6b860eda31372691a43315c7dd4bb54544b422aea4de179426cfc0f16561f402

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 05:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 12.8MB
Sample260910-fy2mbs1we1
SHA256 6b860eda31372691a43315c7dd4bb54544b422aea4de179426cfc0f16561f402
MD5 6348e03c99f167b073a4a6ccad45e3e4
SHA1 5c42892d78091546394c799e26e837f2817913c1
SHA512 e398ba403d1fbb45a5fca6c2b453c728d990e88feee32ba03efc102b950377753ab473d7d8e6e8d4448711f84bbb10704522153b697af6122bb0440bab1b8ada
SSDEEP 49152:U+ES+ESdx+EST+ES+ESdx+EST+ES+ESdx+EST+ES+ESdm+ES+ESdx+EST+ES+ESP:zKjKWQckVgtev5mnlNLq
TLSH
T14CD62B09F98340B1DD2B50F04DCFE3BF8A60BB25C6128DF7F74D8B5BA522BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2556	svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
1764	svchost_CAABCAACCACCBBABCBBABACAABAAACBACCBAAAACBCBCACBAACBCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAACABCCCABABCCBCBBCABCCCAABAABAABBABBABACACCAABABCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe"	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCBABAABBABBCCCABABAACBBCABACBBCACCCBCCCBABCACBABCABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCAACCACCBBABCBBABACAABAAACBACCBAAAACBCBCACBAACBCCCB.exe"	svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5740	sc.exe
6024	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5480	cmd.exe
2880	cmd.exe
2280	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCAACCACCBBABCBBABACAABAAACBACCBAAAACBCBCACBAACBCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
552	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
552	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
552	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
552	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2556	svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
2556	svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
2556	svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
2556	svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2556	svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 5480	552	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 5480 wrote to memory of 704	5480	cmd.exe	94
PID 2556 wrote to memory of 4992	2556	svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe	95
PID 552 wrote to memory of 2880	552	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 2880 wrote to memory of 5740	2880	cmd.exe	100
PID 552 wrote to memory of 2280	552	2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_6348e03c99f167b073a4a6ccad45e3e4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBBBCCAAABACCCCCCBBCBABCCBCCAACBCCABCAABACBBAABACBABCBAAACBAAABCACABABACBABABBAABAABBBACABCABBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAABBBBCCAAABACCCCCCBBCBABCCBCCAACBCCABCAABACBBAABACBABCBAAACBAAABCACABABACBABABBAABAABBBACABCABBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBCBCCBBACCBBACACAACACAAACABABBCCAACCCBBACBAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe" start= auto displayName= "UserDataSvc_CABBCBCCBBACCBBACACAACACAAACABABBCCAACCCBBACBAABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBCBCCBBACCBBACACAACACAAACABABBCCAACCCBBACBAABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe" start= auto displayName= "UserDataSvc_CABBCBCCBBACCBBACACAACACAAACABABBCCAACCCBBACBAABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBCBCCBBACCBBACACAACACAAACABABBCCAACCCBBACBAABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2280
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBCBCCBBACCBBACACAACACAAACABABBCCAACCCBBACBAABBAB"
    3⤵
    - Launches sc.exe
    PID:6024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCACCBBABCBBABACAABAAACBACCBAAAACBCBCACBAACBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCAACCACCBBABCBBABACAABAAACBACCBAAAACBCBCACBAACBCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e07294a76f2cf32db6830b95c6c46fb6c0a88106bacbbc206f323974712c8ee8
MD5 d8462aaa7a9992673078aebbc9ac22a6
SHA1 0d6dae85a06db0b87bcdac94b21405585976d8bb
SHA512 3e8eb7f94f94d214babb664311e91a483329663671c124b0ef7aa2567b69cb26e436803629dca4d62a88b2e75cd0c8521be051d209566e39c24772753b6c76d7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6eac8e27dce16cc969e2a8caa22ed499b2714428937c95fa55043502ae14f029
MD5 491ea640d3b6ac02a33ee91cbeb4e586
SHA1 7da16a5dd10a4e951e74a320bd978d49b5abafde
SHA512 0bcde46c55a23f4829816fdd642580f1ea12fc83b9d0374d904df8795aa357db9d46558346d2c26b28db1a059e35e11ae4aaf8dab22300cf98333086b9b64e81
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cee03846e701ed3d5c4b892429749ea970fa4669316086325b397984d38ee75d
MD5 14139a120b961a165ce279564c7193f3
SHA1 945f7230b9ac949caf6b91e4d85e75dab97c20d7
SHA512 b8709645a601750efd07195bff82d2adef6e13a0b3e6f9bb2f5b505726dad4705e8146aebb84e4c671b7e8eb472075dc2e09f9877e765d0fc70086d4901397e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ad8086f6dcb7a5b3c3e4b8419dd259f66fe47fb884227fbb9b05fb6bad539c7
MD5 64df418faf651f9d0c6301d05a77cf16
SHA1 5c0cdf225413e9e3ff73b3aa264ed483b551985e
SHA512 8e421b40905901ecc32387c6834ff8701449a13e27cf80ada69332c7a8f8cfb1ade1f76cff0f38a06053f304a34fccbece3ef2f5c3707b3f6e308e3f5949715b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4ceaa389aceacc1d6c055bac3eef762aabc46544f316f2c4fb8e9c9dab41b49
MD5 c3f3f479938103ce850ceb0bdbea5d20
SHA1 e019f29c4296023c439769919187fe7b5e0fc7d2
SHA512 0ff58c3c7de9150bfb6e81f9cab472632e638a0e3f6d067625961383bc065b198faa983db77db3e034c59405a140a997e6295f6ac0b823e5d454bfc7e39e6569
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 39.1MB
SHA256 9b24dfa2472e59020d077b0eddedbb08c4c8410ccd830cbcbddc516e7e5029c0
MD5 54a8caaefb593d971a1d89161bbed292
SHA1 24528d35bd26eaaebec758986a22ef2f5d540fe9
SHA512 4087bfc55c020c32d712c8f430658b6f445c9faf8ed01def7618e563a87f0ede75bf65660e0c5508cbc8e49be57fd17359bfee57ff0984983af482913ecd4bbd
SSDEEP 196608:AKWQc0gEYnvLZKWQc0gEYnvLZKWQc0gEYnvLkCqzi8Oq8:hcZEIvkcZEIvkcZEIvQ1POT
TLSH
T198973C09F98340B1DD2B50F04DCFE3BF8A60BB25C6128DF7F74D8B5BA522BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 1.7MB
SHA256 37b23c71edb80d226561deb13b83973564be4c27c5ae1bac85977986c0d82dac
MD5 b83f3b9a57934499601f984dbc119870
SHA1 721e7eb55240fc4284dd77e5fdb0305bd9b79e7e
SHA512 f343ace5eaa24ca49d422984c96a47b0c846ec73065d305f9f6a2fe92b3a6c7e46c52bdecd98dbae66c9c4de85b8ca3ef02cabeec078d8725e860542c4f8e154
SSDEEP 49152:U+ES+ESdx+EST+ES+ESdx+EST+ES+ESdx+EST+ES+ESdm+ES+ESdx+EST+EV:t
TLSH
T1FE850A09F98340B1DD2B50F04DCFE3BF8A60BB25C6128DF7FB4D8B5BA522B616428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cd737aa531167d39463daaee4416a1941178e486800d28f98e79647357eb89a6
MD5 6b718cd42a1db901faaaa363cca10b60
SHA1 3c17332b91f0cf31cc8739c2b0936afc3bb43cb5
SHA512 c48e4a6853b5a4df29ee3337459182e3ce0be9e1ef79f3290637da5eb84b03a303e0e308c0c0e647285b8f90c1f47896c24d09afa90ff3e84af6d55fadad4051
MD5 SHA1 SHA512

