Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/10/2026, 09:28
Behavioral task
behavioral1
Sample
2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
- Size 2.0MB
- Sample261011-lfnkmsgw3j
- SHA256 3801e56506f0409cb207ef742080c01e87c321a009fe44ac64a87552e5c7081a
- MD5 8598616bccf533569472af63fda1d24e
- SHA1 b3b3f66e991e52787654778e5d1a06b631386733
- SHA512 40221863b7fdcfcc28a7527acc52b57e607c033d5d599647bf20be6e62756c2bbc5bcb1aa79cde93a4fcb5885725aab7d473904f39021e8e2a38e7618ad59737
- SSDEEP 49152:kWJE2ZctEafitmGYj+uYP4D2VPrXvqVY1rCEOjvnSd7fX2YXZ:VE2ZBaqaj+uYP4srfq+1bOrS91Z
- TLSH T13C95230175D294B9E7F35B30AC79C6A04EF8FC7049784ADF638429285F78980E978B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe -
resource yara_rule behavioral1/memory/4292-6-0x0000000000760000-0x0000000000BCE000-memory.dmp upx behavioral1/memory/4292-82-0x0000000000760000-0x0000000000BCE000-memory.dmp upx behavioral1/memory/4292-87-0x0000000000760000-0x0000000000BCE000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_es.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_sl.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_sw.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\GoogleUpdate.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_en.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_kn.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_sr.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_te.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_th.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_uk.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_zh-TW.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\psuser.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\GoogleUpdateCore.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_ar.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_no.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_zh-CN.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUTE56A.tmp 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_el.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_et.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_ja.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_mr.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_vi.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_iw.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_nl.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_pt-PT.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUME569.tmp\GoogleUpdateSetup.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_cs.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_en-GB.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_bg.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_ca.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdate.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_ms.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\psuser_64.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\GoogleCrashHandler64.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_es-419.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_it.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_lt.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_sk.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_de.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_fil.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_pt-BR.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\GoogleCrashHandler.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\GoogleUpdateHelper.msi 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_hi.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_lv.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_pl.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_ta.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\GoogleUpdateComRegisterShell64.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\psmachine_64.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_fa.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_fr.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_id.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_ml.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_ru.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_tr.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_am.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_da.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_fi.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_is.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_ko.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe File created C:\Program Files (x86)\Google\Temp\GUME569.tmp\goopdateres_ro.dll 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4292 2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_8598616bccf533569472af63fda1d24e_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4292