d681129dfffbe5a5e170de67feee8935ff9eea2da5deddb248a9e2c5dbb314d8

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 12.7MB
Sample260910-v33graen9t
SHA256 d681129dfffbe5a5e170de67feee8935ff9eea2da5deddb248a9e2c5dbb314d8
MD5 45853c734291cfddfedbd894fb6f5397
SHA1 38b0aef6a7e133de9018c937452c62554ac00e2a
SHA512 39cfc0e15ca02f7512e3a95c0f01af57dfb6f8578403118352a6a6bd5cca62dbc16dc1b573014c084382393d79b5a77776ce3e03bf129de6433d41632dd89cc2
SSDEEP 49152:U+ES+ES+ES+ES+E2iw2Mwqp+ES+ES+ES+ES+ES+ES+E2iw2Mwqp+ES+ES+ES+ESm:LKjKWQckVgtev5mnlNLS
TLSH
T1EFD68C14BAFA0C22E1BB217149F2D6794D71BA258334C5CFE589875F6D33BC05836BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
6036	svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
4348	svchost_BCBCAACCCAABCCCBCBCCBACBBCBABCCBBCABACCBCACBAACACCABAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBCAAACCCCABBBCCACACBCBBAACABCBABAABCBAACCAACBBBCCBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe"	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABABBCCABCBBBBCBBACCACCACABCBACBACCACBCCAACCAACCBBCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCAACCCAABCCCBCBCCBACBBCBABCCBBCABACCBCACBAACACCABAAB.exe"	svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5800	sc.exe
6024	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3544	cmd.exe
5128	cmd.exe
2880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCAACCCAABCCCBCBCCBACBBCBABCCBBCABACCBCACBAACACCABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3252	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3252	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3252	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3252	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
6036	svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
6036	svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
6036	svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
6036	svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	6036	svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 5128	3252	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 5128 wrote to memory of 5592	5128	cmd.exe	94
PID 6036 wrote to memory of 4992	6036	svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe	95
PID 3252 wrote to memory of 2880	3252	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 2880 wrote to memory of 5800	2880	cmd.exe	100
PID 3252 wrote to memory of 3544	3252	2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_45853c734291cfddfedbd894fb6f5397_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCCCAACBBBAACABCBCBCABCAABBCBBACCBBBABABBCCBCCBCBCBAAAABBACBCCBBACBACCCBBACAACBCCCBACCAABAAAACAAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCCCAACBBBAACABCBCBCABCAABBCBBACCBBBABABBCCBCCBCBCBAAAABBACBCCBBACBACCCBBACAACBCCCBACCAABAAAACAAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCCCABAACBABCABBCBACACABABCBBAAAAAABACBBAABCAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe" start= auto displayName= "UserDataSvc_BACCCCABAACBABCABBCBACACABABCBBAAAAAABACBBAABCAACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCCCABAACBABCABBCBACACABABCBBAAAAAABACBBAABCAACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe" start= auto displayName= "UserDataSvc_BACCCCABAACBABCABBCBACACABABCBBAAAAAABACBBAABCAACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCCCABAACBABCABBCBACACABABCBBAAAAAABACBBAABCAACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCCCABAACBABCABBCBACACABABCBBAAAAAABACBBAABCAACAA"
    3⤵
    - Launches sc.exe
    PID:6024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACCCAABCCCBCBCCBACBBCBABCCBBCABACCBCACBAACACCABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAACCCAABCCCBCBCCBACBBCBABCCBBCABACCBCACBAACACCABAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1197e16ce02cec55c765f4aae13fc0d0fa8f0c295c43066fce94b51fe3f69302
MD5 2b2c974122328590cccc679bd678dff7
SHA1 2eb050e93841b0b6f7618f26bbe321c75b8605a1
SHA512 a5bb12ba11d4493bd420b43d297a46b79aef36cf2f3c0a6e3a83b1dc0848149608a0047595911c68ba1805f57097b771fb4de86e797cfdade0a5e5b022050948
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32b6a7eca56f7b176a0536ae5e7c613cb3f7b9cfea964fb642f4d986d7e1f9b5
MD5 9df943eff04ba1a0cf30ccb99c692ec8
SHA1 1619b3f7ed37ad91e23aaef06038331e27264703
SHA512 da8f5cd74b9b30100e422d4f95c244999a804612ea3dbb6aeb9beb4e85cfddab51b4493fcb055c3265ed6d9cfa7b08accd32cfa958eec0838474b8966b530230
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6bd0998b004dd3ccbd746477b501434b0de724aaa3c107c052ec054ea3191f5b
MD5 b86585c17e06811a292716e87b7f116c
SHA1 e696ad8dff6e885c89d9f125e29fa1b4274799c6
SHA512 877fa6b762ca83a2d6ba59a84e3429c0ffea3bfe02bc303e49cc82e4cfc293547cd424ada5383635e6a362c88f49f6ac80af21186e64dbb267dd5b86bd435c67
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 791c0a926e0a3d07268a83afa63ad73f7c6e035da8703fecd201a5293da219cf
MD5 3324e6f3eb3d79c1cb6bedf79a9c6f02
SHA1 3ae8fb23f36e41438c010c862b19dcad3db08a6d
SHA512 4c347c9e12f4b7c82fe2f0731db87aa322489d9d67728164dd3608465dd1c97a1dc24091165e5bccec54954ae233bc5374bb719b845b0c30686838a0037d0a97
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 38.8MB
SHA256 1efb21e512847b67178544149ec5c3a462365b57aa4ae7f380a77baf027cbebf
MD5 06486961d780d22a768d45759266a0cc
SHA1 7c3e5ec5417d83a74ec8bd9d8c9821b324a06dfc
SHA512 f54c3f89c7c10b93e393dd386afbe13f7c2bb1131353a264a1c3f231f815b5cc26941babdded68f418bb3242ca9d224974c31ca1348d38fdc17882414fe3d7f5
SSDEEP 196608:4KWQc0gEYnvLfKWQc0gEYnvLfKWQc0gEYnvLcCqzi8OqQ:pcZEIvycZEIvycZEIvQ1PO9
TLSH
T13F978C14BAFA0C22E1BB217149F2D6794D71BA258334C5CFE589875F6D33BC05836BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 5.2MB
SHA256 080e5cda8cba4ab4a4e9d983b2dd25d7e63be445b3413d6e940890af515470f4
MD5 620f35ff29a32ddd51fcc7e617879999
SHA1 2cd688e59ad2a6e580a7ca6e45da6a770683af4c
SHA512 ad169bc60e800f02ebdad3a41a4fee72da5fac08ee022fd47f5f41e71a73eedd6841987892fad3e3ecff826bc32a32c2d47f2f104d7301122adb3ffe0cc8bb65
SSDEEP 49152:U+ES+ES+ES+ES+E2iw2Mwqp+ES+ES+ES+ES+ES+ES+E2iw2Mwqp+ES+ES+ES+ESf:a
TLSH
T16A467B04FAEA0C61E1BB217149F2D27A4D71BA258335C6CFE689875F6D33BC05835B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 42ada5fd9e4100f23b599c4e06b7d0dbeaf354222a565b7ecca19d4dda6e1e71
MD5 377c03e3e1a22b32cbc87261bb7a3053
SHA1 64a0fe23cb5987d787d5f75ff5e4c41ff3bb7aa6
SHA512 9367ece998099a0448bdb6851fac0b03fa08322be58ba13e79cca4d3d77c087e5207b94a099d05fa64d2f00181d8fce570d91029da194e0d8a0f7290bddc6f89
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e6e0385fba5129d78d7e20a84321e918f3efd3492934b61ec2f2447913f19b9f
MD5 23c57626f7674130d15dcc1e02e046f6
SHA1 2de3aaf9d950d34aa02bf78cb347d46e1d1eae9d
SHA512 60309fea22874d20082f33ccf7b620c891f5bb3e2dfd799ac79069f5c8e0aee42057c39112bd4a7dc6313d809752b93c880b2a9bc4f4f4f639bf0751c7d278ea
MD5 SHA1 SHA512

