71c56135ee7c0687580e45acf51bef258c0c8d2c64c9a383e879f12457880191

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 22.5MB
Sample260910-ycql2sed89
SHA256 71c56135ee7c0687580e45acf51bef258c0c8d2c64c9a383e879f12457880191
MD5 1751b60b29c109698dd2e6fcee05309c
SHA1 d8918d570df478ad96f1a0dc25cd66a2b42b526c
SHA512 9ed7e423882b24ac4eec490fac0034a619028eab75548e29b3e54818e3a92137f3e6000800234169c689ea16dc859bbaa2dd4aac08cdff3f72866c29b92879c1
SSDEEP 98304:PKjKWQckVgtev5mnlNL7KjKWQckVgtev5mnlNLI:0KWQc0gEYnvLIKWQc0gEYnvLI
TLSH
T1D5378E06F9C24471E96701B10CDBD3BF8625BE218B228EE7E74DA72F6932FD16834255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4340	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
1780	svchost_CAAAACBAACCBBCCCAABACABCBBBACCACACCABCACAAACABAACCABCCC.exe
2488	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BACCCBAAACBCCBCBBAABCBCBABCCCBABCCCCCBABBACBABABBCAACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe"	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBBABACBABCBCBCACBBBBCABBBBAACCABBBBAAACCCBCBBCABCBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAAACBAACCBBCCCAABACABCBBBACCACACCABCACAAACABAACCABCCC.exe"	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3396	sc.exe
4296	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3260	cmd.exe
3124	cmd.exe
1036	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAACBAACCBBCCCAABACABCBBBACCACACCABCACAAACABAACCABCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1540	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1540	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1540	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1540	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4340	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
4340	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
4340	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
4340	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
1780	svchost_CAAAACBAACCBBCCCAABACABCBBBACCACACCABCACAAACABAACCABCCC.exe
1780	svchost_CAAAACBAACCBBCCCAABACABCBBBACCACACCABCACAAACABAACCABCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4340	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
Token: SeDebugPrivilege	1780	svchost_CAAAACBAACCBBCCCAABACABCBBBACCACACCABCACAAACABAACCABCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
652	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3124	1540	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	95
PID 3124 wrote to memory of 572	3124	cmd.exe	97
PID 4340 wrote to memory of 5040	4340	svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe	99
PID 5040 wrote to memory of 5004	5040	notepad.exe	100
PID 1540 wrote to memory of 1036	1540	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	104
PID 1036 wrote to memory of 3396	1036	cmd.exe	106
PID 1540 wrote to memory of 3260	1540	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	107
PID 3260 wrote to memory of 4296	3260	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBCBACCACCCBCCAACBBBBCABABCACCAABCCBABCCBCAACCABBBAABACAAABBBBBCBCBBBABABABBAAAACBABACCACACCBCCAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBCBACCACCCBCCAACBBBBCABABCACCAABCCBABCCBCAACCABBBAABACAAABBBBBCBCBBBABABABBAAAACBABACCACACCBCCAACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACCACABCAACBBCCBBABBABCACCCCABBCABCCABBBBCCCACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe" start= auto displayName= "UserDataSvc_BCACCACABCAACBBCCBBABBABCACCCCABBCABCCABBBBCCCACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACCACABCAACBBCCBBABBABCACCCCABBCABCCABBBBCCCACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe" start= auto displayName= "UserDataSvc_BCACCACABCAACBBCCBBABBABCACCCCABBCABCCABBBBCCCACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACCACABCAACBBCCBBABBABCACCCCABBCABCCABBBBCCCACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACCACABCAACBBCCBBABBABCACCCCABBCABCCABBBBCCCACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBAACCBBCCCAABACABCBBBACCACACCABCACAAACABAACCABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBAACCBBCCCAABACABCBBBACCACACCABCACAAACABAACCABCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
1⤵
- Executes dropped EXE
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f62232dcf4d8c14ffb5ed53c8eec746e95849c331e32dfe8cb22b48fb0db1896
MD5 f6595656671d7b3a02ad3a2bbd3358be
SHA1 217ff7deb82f4f3e8439d0613b8504b592bd97eb
SHA512 0db2f322ced6492cf8deb53b9e6a3e277c7b69edf004f21be5c864327df92c261ed730bbefd4f9be03bb8023381f5eafa34d63f899bf7141bd2cbe30b730c0de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2037757088562e1739da550da955214b5838faf631a0351d3f8b386ab2e5aaad
MD5 a76774be14d03b41f87a84d0dbe2163e
SHA1 c82f4c96cd509bf3ae8ba88f0543801024d68b1a
SHA512 ce365d6ff1e274db4058039b4a429b6afacfcfa98a70067ec2bc11a2c4ebb3377e2df79093a27decff937013fb5fb8a56f2e294da12077f08b6cea3fa94db8e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0ad924a781e5093016235d9b4f5c56261a7d621cf6ef1eca120aa737c0a6a905
MD5 e197bbed164bebfb470ffe7aad289517
SHA1 c16f63993cfe9e304293ecbda209500ab2492c21
SHA512 b238506284a399335b09720d3bc3fcc4a298674c54dad4c721b9a94d9dc8489f9c4305deecc5f62242b2a324e54da77e6bde1699d4dc5a771b1ef8a7d183f829
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bb2c09d9dd939bfc35392d4d7f1765b271df6953eae5dab4a7d1a403d879c388
MD5 11c4911982b744f18d6a35a6ac7d8d23
SHA1 59bbb13878bd7765c3b3e6f1728851baf6142fa6
SHA512 c7b3b9ca03f5bb8acaf4eaa863cb103bf0d1997b4a2972ea90254fcb263c3b0e24b8a3d829bcf8305fea240e639e7a208120966930eec7ac9becba8492bdc76a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d2abefac078b8427880ff80ce5ccab6f3bd08867ea76ee6cd041841cbe8c6ab4
MD5 294ca479e057a1ced7da3591c97e5470
SHA1 11781dea3cea2fb5d73002d48a77a3b4c29ab03f
SHA512 82abc43f312caa5327bb6aabb44517d24d43e65a2923440fb4e7230f3d92564814e77b4f83f1eb845ee1d501d68715bad5433031237fe0ab83f26fec6893486a
MD5 SHA1 SHA512

