6ddea3865ecfef12110761e112afa1902c7a7ecee47308f4e9a9f309a79f730b

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 2.2MB
Sample260910-wwbacser8v
SHA256 6ddea3865ecfef12110761e112afa1902c7a7ecee47308f4e9a9f309a79f730b
MD5 352f03a9bc5f8084b7f6a9fa14eab006
SHA1 3b5010b7a0ce9ed3e6f59eea529d47e4305851a4
SHA512 4f856cac76e2228a6c6421ee41b3ba8e32e03e3bd82e09acafb6bd0c85e8510b41af8a4795537c1d551cc4aa51b39b620b39a6c0a349a253b052754f6fbb8eaf
SSDEEP 49152:U+EO+EO+EO+EO+EO+EO+EhKjKWQc2b1FVgbjrjxPe1pbPSQm1Flo+LjphOt:sKjKWQckVgtev5mnlNLFe
TLSH
T103B5D00DF5D640B0D977517048DBD27A8A71B93187218EEBE789C63EAD33BD0A838B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5076	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
2468	svchost_CACBCBCCBAAABCCCCBCAABABCCCCBABABCBAABBACCABBCBBBCCCCAB.exe
4704	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBCBBBABCCBCCBAACBCACAAACCABAABBABCCAAACCAAACAACCABBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe"	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBBBCABBABABBBABBCBACCCCCABCABCBBACCBABCAAAACBAAABBCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCBCCBAAABCCCCBCAABABCCCCBABABCBAABBACCABBCBBBCCCCAB.exe"	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4240	sc.exe
3052	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
728	cmd.exe
4088	cmd.exe
4936	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBCBCCBAAABCCCCBCAABABCCCCBABABCBAABBACCABBCBBBCCCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4072	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4072	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4072	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4072	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5076	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
5076	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
5076	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
5076	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5076	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
176	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 728	4072	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	108
PID 728 wrote to memory of 4680	728	cmd.exe	110
PID 5076 wrote to memory of 1028	5076	svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe	112
PID 1028 wrote to memory of 1704	1028	notepad.exe	113
PID 4072 wrote to memory of 4088	4072	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	116
PID 4088 wrote to memory of 4240	4088	cmd.exe	119
PID 4072 wrote to memory of 4936	4072	2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	120
PID 4936 wrote to memory of 3052	4936	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_352f03a9bc5f8084b7f6a9fa14eab006_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABAABCAABACBACBBCACABAAABACCABBBCAACCBBBABABCCABACAAAABCABAAABBACBACBBBACBCCBCAABCABBAAAAACABACACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABAABCAABACBACBBCACABAAABACCABBBCAACCBBBABABCCABACAAAABCABAAABBACBACBBBACBCCBCAABCABBAAAAACABACACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCBABCABCCCABACAAABACACBBAACABBCBACCABAAACAAABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe" start= auto displayName= "UserDataSvc_AABCBABCABCCCABACAAABACACBBAACABBCBACCABAAACAAABABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCBABCABCCCABACAAABACACBBAACABBCBACCABAAACAAABABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe" start= auto displayName= "UserDataSvc_AABCBABCABCCCABACAAABACACBBAACABBCBACCABAAACAAABABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCBABCABCCCABACAAABACACBBAACABBCBACCABAAACAAABABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCBABCABCCCABACAAABACACBBAACABBCBACCABAAACAAABABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCCBAAABCCCCBCAABABCCCCBABABCBAABBACCABBCBBBCCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBCCBAAABCCCCBCAABABCCCCBABABCBAABBACCABBCBBBCCCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
1⤵
- Executes dropped EXE
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4dedcc23ead9f1deb92d347735f2d37875ff883863975c812f1d38e5ff8f9319
MD5 7f83b1137d8efc0e38d698f79ce16edd
SHA1 c2b91f3d0e22c6fd8540f102773eb799bd55a334
SHA512 d3506f158454faf105fe5c9dbf6e3a4a27ac3fb14681f9eaf92853907b0547965121e5b82fe616deda7d83274cb20082bdd9097e2c94caff54856d1bd0c434a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd6fbf9bf0d24ea42dba862d64e1169110fc56d21744fb0315ef7687b90a540f
MD5 7452e0afd1589d63a7f9e0ef28b26ae3
SHA1 307ae8069e99fdd2203ca9737f537babefd50a6c
SHA512 0328511109110a85304c39a81015c305b77bf9a73108277fb02de2389a89fc0edd3949e4adc02bd594ad271f27b0621939c913a86c654a98c236ec3e0619aa45
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a26446528cc12b923441b16497c9f300c16c7a6178b3fe9687a9975ce4165d4b
MD5 32b0064272acda3418cc4bb20e7c4bbb
SHA1 6d173646489ae309a0aa2051c7c3479cf9ff65f3
SHA512 74e5477b008981cda5251255543884b5a4aee11cd8c7559bf963b9ec2542944fbdc06dcb1ab5e06842ff8bcbefdac418e092fa060da5b90bbcef19cf9bc398e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 36883d28169efc0c98dd2fc5aa0e45e3beb4b188fc0d3f9f39e14e1827a45c0e
MD5 16024d98575f760ff2f25ad9b9904db1
SHA1 e3a7f9148d2e6f0bdb71650084da465a4b5251ee
SHA512 d0d5ee951996e627cfbc5741e14f08ade1e2c0a5fe75b56cc6a59dc3fc0bb9f10c02430d491f672fbf643371f05f8bd78dd7e70e7e6f7e0434022591d98a24a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ce1869cef461c9d84a12b146ad5af09cc3e0012c16a57af1644fd2473a4ae7cb
MD5 77a4b60d415170e5a7edb51338b37908
SHA1 925b1a08e41a4b519c8eb13d5f545c23f694204c
SHA512 a1b67e742603e79bab76ad3e3478ab639c380c3490f92d4bd538d7d6d21c162e6a541ea3cc964a75582e93268aa38a3a53df758691c955337f4c96d259bd052b
MD5 SHA1 SHA512

Submit Download

svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBAAACBBACCCACCCABCAABCCBABBCCABCCACAACCABCBCBAAA.exe
Size 2.2MB
SHA256 6ddea3865ecfef12110761e112afa1902c7a7ecee47308f4e9a9f309a79f730b
MD5 352f03a9bc5f8084b7f6a9fa14eab006
SHA1 3b5010b7a0ce9ed3e6f59eea529d47e4305851a4
SHA512 4f856cac76e2228a6c6421ee41b3ba8e32e03e3bd82e09acafb6bd0c85e8510b41af8a4795537c1d551cc4aa51b39b620b39a6c0a349a253b052754f6fbb8eaf
SSDEEP 49152:U+EO+EO+EO+EO+EO+EO+EhKjKWQc2b1FVgbjrjxPe1pbPSQm1Flo+LjphOt:sKjKWQckVgtev5mnlNLFe
TLSH
T103B5D00DF5D640B0D977517048DBD27A8A71B93187218EEBE789C63EAD33BD0A838B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-60-0x0000000005A60000-0x0000000005A61000-memory.dmp

Download

memory/2468-79-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4072-0-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/4072-7-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/4704-80-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/5076-36-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/5076-26-0x0000000000830000-0x0000000000851000-memory.dmp

Download