Submit Download

svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
Size 12.7MB
SHA256 d681129dfffbe5a5e170de67feee8935ff9eea2da5deddb248a9e2c5dbb314d8
MD5 45853c734291cfddfedbd894fb6f5397
SHA1 38b0aef6a7e133de9018c937452c62554ac00e2a
SHA512 39cfc0e15ca02f7512e3a95c0f01af57dfb6f8578403118352a6a6bd5cca62dbc16dc1b573014c084382393d79b5a77776ce3e03bf129de6433d41632dd89cc2
SSDEEP 49152:U+ES+ES+ES+ES+E2iw2Mwqp+ES+ES+ES+ES+ES+ES+E2iw2Mwqp+ES+ES+ES+ESm:LKjKWQckVgtev5mnlNLS
TLSH
T1EFD68C14BAFA0C22E1BB217149F2D6794D71BA258334C5CFE589875F6D33BC05836BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBBACABBBAAAABABABCBCCBAABACCABBABCBBABCAABCABBCACCC.exe
Size 1.6MB
SHA256 19ab1b94202c115b06478a70895e696489c1c79f8754475b0d46e150c3e6df14
MD5 ce942037600caf25806cfb231a0b7077
SHA1 c9e46ee473110cc8b7719a24ed51dc4bae5a37d3
SHA512 4d2cfa9d3bc41b1622cb473878e8e4442dc126c3c3418627fa4cfa388ee8616243d20a6b3ae0f8f0f2b860c451cbe4d33da2da1255182f5287247faa68050c20
SSDEEP 49152:U+ES+ES+ES+ES+E2iw2Mwqp+ES+ES+ES+Ei:p
TLSH
T141756B04FAEA0C61E5BB217149F2D27A4D31BA258335C9DFE589871F6D33BC05836B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3252-48-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/3252-70-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/3252-0-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/3252-23-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/3252-12-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/6036-49-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/6036-71-0x0000000000280000-0x00000000002A1000-memory.dmp

Download