71c56135ee7c0687580e45acf51bef258c0c8d2c64c9a383e879f12457880191

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 22.5MB
Sample260910-ycql2sed89
SHA256 71c56135ee7c0687580e45acf51bef258c0c8d2c64c9a383e879f12457880191
MD5 1751b60b29c109698dd2e6fcee05309c
SHA1 d8918d570df478ad96f1a0dc25cd66a2b42b526c
SHA512 9ed7e423882b24ac4eec490fac0034a619028eab75548e29b3e54818e3a92137f3e6000800234169c689ea16dc859bbaa2dd4aac08cdff3f72866c29b92879c1
SSDEEP 98304:PKjKWQckVgtev5mnlNL7KjKWQckVgtev5mnlNLI:0KWQc0gEYnvLIKWQc0gEYnvLI
TLSH
T1D5378E06F9C24471E96701B10CDBD3BF8625BE218B228EE7E74DA72F6932FD16834255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
416	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
2012	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
6048	svchost_ABCCACCACBCCBCACABAABACCBABBAACCABBBCBCAABCBACCACAABAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAACABCBACACABBBCBACCBBBCCBBCABBCCABBCACAACCCCCCCBCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe"	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAACABAABBACBBBACABCCBBBCCAACBAABCCACBCBBCACCBBCBABABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCACCACBCCBCACABAABACCBABBAACCABBBCBCAABCBACCACAABAAA.exe"	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5704	sc.exe
2460	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4904	cmd.exe
5268	cmd.exe
3664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCACCACBCCBCACABAABACCBABBAACCABBBCBCAABCBACCACAABAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5916	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5916	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5916	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5916	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
416	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
416	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
416	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
416	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5916	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	416	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5916 wrote to memory of 4904	5916	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 4904 wrote to memory of 3944	4904	cmd.exe	94
PID 5916 wrote to memory of 5268	5916	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	95
PID 5268 wrote to memory of 5704	5268	cmd.exe	97
PID 5916 wrote to memory of 3664	5916	2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 3664 wrote to memory of 2460	3664	cmd.exe	100
PID 416 wrote to memory of 6000	416	svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_1751b60b29c109698dd2e6fcee05309c_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBACCABABAACBABCCCACAABCBCCCBABABCAABCBBBCCCCAAABACAABCCACBBAABAAABBCAACCCCBBABBCAAABBCBAACBACBCABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBACCABABAACBABCCCACAABCBCCCBABABCAABCBBBCCCCAAABACAABCCACBBAABAAABBCAACCCCBBABBCAAABBCBAACBACBCABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCCCAAABACCCACABCACACABAACBACAAABACABBBABABBCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe" start= auto displayName= "UserDataSvc_ACCCCCAAABACCCACABCACACABAACBACAAABACABBBABABBCCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCCCAAABACCCACABCACACABAACBACAAABACABBBABABBCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe" start= auto displayName= "UserDataSvc_ACCCCCAAABACCCACABCACACABAACBACAAABACABBBABABBCCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCCCAAABACCCACABCACACABAACBACAAABACABBBABABBCCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCCCAAABACCCACABCACACABAACBACAAABACABBBABABBCCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
1⤵
- Executes dropped EXE
PID:2012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACCACBCCBCACABAABACCBABBAACCABBBCBCAABCBACCACAABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACCACBCCBCACABAABACCBABBAACCABBBCBCAABCBACCACAABAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0dbc9f9cb66877b556081f8f1d9d37287eed76c529d4541f8cd9cbe51730427f
MD5 651e08f06afabeb782bb679802351a75
SHA1 596b2950dcdb6a921ba6e0cf763f382483bb8f86
SHA512 082d3a8e54f5b6c5b44b7a55e4c3f7ab48e1fc1116ac608ee56dc703d9b2cb2a5044282944bc3d738e7b68fd63a7bb844a530d836f9880685f2c99c248d4784c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f87bedf408a27849a21f5c0fb90a6b8669db7850501b23447497705d7e7a559f
MD5 c2aa4ffe5126b0edbd8b96c54e409339
SHA1 7801d30d6e71205fac0b767fb10b2fb9ea6907ba
SHA512 8f1bb49000439285c1ae2bb71068160f774db967f8141c2b56010dcc114b7de8c6597f621e4880675e088a3a11b1dbedf8b4c5be5e061812def14e16974c9377
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e8522ff828cb4d3b6107c165e41753859d722c1bec61428a7921e36435bd3c5
MD5 945ff09e48890c2040f9843cccc43ac7
SHA1 dd2a37faefd0c0dc166f60bbb34ceafb7bc91174
SHA512 aec16241981a9023097c0811afe443ca43d016edf0ba17a4041a0e012fb8438089e9f2eeb11fd4496d32f5f54ff1de76fc42e47a29da8df5ec957d8c6e879690
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 569b5b4484560341181a006af7a813e231f6d37c1bfc1b0f73c5a172f37f0b36
MD5 b9b9c723601a071592024f744badb9ee
SHA1 fa388433af419bf71b44fef34a154744c478f924
SHA512 bca4379b949d99617ef5501611ac35ee88fd49cddfbe7be0dcf1553c8e5cd4fb0153498f5712928f1bdafa97d8f9275bafc6b89383d130e4502606c51f381cb3
MD5 SHA1 SHA512

Submit Download

svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABBCBBCBABCCAAAAAACBBABBCBCACCBACCBBABABBCBBBBABAAA.exe
Size 22.5MB
SHA256 71c56135ee7c0687580e45acf51bef258c0c8d2c64c9a383e879f12457880191
MD5 1751b60b29c109698dd2e6fcee05309c
SHA1 d8918d570df478ad96f1a0dc25cd66a2b42b526c
SHA512 9ed7e423882b24ac4eec490fac0034a619028eab75548e29b3e54818e3a92137f3e6000800234169c689ea16dc859bbaa2dd4aac08cdff3f72866c29b92879c1
SSDEEP 98304:PKjKWQckVgtev5mnlNL7KjKWQckVgtev5mnlNLI:0KWQc0gEYnvLIKWQc0gEYnvLI
TLSH
T1D5378E06F9C24471E96701B10CDBD3BF8625BE218B228EE7E74DA72F6932FD16834255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-24-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/416-37-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/5916-0-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/5916-8-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download