5f55aa464de551651249f409dadac58aeef316fbf81fc0b5c767d4b9febb2325

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 12.5MB
Sample260910-eqhntaxbmg
SHA256 5f55aa464de551651249f409dadac58aeef316fbf81fc0b5c767d4b9febb2325
MD5 903d3c1b254c4ff922df38248f0e39db
SHA1 dd57393d600ba4d2b04cd3cf8944a024036c12bf
SHA512 3b46ea80184197d420a0c6cf87f296441a9a8942dc1e6a371d9a9e8f9b3f63b1afceaed4ccc29eba30562d2b5bf2b938b29fa56ca23943121734a11420230694
SSDEEP 49152:U+ES+E7+ES+ES+E7+ES+E6+ED+ES+E7+ES+ES+E7+ES+Ej+ES+E7+ES+ES+E7+EK:MKjKWQckVgtev5mnlNLj
TLSH
T161D64B09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4ECB5B6923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3904	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
4408	svchost_CAACCABCCBACCBBAAAABCCCCBAAAACCACBACAACABAABABCAAACCBBA.exe
3704	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCBBABACBABCCAAAABBCABBAACABBBBBCAABBABCBABCBBCCABCAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe"	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBACBACBBBBCCCBCCAACBBBAACABCBABAABAACCBAAAACBCBACABCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACCABCCBACCBBAAAABCCCCBAAAACCACBACAACABAABABCAAACCBBA.exe"	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
384	sc.exe
1876	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5048	cmd.exe
3740	cmd.exe
5052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACCABCCBACCBBAAAABCCCCBAAAACCACBACAACABAABABCAAACCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1100	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1100	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1100	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1100	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3904	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
3904	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
3904	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
3904	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
4408	svchost_CAACCABCCBACCBBAAAABCCCCBAAAACCACBACAACABAABABCAAACCBBA.exe
4408	svchost_CAACCABCCBACCBBAAAABCCCCBAAAACCACBACAACABAABABCAAACCBBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3904	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
Token: SeDebugPrivilege	4408	svchost_CAACCABCCBACCBBAAAABCCCCBAAAACCACBACAACABAABABCAAACCBBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4304	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 5048	1100	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 5048 wrote to memory of 4964	5048	cmd.exe	103
PID 3904 wrote to memory of 556	3904	svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe	104
PID 556 wrote to memory of 3756	556	notepad.exe	105
PID 1100 wrote to memory of 3740	1100	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	109
PID 3740 wrote to memory of 384	3740	cmd.exe	111
PID 1100 wrote to memory of 5052	1100	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	112
PID 5052 wrote to memory of 1876	5052	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCAABCBACBBBCABBBCCBCBABBAABAABACCABBABBBBCAAAACCCBAABBAACBBBCCBCCCCACAACCCBABACABABABAABABBBBBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCAABCBACBBBCABBBCCBCBABBAABAABACCABBABBBBCAAAACCCBAABBAACBBBCCBCCCCACAACCCBABACABABABAABABBBBBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACCCBBCAACABBBABCACBACCAAAABCBBCAABCCCCBABCAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe" start= auto displayName= "UserDataSvc_BBCACCCBBCAACABBBABCACBACCAAAABCBBCAABCCCCBABCAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCACCCBBCAACABBBABCACBACCAAAABCBBCAABCCCCBABCAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe" start= auto displayName= "UserDataSvc_BBCACCCBBCAACABBBABCACBACCAAAABCBBCAABCCCCBABCAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACCCBBCAACABBBABCACBACCAAAABCBBCAABCCCCBABCAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCACCCBBCAACABBBABCACBACCAAAABCBBCAABCCCCBABCAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCCBACCBBAAAABCCCCBAAAACCACBACAACABAABABCAAACCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCCBACCBBAAAABCCCCBAAAACCACBACAACABAABABCAAACCBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
