6c20ddd62933022eacc7f3a8b77be7c6fb2fc39f75580da255254ca301f2d42a

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Size 54.2MB
Sample260910-qp2abaxybt
SHA256 6c20ddd62933022eacc7f3a8b77be7c6fb2fc39f75580da255254ca301f2d42a
MD5 95549133a06f6270ff069af8a6641b75
SHA1 152fdd94d559159be2816603948a34c72d6dfcb5
SHA512 b6e9a55387cd8bceba3d5d93e870e4b021faa8dab5fd296a1905a138e59e7220ce63744e8712bebbad4a314d7d9e966820640655b089f69b7f43d194721ddb6c
SSDEEP 98304:sK7K7K7K7K777K7K7K7K7K7K7K7K7TK7K7K7K7K777K7K7K7K7K7K7K7K7TK7K7R:kKWQc0gEYnvL3
TLSH
T1BAC72A09F98344B2D92B11B04CCBD3BF8A30BE258B128EEBF64DD75F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3348	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
5232	svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe
4980	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBAAABACABBCCBACBCCBBCCBBBAAABBAAACBCCCABBACACCBAACBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe"	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCCBBBBCBCBBBACBCCAACAABBABCCCCCAAABCCBABBBABCCABACABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe"	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1428	sc.exe
3868	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1848	cmd.exe
1884	cmd.exe
1388	cmd.exe
3836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2284	schtasks.exe
3376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5032	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
5032	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
5032	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
5032	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
3348	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
3348	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
3348	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
3348	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
5232	svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe
5232	svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Token: SeDebugPrivilege	3348	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
Token: SeDebugPrivilege	5232	svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 1848	5032	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	92
PID 1848 wrote to memory of 2284	1848	cmd.exe	94
PID 3348 wrote to memory of 4624	3348	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe	95
PID 5032 wrote to memory of 1884	5032	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	98
PID 1884 wrote to memory of 1428	1884	cmd.exe	100
PID 5032 wrote to memory of 1388	5032	2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	101
PID 1388 wrote to memory of 3868	1388	cmd.exe	103
PID 3348 wrote to memory of 3836	3348	svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe	105
PID 3836 wrote to memory of 3376	3836	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_95549133a06f6270ff069af8a6641b75_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAACBABBABABBCBCAAAABBBABCCCBCACBCABBCCCBCBCCBABACBBABABCACBCBCBAABBAACCABAAAACBAACBCCBCAACACBBCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCAAACBABBABABBCBCAAAABBBABCCCBCACBCABBCCCBCBCCBABACBBABABCACBCBCBAABBAACCABAAAACBAACBCCBCAACACBBCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCAACCACCCAAABAACCCBABAACCCCAAAACACCAACCAACABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe" start= auto displayName= "UserDataSvc_CCBBCAACCACCCAAABAACCCBABAACCCCAAAACACCAACCAACABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCAACCACCCAAABAACCCBABAACCCCAAAACACCAACCAACABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe" start= auto displayName= "UserDataSvc_CCBBCAACCACCCAAABAACCCBABAACCCCAAAACACCAACCAACABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCAACCACCCAAABAACCCBABAACCCCAAAACACCAACCAACABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCAACCACCCAAABAACCCBABAACCCCAAAACACCAACCAACABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACCACBCBBBCCAAABCABABAABAAABABBABCCACBCBAAABBACCAABCABACBCCCACAACAACAABABBBBAAAACBACCBBBABCBBACBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACCACBCBBBCCAAABCABABAABAAABABBABCCACBCBAAABBACCAABCABACBCCCACAACAACAABABBBBAAAACBACCBBBABCBBACBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBBABABCCACBCBABBCBCABAACBCCCBCCAAACABCCBBAACBACCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCABAAACBBBABBAABBABCAACBACACBBCAACCABCABCACCCBBBBBA.exe
