fae982d7f0cb7ebf533e2a85f600d77b69b2d05015b7c64a508106fb07e0b1f0

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 9.9MB
Sample260910-k4bqba1ckd
SHA256 fae982d7f0cb7ebf533e2a85f600d77b69b2d05015b7c64a508106fb07e0b1f0
MD5 ec61cc177d218eff87949fc80c9eed32
SHA1 b529a1fdc86a86a7d25320453b4c8f81635d5626
SHA512 6a2a78d08768ffdd05d57073df668ad8204d8fe9ab15cdefd406e18922e193a94b14cd0f34e3cc49745d77982a632b5a5e1c0cb111109c1f40a52cc8f3df15df
SSDEEP 49152:U+ES+ES+EYRXpH+ES+ES+ES+ES+EYRXpH+ES+ES+ES+ES+EYRXpH+ES+ES+ES+Ek:QKjKWQckVgtev5mnlNL5
TLSH
T119A67E06FAC64071E97701704DDB93BA8631BD214B218BEBE788E63FAD32BD16834755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5956	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
424	svchost_BCABAABCCCCABBABCAAABBCABCCBCCABABBBBBAABBCABBABCCBBACC.exe
3900	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCABCCABBCABCCABCCCCCCACBCCCCBBAAAAAAABCBBBCBBACCABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe"	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABABAAABABBAABABBAAABBACACBBACBAACBCBCCBCACCBCCCBCCAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABAABCCCCABBABCAAABBCABCCBCCABABBBBBAABBCABBABCCBBACC.exe"	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
908	sc.exe
2176	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5788	cmd.exe
3808	cmd.exe
3948	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABAABCCCCABBABCAAABBCABCCBCCABABBBBBAABBCABBABCCBBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5724	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5724	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5724	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5724	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5956	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
5956	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
5956	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
5956	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
424	svchost_BCABAABCCCCABBABCAAABBCABCCBCCABABBBBBAABBCABBABCCBBACC.exe
424	svchost_BCABAABCCCCABBABCAAABBCABCCBCCABABBBBBAABBCABBABCCBBACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5724	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5956	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
Token: SeDebugPrivilege	424	svchost_BCABAABCCCCABBABCAAABBCABCCBCCABABBBBBAABBCABBABCCBBACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 5788	5724	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 5788 wrote to memory of 692	5788	cmd.exe	94
PID 5956 wrote to memory of 4684	5956	svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe	95
PID 5724 wrote to memory of 3808	5724	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 3808 wrote to memory of 908	3808	cmd.exe	100
PID 5724 wrote to memory of 3948	5724	2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 3948 wrote to memory of 2176	3948	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_ec61cc177d218eff87949fc80c9eed32_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCCAACABBCAAACACCBCCBACBAACCABBBCABBACACBBBBCACBCAACCCCACABABBBACCABABBBCACACCCBACAABBABBCCBBAACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCCAACABBCAAACACCBCCBACBAACCABBBCABBACACBBBBCACBCAACCCCACABABBBACCABABBBCACACCCBACAABBABBCCBBAACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACCACBBCCCCBBABACCBCCACAACBABACBABACBBACCCBCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe" start= auto displayName= "UserDataSvc_CBAACCACBBCCCCBBABACCBCCACAACBABACBABACBBACCCBCBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACCACBBCCCCBBABACCBCCACAACBABACBABACBBACCCBCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe" start= auto displayName= "UserDataSvc_CBAACCACBBCCCCBBABACCBCCACAACBABACBABACBBACCCBCBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACCACBBCCCCBBABACCBCCACAACBABACBABACBBACCCBCBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACCACBBCCCCBBABACCBCCACAACBABACBABACBBACCCBCBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAABCCCCABBABCAAABBCABCCBCCABABBBBBAABBCABBABCCBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAABCCCCABBABCAAABBCABCCBCCABABBBBBAABBCABBABCCBBACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
1⤵
- Executes dropped EXE
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37a1a0575cbfdea1d0cd8a93ea4b6b2b5c087dc21a12a3f7a84594e224a18a75
MD5 e43d7c39b0330fec2ae411ec6a56f4c5
SHA1 e6172733fab8106089e4646994068cfb3feadc78
SHA512 11268d0aabe2d79df2fdc5b09b7ee5a97d17db81cad54ec2d330396ae9c076fa6d743d00f3e7f969cbad00dfc1e0688595d39a2a34e4689047325bd3485004ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a56e17127b94ef8952ad87755ac784493baf09080a5b0f320d7f7909a4e2525
MD5 1524dba5187303ffb89eb4479dbddb0c
SHA1 996ea0d5fb7717c0a4bfb1766def8df21d0065a1
SHA512 933281be388fd51315da440677fb4652e09f106530b3a57a7f13845b782fa577a9fcda5d8c4d396ce3da9a71e6fbe52b22446057bc9f53b334d27898f5aa67d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e1e659d94965b1e4e9eb0a89bf6a2c6b974701deec8535a69fef4234197bfb9
MD5 dccfe2e212df8511b2c2980ed486f345
SHA1 57f6c141fb1ac984d0b8a26005439ce3a6112e6c
SHA512 db7aba88825280ec32b39d3a6122299e4dc10bc50ae2573ff277b891807b696dd307420b3e31a5ca890262867f46c0f3488b427d31ff3ec1175466f271b9492d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a6aabbc928dc0297a068b7385c7e6c51e3b56cc5d5a9eea7e1634052cf17111
MD5 005fb9edd2ea8e1ef8f12d61eeca05b4
SHA1 e5f3800e870ea0eaf20ccf4293d7eb31c76361a3
SHA512 77b2a3f6c2625c12ec279e96170f12538c4638c2ece74228b89e435e04c7f70e206764cff38a06b98b840cf11a1d868f6a02c21477d0ed80511a71f0f1f45499
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa139a6342fff244b7b626dcb9956443542968a6afa2c846157afdee067152f2
MD5 6a8f593b7d7b86091a3c56dcfb5645ff
SHA1 5605c3b2574d47f2ccf9979d865eb3f363ac1649
SHA512 86fd27f9e97afaf1c9398c0ed29cbec04c3f543c8be59c9571f5109ab35a7e4e96b85c6d0f4285d680aa861888d43ec474f0149369794651b16ad6cf3b90cb2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a6665d595896d9381ea2850bbc4a4d0d49432111a1d99e18ee8c01c05e291178
MD5 876c285f9a126727b3c19303d13a6bd5
SHA1 a412f4989a19c245053aedb28ce78b4e50805301
SHA512 7b9f3950c99ccfee7370e544e6e74cee8310511fa2fbdb48140d653db5ded5b7b5116fe9680e1882bae6084dca4e04f9011c4dddd7f6408213ff2a58f3199263
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9b590b09f447be38bfe14f8dea264a07f438ca89bee920c5c5a8ccc3beac23be
MD5 31e98eab89c7672a722b4dabae8fe1b9
SHA1 e774c2d49c6e7f1fdf69ecb1d230f3bdd5e2dbb7
SHA512 c296e387b287c3e57747b4084c645b4ed6b9b1b884873ff778cd7267d7abfbe4fbe6b89d1c431b039739b5993dac84995618f008547c8facb8578b35a8e68cce
MD5 SHA1 SHA512