1⤵
- Executes dropped EXE
PID:3704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f7b1f494097391665aca41a11b5e096c3f308e4e16604cb5901364d3b77c66c1
MD5 419441065cffabe0bc5af759ce8f53e9
SHA1 e32a2ceadbb0fa1452004840466628323fe7a224
SHA512 624a210dda0843abf023f9b66919f387ff4c648d9c0d56cef67655b4dd4f3cf74e40bed82fedf6596385b9f10af9694d6ff42c6f7b06f6ec26824e78236ce032
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f406e7063de16e37b1e9408fcf07f01755da385a9239dc562f8316319931948
MD5 8f20daef0e30986fbf1792d2d2990ab4
SHA1 ba7f78f55acca62219e0ae164e3697bf9a12a6c9
SHA512 af662a6d9ca071729eaa3a16e4000db23653244c1d0a023a763f692cdb7506c313217ff5705442102604a24e6307aa268156a11de796ce647727b333587a7dd9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07694d9c3c32f707f4f581c4b54d32570f1b2e51e5954eb8329bc12ed2fce9eb
MD5 beff1056c99ee5ed8f111974d1eb5575
SHA1 438311aa11aceeb422c277367d99b1dbea5f6f12
SHA512 d94f9e45e8ed540a9d2a3939c55a84b01551fb3005c4ce006f99fd4eca1e0845e1ecd561ebc8b0e5af81138ddbd87f150d743be9c7e9a70dcd0a91bb4f6ea761
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8bbf082a41e1481d1ae738af585c872881434d43ffff56d066af7cbd891a318c
MD5 79c7b2101e5ffffcf48fa5789b79caf1
SHA1 812c21525200aa1e1ee3bb16294a35f72001990c
SHA512 528b644aed20fad6d9f9698a22fd652cb8aa3f2975d027626c07610890f6311e289236fd431272e78fd4480dce0da9f60c854fb99900c5dba35a833aa0f3475f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1128cf928994ac5ed4bae7b0bb9c3c423400bf1e0d4ca7b87db09856f3cc8773
MD5 3b1dbaeba61aa479657e4614f9194406
SHA1 8145530f62a5fa579a5e0923501385feeddc23a6
SHA512 2d6742d776a434ed12083aa92bb41dcc7d38bea45d1ef6581f0d0c9365f7592578df2572f21d7647749be99218d84f7a1e40f8c959b0f3e73c36f60f4e28fa79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2a063b868e8bf5c8207addf4622328d39477a959d709c25fd439d6978fe0f70f
MD5 e6555b6945d4317dbae8e4b78bf80ae2
SHA1 89ba473da2771c22e86777ef65b89367d389e06b
SHA512 00ff82b6345d44d0b26809483b0f026af6266064f9910766f84d10b2f485096e4890aad0dc7992561755f39df933c90f60bf42cf7bcbd194e62568bd3f5e28ac
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCABAABBCACAABCBCACBBACCCBABABABACCBCAACCBAAAABCAACB.exe
Size 12.5MB
SHA256 5f55aa464de551651249f409dadac58aeef316fbf81fc0b5c767d4b9febb2325
MD5 903d3c1b254c4ff922df38248f0e39db
SHA1 dd57393d600ba4d2b04cd3cf8944a024036c12bf
SHA512 3b46ea80184197d420a0c6cf87f296441a9a8942dc1e6a371d9a9e8f9b3f63b1afceaed4ccc29eba30562d2b5bf2b938b29fa56ca23943121734a11420230694
SSDEEP 49152:U+ES+E7+ES+ES+E7+ES+E6+ED+ES+E7+ES+ES+E7+ES+Ej+ES+E7+ES+ES+E7+EK:MKjKWQckVgtev5mnlNLj
TLSH
T161D64B09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4ECB5B6923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 2117c31ff77312e40a632d17d381833e4c63355fd4c0031c8a68fa2a9ab5665d
MD5 51f6277aaeabcb4b63cdba1a16145795
SHA1 246c48bf523cbc4fe701e793eba63fce06344cc6
SHA512 00345e4b50b7c4009ed20451b0f7470831bd20871662eede1dc83c7e4b273ebbfe9583b643575a4b80a72187bee9a39a73c189f311aa9757f4d37a83ef72a03f
TLSH
T186110420A869D823F2322CC78139AB5B0DB0738FBCACAB5423484108AB14D39CF554E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-59-0x0000000002D10000-0x0000000002D11000-memory.dmp

Download

memory/1100-0-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/1100-8-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/3904-37-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/3904-27-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/4408-78-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download