1⤵
- Executes dropped EXE
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 befbab3401754d9dff9e8a1d05ccdbb3b87d313d6f3d8d28123a1419793c8397
MD5 859627d209c1bece2550d3fdd2cf47c6
SHA1 eda1f2b4daf3488d51fa34bb41f6abcaaa6cd1db
SHA512 337dcd3b7e8bc7e39f69d80b9e97b70a23ac5fb2c3ffb47c743bd962829db9170f571f64f70f6b3ca4a0757ce0d7c7e5daea7dc3692ffe86c0356ffbe211c71c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1d57c41c2b3030fb5bd457d18b7d862a7d5206c85b550063e0a33a18322a1e66
MD5 a7d055e86dfb51356c96e4b2d34f91c1
SHA1 3d826a648f7c64b33bba002262acc6693e82eeba
SHA512 841cc8b7225fb6755857a29e1a8030437c219a8c04097893b11e95fcce063b847bf6149952e393d6e644a3e154650f046c4b57dcd5644a18c5a9d514c411351d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d439279895553f9535ca8befcfc13a0d255714e08634014306149c998ca94ba4
MD5 9e0db685f663aadb4beed5afc428652c
SHA1 86d919ea51ff078d970e68f8b5d319926c55691c
SHA512 e6e8b3b881be91a4547b615f505293e164b0ee0877711a04e13bf17eaf89fb73cfd59da282b9e1d36c08826596005be397b8cebe2d22d68add16f79cfab1eeeb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f7b99b794333ad47c23fbb7658613612af264299301a094f5725db9b3283fb8
MD5 e6ef233e203903f0c37d135e6633b557
SHA1 db58c085713e5059ca871057915aaae528501aa6
SHA512 5193cf20819beca6d0bf8968b23fe99598e72a23b23b17196035ddbfef8c066cbd82fad27d36f065b818372bcad65795c4af82200c946e74ffc5f8d9f389a533
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f36d0915d8310df9bf30fcbd54f6c352d75db542d30352c16d3c6f2e5ea9f159
MD5 2fcdda25d42d18982b79f8b636ab2b33
SHA1 de89c2019397db6a29dd79641c0bdaa191ddf308
SHA512 52ce55660f74c3b86e1786a7561b6944baad797f9284eaece448a89c5e60837b580ed2c0c07361357e11a42476f46937af1c97fb696b0f25f21be260c04593a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9741f88645b5890f512a124feaa3d0d2a2b716673297c628093b2964cf9dd62
MD5 936ac70ab05c43d1b7595e4ae3186cf2
SHA1 792954812ae28fba1c733e149b9af59d24127449
SHA512 f326cd302253c333dc259d1c9ea728a9eac472c42fab9b52ad8f6cbc0553a7c5a498b4b75b8b1b2880c0f112e446a805e898eb729ce2e27728feeb6bca9d1ea2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d461c0a0f1307f5fb16bc322c361b61383064d3d304a5ae1fb2682b249afb05b
MD5 4b420ae91fa868684a4bfb11ca65f39e
SHA1 a5c759fdb60dc5415075f5678a007086da2c1ded
SHA512 cf7c99cad1d3700574fa6a6866cde6a217fd3ed32f1ec5159f9909cea13b13491f739e0fc554f145bb2ed10fd2f442aa942f4c6ff37e7db74a1c3d0a015701e9
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 92cbbcbead431043fb64f3be868d40ef25761da0223b363dcfc442770395fdb9
MD5 41772557faa979ea02da7a6ec2a6545f
SHA1 8cd7b12ad6d6a89a9dbd605cc8a082108e1eb17f
SHA512 e54f72d3aaacf715a6908afccf9f6c51774157d159effef99b43264b98bb3621d771a278cb5f0a978f69be66873b7dbdbd074b6b56b1d837657fcf0b6c0e237d
TLSH
T18911E780F0A6D857F17128CB9627CB860CE837BB9C5CABA42309452DF7ADD358D554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 53b525832c2316159648d9dd9f0c29935a029711c3e9c1accd961aa442582887
MD5 7243bc22502d7d8098a0ef5d911dfb48
SHA1 4c2e236c8eb49498caf1dc6d1a436ee99e932f47
SHA512 8db23b9f8f4cea7eede322811c8947c60281718f3c7f8407f27934c276b56092c042deffc557529ea2263ffc176a7334058e616d7691511283201a1d4ed61ab8
TLSH
T150113891F092C8A7F13028CB962ADB860CA837FF9C9CAB94530A4528F7ACD35CD444E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3348-32-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/4980-73-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/5032-6-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/5232-63-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/5232-87-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download