Submit Download

svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
Size 12.8MB
SHA256 6b860eda31372691a43315c7dd4bb54544b422aea4de179426cfc0f16561f402
MD5 6348e03c99f167b073a4a6ccad45e3e4
SHA1 5c42892d78091546394c799e26e837f2817913c1
SHA512 e398ba403d1fbb45a5fca6c2b453c728d990e88feee32ba03efc102b950377753ab473d7d8e6e8d4448711f84bbb10704522153b697af6122bb0440bab1b8ada
SSDEEP 49152:U+ES+ESdx+EST+ES+ESdx+EST+ES+ESdx+EST+ES+ESdm+ES+ESdx+EST+ES+ESP:zKjKWQckVgtev5mnlNLq
TLSH
T14CD62B09F98340B1DD2B50F04DCFE3BF8A60BB25C6128DF7F74D8B5BA522BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBCCBCCACCBBBCCBAACBCBBAACACBAAACBACCACCACBBBABBCCAA.exe
Size 4.6MB
SHA256 8e041461f93d32d072fce657c0025c3c67d1903f48e0502f0bc553b0751590bf
MD5 5cdfeee2be0e4b82863abb50138e9b4b
SHA1 d0aa59d26cebe987d39bd9746f9624abf877b90d
SHA512 5cf8d8b02f73421a766e188e44a9d9718c22334815147047dbf627fdb3370a6704dea901e46145098790825ab6a40e15046657a64e63642ff5ba0831b6def0c2
SSDEEP 49152:U+ES+ESdx+EST+ES+ESdx+EST+ES+ESdx+EST+ES+ESdm+ES+ESdx+EST+ES+ESr:p
TLSH
T1D9260A09F94340B1DD2B50F04DCFE3BF8A60BB25C6128DF7FB4D8B5BA522BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-48-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/552-70-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/552-0-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/552-23-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/552-12-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/1764-85-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/2556-49-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download

memory/2556-71-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download