Submit Download

svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACBACCBCCCABBBBCBCACBBCACBABCAABABBABBCBCAACCCABACC.exe
Size 9.9MB
SHA256 fae982d7f0cb7ebf533e2a85f600d77b69b2d05015b7c64a508106fb07e0b1f0
MD5 ec61cc177d218eff87949fc80c9eed32
SHA1 b529a1fdc86a86a7d25320453b4c8f81635d5626
SHA512 6a2a78d08768ffdd05d57073df668ad8204d8fe9ab15cdefd406e18922e193a94b14cd0f34e3cc49745d77982a632b5a5e1c0cb111109c1f40a52cc8f3df15df
SSDEEP 49152:U+ES+ES+EYRXpH+ES+ES+ES+ES+EYRXpH+ES+ES+ES+ES+EYRXpH+ES+ES+ES+Ek:QKjKWQckVgtev5mnlNL5
TLSH
T119A67E06FAC64071E97701704DDB93BA8631BD214B218BEBE788E63FAD32BD16834755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b3cae60a910d4076e72c75a16f9fcfc71a23863b9baaa99ed804aab92196a6d2
MD5 c0eee3af48fa25e9eebec05622d872cf
SHA1 0bb7d60618f332186b8ceaa85ef9afd36321a3eb
SHA512 30eaffbb91b71b59b71da6eb62fdf93fca0d45417b065cf4204a4b3d29fd9c46e5a126f13901e4115f55eba5db8eb270d9bf4663b6731dab37045c12bd0de89c
TLSH
T13311E362F065DC93F072684B5325CBC62C9C27FB686CAB1453090528EB95E3ACF150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/424-64-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/424-82-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/5724-0-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/5724-8-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/5956-34-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download