Submit Download

svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCABACBCABACCBABAABAABAAACBBCABABCAACABCAAABCCABABBB.exe
Size 22.5MB
SHA256 71c56135ee7c0687580e45acf51bef258c0c8d2c64c9a383e879f12457880191
MD5 1751b60b29c109698dd2e6fcee05309c
SHA1 d8918d570df478ad96f1a0dc25cd66a2b42b526c
SHA512 9ed7e423882b24ac4eec490fac0034a619028eab75548e29b3e54818e3a92137f3e6000800234169c689ea16dc859bbaa2dd4aac08cdff3f72866c29b92879c1
SSDEEP 98304:PKjKWQckVgtev5mnlNL7KjKWQckVgtev5mnlNLI:0KWQc0gEYnvLIKWQc0gEYnvLI
TLSH
T1D5378E06F9C24471E96701B10CDBD3BF8625BE218B228EE7E74DA72F6932FD16834255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 5693c51384d53694f5de1a8e465beb4be3eb91267df0cf96a1f5b7688578cb7e
MD5 9f6ea92eef075cd09908086699adbff3
SHA1 6aa0471bceaf6892bf656f1dc5c4b0bca494fef9
SHA512 6de9608a4e830cdeeaea5110dc613bd88916daf165eb39e62ef558f40e606de3d15c2559417c43eae7f1216cc821043624b659aba1374d0e5b5bb6d9d31b2280
TLSH
T19211C161F065DC23F2322CD75629AB472CF6375FAC5CABA423044618A715D3ACE158F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1540-24-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/1540-50-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/1540-74-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/1540-11-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/1540-0-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/1540-106-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/1780-107-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/2488-115-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/4340-36-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/4340-75-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/4340-51-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/4340-114-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/5040-78-0x0000000004E60000-0x0000000004E61000-memory.dmp

Download