229c06b985b1033a5c3737bdcbb83dd33fa9ccbfaf47d35c10b2f8980d444bb2

General

Target
2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Size 51.6MB
Sample260910-pmkn4swycs
SHA256 229c06b985b1033a5c3737bdcbb83dd33fa9ccbfaf47d35c10b2f8980d444bb2
MD5 a7ec57c4a80872b784fb780ce032340d
SHA1 ae1cc7a0bf393e682ebdbf727c5fdb61bc0d518c
SHA512 4026dda67bc1789901850c125c51b45a8fd8cfd8e1d29bfff63d04fa8f1e564ad2f49e4103a932434cd466ee071b01c8d3ac7fc2b232d208bc76b8cd84fe1e3f
SSDEEP 786432:Cz4rE3ZObqzz2kxgfRZQbAjdGNOmGCDGo+XyhydA1cM2YkQOgUFw:s4o3Z72kxSZe2sNxxayhyil2Ykgy
TLSH
T1A2C7DFA3D0134B14EBD60A7ADAD138041D98B01EFFA869EF354C9C85E2A37C176B17B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 1 IoCs

pid	Process
4736	solarex.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6000	cmd.exe
2288	cmd.exe
2568	cmd.exe
4144	cmd.exe
4352	cmd.exe
5044	cmd.exe
2312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solarex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
4496	reg.exe
1404	reg.exe
3248	reg.exe
4344	reg.exe
4868	reg.exe
264	reg.exe
5512	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4708	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4708	AUDIODG.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 6000	2088	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe	89
PID 6000 wrote to memory of 1404	6000	cmd.exe	91
PID 2088 wrote to memory of 2288	2088	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe	92
PID 2288 wrote to memory of 3248	2288	cmd.exe	94
PID 2088 wrote to memory of 2568	2088	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe	95
PID 2568 wrote to memory of 4344	2568	cmd.exe	97
PID 2088 wrote to memory of 4144	2088	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe	98
PID 4144 wrote to memory of 4868	4144	cmd.exe	100
PID 2088 wrote to memory of 4352	2088	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe	101
PID 4352 wrote to memory of 264	4352	cmd.exe	103
PID 2088 wrote to memory of 5044	2088	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe	104
PID 5044 wrote to memory of 5512	5044	cmd.exe	106
PID 2088 wrote to memory of 2312	2088	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe	107
PID 2312 wrote to memory of 4496	2312	cmd.exe	109
PID 2088 wrote to memory of 4736	2088	2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_a7ec57c4a80872b784fb780ce032340d_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCmd /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCmd /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRun /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRun /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLogoff /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLogoff /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRestart /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRestart /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableShutdown /t REG_DWORD /d 1 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableShutdown /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4496
- C:\Users\Admin\AppData\Local\Temp\solarex.exe
  "C:\Users\Admin\AppData\Local\Temp\solarex.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

solarex.exe

Path C:\Users\Admin\AppData\Local\Temp\solarex.exe
Size 42.5MB
SHA256 8511d57da70591d4cf7bd518a1b9e86c8ce8840b9d441441106ceee463bd720f
MD5 5c4d3c1a506a5eb970034555291a8c62
SHA1 b8427da607bb899bf6ddcbc50a525ebc99342f4d
SHA512 e08edbd33c3980d4ed7b2c4a32d4310ff3cfe455395bdd316ba0a868e99335ab0826705875e3eb57be10be72953dc29427aca4e854364625cf4d7b620896c944
SSDEEP 786432:Iz4rE3ZObqzz2kxgfRZQbAjdGNOmGCDGo+XyhydA1cM2YkQOgUFw:a4o3Z72kxSZe2sNxxayhyil2Ykgy
TLSH
T16CA7D0B3D0134B14ABD70A7ADAD13D042D98B01EFEA8693F394C9C85E3A370176A57B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-0-0x00000000005D0000-0x00000000039A5000-memory.dmp

Download

memory/2088-1-0x00000000005D0000-0x00000000039A5000-memory.dmp

Download

memory/2088-7-0x00000000005D0000-0x00000000039A5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads