCCABCBCAABBCCAACAACAABCBBABCBAACBAACBCCACBCCBABAACCAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3308	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
Token: SeDebugPrivilege	2712	svchost_BCCABCBCAABBCCAACAACAABCBBABCBAACBAACBCCACBCCBABAACCAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4404	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4048	3668	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	105
PID 4048 wrote to memory of 5116	4048	cmd.exe	107
PID 3308 wrote to memory of 3188	3308	svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe	108
PID 3188 wrote to memory of 396	3188	notepad.exe	109
PID 3668 wrote to memory of 4216	3668	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	113
PID 4216 wrote to memory of 3496	4216	cmd.exe	115
PID 3668 wrote to memory of 3916	3668	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	116
PID 3916 wrote to memory of 3124	3916	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBABBCCBCBAAACBAABABCBCAACBACBCBACBBBBCCBAACBACCBCCABBCACCCABABBCACACABAAAACBCBABCBAAAABAAABAAAAACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBABBCCBCBAAACBAABABCBCAACBACBCBACBBBBCCBAACBACCBCCABBCACCCABABBCACACABAAAACBCBABCBAAAABAAABAAAAACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBBBBBCCACAAABABCCCCAACBBAACBABAACBBABBBABACCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe" start= auto displayName= "UserDataSvc_CBACBBBBBCCACAAABABCCCCAACBBAACBABAACBBABBBABACCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBBBBBCCACAAABABCCCCAACBBAACBABAACBBABBBABACCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe" start= auto displayName= "UserDataSvc_CBACBBBBBCCACAAABABCCCCAACBBAACBABAACBBABBBABACCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBBBBBCCACAAABABCCCCAACBBAACBABAACBBABBBABACCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACBBBBBCCACAAABABCCCCAACBBAACBABAACBBABBBABACCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCBCAABBCCAACAACAABCBBABCBAACBAACBCCACBCCBABAACCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCBCAABBCCAACAACAABCBBABCBAACBAACBCCACBCCBABAACCAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
1⤵
- Executes dropped EXE
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18c45c71a1f64418fe9f30e112455f182bf3e3c6b8862d58ded1793d2260cdc5
MD5 89c21bd4ccdfecbb1b1ac97f785c7776
SHA1 825f381cf2cfbfbd2bb092516610cff460f3049c
SHA512 baeb658386eba2c0ad1d357d433f58f314287d619ac432c3a4541edd74d700c8e79c16e0fdf10d9d8acb616828aae904253a3f198acabdf67bc11002a2cfb965
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31a2798cd9cee2985230d72ea1fd4f55a4d1d567861555d67ea0f36002906022
MD5 79529757254073f4307ed2050eb09f9e
SHA1 dca03ca1be7a9a7c08a186f2f5203b37d4f96617
SHA512 0627c249ba8a942c660a9b8feb495f7cd88a72470c937a26f2a981692b64b33de81d418e2ad4f15caaf9dcb74368468663e74a33755b4feecb0dd07830177b8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ee0734355d57e34f411725c2eba895929e536f257163dbbf00c3692dd3c72bcd
MD5 f71f3c06d3de8790f3a5b147a1ed2e7e
SHA1 245775450945db2e3e32c065e13197bb92648a7b
SHA512 22fde68a1b1f51a795d396380207112cd4dc87cc0151ddd08a9c26d5b7e8e9cbf3bca4b98cea871ad6ef0e8d2a20926c9187facee0f7719fee5b89a0c9ce1105
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99da93fb0b527ea7b87c3d227dca6c11ba60fd3ee5164dc2c491bb7fc3c05f1c
MD5 420eea0a78fa4bd2fc4e43cb57d35e15
SHA1 23966bf94a7a37e9779c2beafec03df4a8510712
SHA512 1c0f40ce8d898806e506845051ca964ba15bf8cef6bfaf32189b408c21440827e31595281bec8e2708cf0dc06c6b41b60aad47266e734d97776a3374428e39f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab4e67183b8a363f4c02ff56583af4a580c2f28f1d640aea9bba4a217681a50e
MD5 1e936ba6fbd22e2f9518cb17878a46ed
SHA1 2335e69e3a193f4b654ccbe2252933dcfd4de85c
SHA512 920a386a8a09dba3c6cb824c962f1e3ae55da6a32ac335a0b49e21aef3b4fa73d9c82f3177a1410c12edb99b4f12c2bf962dfa59af9dce4c9b36a44534c1898b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 78de0e36dce14f0cc5d32edefaabca0af3893da1f02952d8e01057900d72cb54
MD5 28a5fa7d7658ef7e434924abd27ff59f
SHA1 7e51400fa5ddb315fb73e4783be45f049cc8ab4c
SHA512 ccccf90c59dd0da22febaa9248360b9460962f1cc105a7580559998581473d2fee3a6e158183886d3011a7fdd5cba2fef74f940dc2095aea85abf995ff9c24ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8054ae4b491f23687e747094e951c39f63a9d2798e7a63b69e75a898181e97ba
MD5 b5febcdf73284cb8cf1e2565bb25ae75
SHA1 3c8d161efcd787edd5f3b095d30cd5cabc1e2382
SHA512 1e3fa2ffc50f02c82ab7fea63dae1d30dc755298890fb02b212056831e5496293f11a8bf14b03d35e85c60855448e213109ee0e14db0440d0e530af00ce46421
MD5 SHA1 SHA512

Submit Download

svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABAABCCAABCAABCABBCBABBBACAABCCCAABBBBBCAABABACCA.exe
Size 16.7MB
SHA256 f9c31c95d24d392990db0f2af656d30650a2b2f21590276a7458d5918ca639b0
MD5 c14b85175373d055b2e2bd0399802f29
SHA1 14336f28ad9d7e1d25d5ffd5ad5f40dbda2b8d6e
SHA512 f2827821dc0304756ffb7e8f774b67424db5c3f5107b59aeb1035f7d28eac3817533af811fab38c26d028346b21a1444e803272b429d603bcb520c074f346484
SSDEEP 393216:FO4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4H:Uhasshasshasshasshasshasshasshay
TLSH
T14207193CADE841A6D472C671C9A2A5DDEA31B8127B005ECF21D2534E4D3BBD26D70E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0e6ebb8cf5e2fc56f85dcb704f8ac7ab7fad626c0586e1a4479065a04349de52
MD5 8404adeb98dd63b6256983abee983770
SHA1 7494efaf04e66923b8b4aed6c2e738c0803bca6a
SHA512 879dd3483b86c438e561514518333d5dd3d79a2482eb142f379c3c65c5feae53fd636ff6e299916dee501d36110363a933d156461cbaa0306cd051c14529823d
TLSH
T13011D371B075D4A3F0326893661AEB8B08E8B3CFBC98AF241305860CEE59C34CD158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2712-87-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/3188-60-0x0000000002830000-0x0000000002831000-memory.dmp

Download

memory/3308-37-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/3668-8-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/3668-0-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download