a2fa24bab86e6433d2ac51c29c4d10f11bb67ea84124a3ac312b65f78d871f29

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
Size 12.3MB
Sample260910-jg48nszenb
SHA256 a2fa24bab86e6433d2ac51c29c4d10f11bb67ea84124a3ac312b65f78d871f29
MD5 0ba38b0a86708795615d90b53ed943fe
SHA1 6c9a4daf6f4bf1f8fb5579d3f8db6bc383e16b3f
SHA512 e747044518b076c5377c9c81d2eaffa8a03b7e274498c3bdf8ef2dc1c003526f74860f2bf5f0fc200b690017626f9175809aebc620a8d8b7d7de574f3527f1d0
SSDEEP 196608:EfUSRfUSRfUSRfUSRfUSRfUSRfUSRfUSRfUSrKWQc0gEYnvL/:kDDDDDDDDscZEIvL
TLSH
T1C4D6C022F4824072E9B601B25D5BE3799E38AF3443118DBAF3CCEE0F79359916677252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2824	svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAAABBBCCAAABBCCACCCAAACBABCCCBCCABCCCAABBBBAABCACCCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe"	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3152	sc.exe
4864	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3988	cmd.exe
4776	cmd.exe
3964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4028	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
4028	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
4028	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
4028	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
2824	svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe
2824	svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
Token: SeDebugPrivilege	2824	svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3988	4028	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe	91
PID 3988 wrote to memory of 944	3988	cmd.exe	93
PID 4028 wrote to memory of 4776	4028	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe	94
PID 4776 wrote to memory of 3152	4776	cmd.exe	96
PID 4028 wrote to memory of 3964	4028	2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_0ba38b0a86708795615d90b53ed943fe_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_remcos_rugmi_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAAABCBABCBBCCCBAAABBACCBCCABCBAAABAABBCBCAACBAAABCABBBABBABCCCBABACBCBBCCBCACBCCACBACABCABAABACBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAAABCBABCBBCCCBAAABBACCBCCABCBAAABAABBCBCAACBAAABCABBBABBABCCCBABACBCBBCCBCACBCCACBACABCABAABACBCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCCBBCABBABBCBBBCCCACCBCAAACAABBACAACBCABCACABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe" start= auto displayName= "UserDataSvc_BAACCCBBCABBABBCBBBCCCACCBCAAACAABBACAACBCABCACABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACCCBBCABBABBCBBBCCCACCBCAAACAABBACAACBCABCACABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe" start= auto displayName= "UserDataSvc_BAACCCBBCABBABBCBBBCCCACCBCAAACAABBACAACBCABCACABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCCBBCABBABBCBBBCCCACCBCAAACAABBACAACBCABCACABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3964
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACCCBBCABBABBCBBBCCCACCBCAAACAABBACAACBCABCACABCC"
    3⤵
    - Launches sc.exe
    PID:4864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe
1⤵
PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 750e6c71081908a0ce207c47a2c42f83bfee66e6fe3f8c4cf4013f4ec09c147b
MD5 56f9f90d836a599f89f3a9e3b4be9ed6
SHA1 d897dd195ca6fc5b98c88097875b10e10c9af3e3
SHA512 040269e18ce6c02de1e6a45ca43f444a167ed2da9d6f67cb487c1b25c2d295587f2a5b8ff28b76110410fce4252719bf5d8d95fdb605f25ecf5c59e2cdb17967
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b5ced2d9e146c6af0ef52a233e16c3afc334c46cbca6e024eac73a7da9f2bf93
MD5 8dc343f29441f2d8dcb3b35c41bb514e
SHA1 462ea7db2e27e0c604aacf24a727291035284d89
SHA512 659146b222ec5eefe1ded68e7e6ea150c4f1c50fc1fff1c436eb9fa3ab8a53b1826e346dad9920a748251df10fe62552294cd49628a1425511035ee60d113883
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa8d32370f06c52a12e26f8aa3b375a83704609a8661568d0b295db0b50c5558
MD5 2a53d903f9467aab72c2cbfbe3ab9019
SHA1 d1482479d07f50ddb2661afa89bc94efb91779ae
SHA512 a5a00f540ca3eebc274ffc42577dab2bff0f264b0ef83aad6b2088f955b00193148c17ebc3c9d8df32c808fbb608403e8b7fd1b863f562f28bae8b253051f151
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2422ea2716a27349c53d17bc99f016b1ee4fed6376a6e4301a101cec64da43e7
MD5 b6fa06652bd8c79c6c09520c2ace2a32
SHA1 322572fd69754f18c3dec6f567a184dfd478c9c7
SHA512 145ab34dd8fb32624171637cd3fec8b921cb7a334778b6c94995ffd6f44a245566e5ff20d4fb7c72c0e5b37cc3d8df21cb62c4856d825fc2e3af1af87a76911b
MD5 SHA1 SHA512

Submit Download

svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAABACCCCCCBCCCBABCBBABBACABBABBBCBABABACBBBBBCABA.exe
Size 12.3MB
SHA256 a2fa24bab86e6433d2ac51c29c4d10f11bb67ea84124a3ac312b65f78d871f29
MD5 0ba38b0a86708795615d90b53ed943fe
SHA1 6c9a4daf6f4bf1f8fb5579d3f8db6bc383e16b3f
SHA512 e747044518b076c5377c9c81d2eaffa8a03b7e274498c3bdf8ef2dc1c003526f74860f2bf5f0fc200b690017626f9175809aebc620a8d8b7d7de574f3527f1d0
SSDEEP 196608:EfUSRfUSRfUSRfUSRfUSRfUSRfUSRfUSRfUSrKWQc0gEYnvL/:kDDDDDDDDscZEIvL
TLSH
T1C4D6C022F4824072E9B601B25D5BE3799E38AF3443118DBAF3CCEE0F79359916677252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2824-25-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2824-38-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/4028-0-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/4028-8-0x00000000008E0000-0x0000000000901000-memory.dmp

Download