5059dd66585369d3600a0736e8d72e4bec4ab49422d0786add7edd03df59d1f6

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Size 51.6MB
Sample260910-n2ynvabp6t
SHA256 5059dd66585369d3600a0736e8d72e4bec4ab49422d0786add7edd03df59d1f6
MD5 b22015533e542fa99ede30d6c14816f1
SHA1 b55b7306ed0e5c9e90cf1e4cf68fa8adde9b8ee3
SHA512 324c97672e506a2c1f4a389917102cfde605cb6d8e48788cffad13bcb7ff6efc02dddb66a7ffed16e5d629c4fb3ad17104109f710a5ef07ab76db03b3830bf32
SSDEEP 49152:U+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+EJ:Dp7Ep7Ep7dKjKWQckVgtev5mnlNL4
TLSH
T1CAC72A09FD4340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5732	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
5704	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
4700	svchost_CBBAACACAAAABAABBCABBCBACBCAAABBBCAAABCACBAABACBCACCACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABBBACBBACBBCCABAACBCCCAACBBCCCBCAABABBABACCABBABACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAACACAAAABAABBCABBCBACBCAAABBBCAAABCACBAABACBCACCACB.exe"	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCBCCACBCCABABCCABABCBABBBACCCACACACCCABBBCCBCCBABBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe"	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4284	sc.exe
1964	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5272	cmd.exe
5360	cmd.exe
4200	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAACACAAAABAABBCABBCBACBCAAABBBCAAABCACBAABACBCACCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5032	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
5032	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
5032	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
5032	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
5732	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
5732	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
5732	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
5732	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Token: SeDebugPrivilege	5732	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 5360	5032	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	92
PID 5360 wrote to memory of 5068	5360	cmd.exe	94
PID 5732 wrote to memory of 664	5732	svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe	95
PID 5032 wrote to memory of 4200	5032	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	96
PID 4200 wrote to memory of 4284	4200	cmd.exe	98
PID 5032 wrote to memory of 5272	5032	2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	99
PID 5272 wrote to memory of 1964	5272	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_b22015533e542fa99ede30d6c14816f1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABAABCBCCCCCCACACABCBAABCACBBCAACABAAAAACABABAACCAABBBACACCBCBCCCABCCBBBAAABACACCCCBBAABABABBCBBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABAABCBCCCCCCACACABCBAABCACBBCAACABAAAAACABABAACCAABBBACACCBCBCCCABCCBBBAAABACACCCCBBAABABABBCBBCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACCBBBCCBCACCCBACABBACACACBACACBABACACCBAABBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe" start= auto displayName= "UserDataSvc_ABAACCBBBCCBCACCCBACABBACACACBACACBABACACCBAABBBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAACCBBBCCBCACCCBACABBACACACBACACBABACACCBAABBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe" start= auto displayName= "UserDataSvc_ABAACCBBBCCBCACCCBACABBACACACBACACBABACACCBAABBBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACCBBBCCBCACCCBACABBACACACBACACBABACACCBAABBBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAACCBBBCCBCACCCBACABBACACACBACACBABACACCBAABBBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAAAABBAABBAAACBCCBCBBCCACBBCBBCBCCCBCCCBABCCABACCAC.exe
1⤵
- Executes dropped EXE
PID:5704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACACAAAABAABBCABBCBACBCAAABBBCAAABCACBAABACBCACCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACACAAAABAABBCABBCBACBCAAABBBCAAABCACBAABACBCACCACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b57843bc8d1170a9e0bd475f43d657309145381635ec734782bdde7a0403f1e
MD5 7c266777fcdbfe10961c1ef86b0c5dea
SHA1 2d5e8bf821abb90119ffe72f4aab26e454c938f8
SHA512 256733eb52f10aa476f51e9e638f0dac53e735bb9e3b03c88a9b7d1988d65366437c502e02e587df8701b66560ae31c772b7679f98faba4f8c483ba97dd6088d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8969ac7918bd5d328e405d291ab42af03d03864c369dae62be9e424afd48653f
MD5 70f613a868260650bd775c38b47bac65
SHA1 20457b4723b2387f919b2f4145df7fe81e0e3048
SHA512 0f9f601aad2d1dc44645d9cd7064eb04363ac49be653b5e7ae0bb79e01ef2aecd7bb0bfdd6fda4d7c56b5772c1e3f4cea78088fb7372a6650bc2d3708cea4ce5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c99b40b8496ff40b375c4e39023d0a1ffaeafe74e76f4d4ef31c05db3f4b6125
MD5 d325bca1eab969bef78dcf420de24175
SHA1 9e456bcf2883c74379db096be4ac52f6a4e9aaf9
SHA512 a9a87f918b8db14f0b47fc1c6baf8112e0bf5350ee53a9f0b30ac7b075bf87d2b2c83f5709acb820bd3519c6aa8ce69fbc601eeed7e3c1228b9efe77cba52e2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9d0bfc9419e1a53cacf172b4f5c99bd7b0ebe83f9146a8e03fe21ab857eb6cd
MD5 4df5653114232fcb4c93166394cb3d81
SHA1 ba1e4d6a0ba71fe161333ad6d4e0459902159cf2
SHA512 60152c77f805c0d51ad0364e411830a2104155f04cf19f818990e0775d1a32f537213d80f02eb089798517c3559b5cc8477607e79531e0ae5c669382e4b290cf
MD5 SHA1 SHA512

Submit Download

memory/5032-32-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/5032-35-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/5032-0-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/5032-61-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/5032-22-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/5032-11-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/5732-34-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/5732-52-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/5732-73-0x0000000000160000-0x0000000000181000-memory.dmp

Download