dc6dc7a4107e6ad294b20eb0fd2906a49d059ee8296830d1ead030e56521cd6d

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe
Size 14.3MB
Sample260910-g4a71afh64
SHA256 dc6dc7a4107e6ad294b20eb0fd2906a49d059ee8296830d1ead030e56521cd6d
MD5 3be79e2c15ab15d3eb36769b378234b6
SHA1 e3c8c30c55d1a9d6d6a6d9b39a39716623549646
SHA512 1649fe46af25a1a4b532864d43982e355cd22cf2fc1002ebec66d6d2234ae13e4f8bd469e7545fba650318402d96329609bd9954b4dc98d5294ca74058e10fc3
SSDEEP 49152:U+ES+E6+ES+ES+Ex+ES+ES+ED+ES+E7+ES+ES+E7+ES+ESd+ES+E6+ES+ES+Ex+G:pMMMMMMMMSKjKWQckVgtev5mnlNLD
TLSH
T1FEE65C09F94344F1D92B51B04DCBE3BF8A70BB2586128EFBF74DC71B6923B616828255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5008	svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBABABCAABCAABACBCBBCBCBACBCBBCAABCAACBAACAABACCACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe"	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1900	sc.exe
2100	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4936	cmd.exe
2716	cmd.exe
4968	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5688	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe
5688	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe
5688	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe
5688	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe
5008	svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe
5008	svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5688	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5008	svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 2716	5688	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe	93
PID 2716 wrote to memory of 2756	2716	cmd.exe	95
PID 5688 wrote to memory of 4968	5688	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe	96
PID 4968 wrote to memory of 1900	4968	cmd.exe	98
PID 5688 wrote to memory of 4936	5688	2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_3be79e2c15ab15d3eb36769b378234b6_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACBBCCBCAABBACCBCAACACCACAABBCBACACBACACCCCBACCABABBABAAAACBABBABAACACBACAABCCBBACBACBABABBCCBCCABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACBBCCBCAABBACCBCAACACCACAABBCBACACBACACCCCBACCABABBABAAAACBABBABAACACBACAABCCBBACBACBABABBCCBCCABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCABABBBAACAACAACCCAAAACACBACBBBCCCBBAAABACCCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe" start= auto displayName= "UserDataSvc_CCCCABABBBAACAACAACCCAAAACACBACBBBCCCBBAAABACCCBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCABABBBAACAACAACCCAAAACACBACBBBCCCBBAAABACCCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe" start= auto displayName= "UserDataSvc_CCCCABABBBAACAACAACCCAAAACACBACBBBCCCBBAAABACCCBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCABABBBAACAACAACCCAAAACACBACBBBCCCBBAAABACCCBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCABABBBAACAACAACCCAAAACACBACBBBCCCBBAAABACCCBABB"
    3⤵
    - Launches sc.exe
    PID:2100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4e101ebf307c2e28dff9ef5db1181eb6df6461da7fd10a34c2f3697b0d564c2
MD5 b8585be3db9c7260d718ae862a292f34
SHA1 404f828bc2ccfcac8f58c02894c85d5c2fd2c0c8
SHA512 f74859cac56286b850cdcb6e3844a9857ea894d61e265dc8f382742c33bfaa9ab6e6f58dce27adc0f4a5e522b16083deec07a32cd017a882fd8b52fe6abb8210
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e23cd44cd314fcdb269e566c042592c166debe907a8a05bf6dd54c3c23e2bd70
MD5 43bebd7d79502378e0741c5e87c7e8c5
SHA1 6adc4d8b905b062f3f41ac266a11e1fc4f98caa7
SHA512 6d0e66e1338ad29750be06110de1ccda5d34ceb29589b482c44c3590b6a9eefe46cdc937607e17264893e96ef3cc97b3e8588bb3d1696619462e879dd625d458
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e87166612f3908c23d6a5e63a242036d1b1e94b67771d303e318ad581d9aa4f
MD5 c477fd60991ba3b59a38d2572cba515f
SHA1 603631567a9ef7941537964bd9def409c79113ca
SHA512 00be8e99a235b00a5210e15952ecb245fa18a1a66877c77ad738096809721f7a1903469934ff515672de5dd07c67f286ccb28ed34b051f034e56d279df4929c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6f0ce8798d84cf3190819ca3f734506fb29748be614caf15f537428f20236970
MD5 846aeac30efb4ec603a2ed6a4070470a
SHA1 5c0602efc72d4bd9b702f69141b81c9f2fef98e2
SHA512 9a1a7245c660643cc9cf6edf6c53c6084fae3ea40f0ae104ded551bb3369b934d8d6d345fa2053f625623bccb781a8324da581bae3014256f1832ccb8dcbb83a
MD5 SHA1 SHA512

Submit Download

svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe
Size 14.3MB
SHA256 dc6dc7a4107e6ad294b20eb0fd2906a49d059ee8296830d1ead030e56521cd6d
MD5 3be79e2c15ab15d3eb36769b378234b6
SHA1 e3c8c30c55d1a9d6d6a6d9b39a39716623549646
SHA512 1649fe46af25a1a4b532864d43982e355cd22cf2fc1002ebec66d6d2234ae13e4f8bd469e7545fba650318402d96329609bd9954b4dc98d5294ca74058e10fc3
SSDEEP 49152:U+ES+E6+ES+ES+Ex+ES+ES+ED+ES+E7+ES+ES+E7+ES+ESd+ES+E6+ES+ES+Ex+G:pMMMMMMMMSKjKWQckVgtev5mnlNLD
TLSH
T1FEE65C09F94344F1D92B51B04DCBE3BF8A70BB2586128EFBF74DC71B6923B616828255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCBBABCACBBABBBBABBCCCACABBACAACBCABCBCAAACBAAABBCB.exe
Size 8.4MB
SHA256 130f7a45df67be5362d58aea7948454d14a63c63c2d5f0e10b56ae219a712baa
MD5 d86ff6e318b6597688705e372b1762b4
SHA1 16e02868aa3f0af53cce76379cce2aff92e9b77a
SHA512 f3f8b0238a986fd27d957c0af09b8bd1b34aab36a0a513b80b4b276754b996507d77da16d8d2f29b68b9da799c33f12aa79792d7e2d2d42755f11259bc7c469b
SSDEEP 49152:U+ES+E6+ES+ES+Ex+ES+ES+ED+ES+E7+ES+ES+E7+ES+ESd+ES+E6+ES+ES+Ex+l:pMMMMK
TLSH
T1F8964B09F94344F1D92B51B04DCBE3BF8A70BB2586128EF7FB4DCB1B6923B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5008-25-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/5008-38-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/5688-0-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/5688-8-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download