47398d02041a13233afab494eebd3e99545f98ec3776c92313539b36d6364792

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_fd52a0cec69b33fd3dfc90bb5b7ddfca_amadey_elex_hellokitty_karagany_luca-stealer_njrat_redli.exe
Size 54.9MB
Sample261027-bf4azshx2s
SHA256 47398d02041a13233afab494eebd3e99545f98ec3776c92313539b36d6364792
MD5 fd52a0cec69b33fd3dfc90bb5b7ddfca
SHA1 8e0c46c1951e665a4ae481fdbc58c157f5b64291
SHA512 1452505fd9f75b0f235f59fe9b9661e8c0a9e6c836715aa93a90f05d543e6657ae8363a95672271465d557663ab8e9918aa95f13eaa26584c75000cd550733af
SSDEEP 1572864:9AwN7MzDaWymAcrQj1Po1DhW7bs5tbbsOPPBOIwi:9vMzDSm/rQjFUW/Ib3nwi
TLSH
T165C733416284E038E68101381AEB06FB6F3BBCB4E75249E31BDD7A597C446D395373AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4f0-4.dat	UPX
behavioral2/memory/2628-10-0x0000000000D20000-0x000000000110A000-memory.dmp	UPX
behavioral2/memory/2628-76-0x0000000000D20000-0x000000000110A000-memory.dmp	UPX
behavioral2/memory/2628-77-0x0000000000D20000-0x000000000110A000-memory.dmp	UPX
behavioral2/memory/2628-80-0x0000000000D20000-0x000000000110A000-memory.dmp	UPX

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c4f0-4.dat	upx
behavioral2/memory/2628-10-0x0000000000D20000-0x000000000110A000-memory.dmp	upx
behavioral2/memory/2628-76-0x0000000000D20000-0x000000000110A000-memory.dmp	upx
behavioral2/memory/2628-77-0x0000000000D20000-0x000000000110A000-memory.dmp	upx
behavioral2/memory/2628-80-0x0000000000D20000-0x000000000110A000-memory.dmp	upx

Executes dropped EXE 2 IoCs

pid	Process
2628	irsetup.exe
5848	GetMachineSID.exe

Loads dropped DLL 2 IoCs

pid	Process
2628	irsetup.exe
2628	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	irsetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	irsetup.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_fd52a0cec69b33fd3dfc90bb5b7ddfca_amadey_elex_hellokitty_karagany_luca-stealer_njrat_redli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GetMachineSID.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	irsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main	irsetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	irsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	irsetup.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2628	irsetup.exe
2628	irsetup.exe
2628	irsetup.exe
2628	irsetup.exe
2628	irsetup.exe
2628	irsetup.exe
2628	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2628	1596	2026-10-26_fd52a0cec69b33fd3dfc90bb5b7ddfca_amadey_elex_hellokitty_karagany_luca-stealer_njrat_redli.exe	90
PID 2628 wrote to memory of 4508	2628	irsetup.exe	91
PID 2628 wrote to memory of 5848	2628	irsetup.exe	93

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	irsetup.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-26_fd52a0cec69b33fd3dfc90bb5b7ddfca_amadey_elex_hellokitty_karagany_luca-stealer_njrat_redli.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_fd52a0cec69b33fd3dfc90bb5b7ddfca_amadey_elex_hellokitty_karagany_luca-stealer_njrat_redli.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1803698 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2026-10-26_fd52a0cec69b33fd3dfc90bb5b7ddfca_amadey_elex_hellokitty_karagany_luca-stealer_njrat_redli.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-2714045687-1127350534-2056456672-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" export HKLM\Software\Stardock C:\Users\Admin\AppData\Local\Temp\registry_export.txt /y /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe" C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Encoding.lmd

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Encoding.lmd
Size 393KB
SHA256 d0b2fa60e707982899ecd8c4dc462721c82491245b26721a7c0e840c5f557aed
MD5 6eec47ab86d212fe3ed0f56985c8e817
SHA1 06da90bcc06c73ce2c7e112818af65f66fcae6c3
SHA512 36d6ef8a3fecb2c423079cadbfcbe2b044095f641c9a6ce0f9d0e96c6400f00a089aa26cc9d361bfdbcfdc3a8487d18d64956b36f39320648d1ddb565221a9cb
SSDEEP 6144:Jn49uVamRTBkNYZ1qrgUDtBfOGj3ruHkFB2t6SyoYkQe9ANuiRv1:ZSc3ZBkA1qUUXfP2XzYkQOcuiRd
TLSH
T139842395E52A115CE47882BF4EC3AECF43B878014E484F1E1AD189197CDEBF59257E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetMachineSID.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
Size 58KB
SHA256 723adae0e69127a6bfbc65c5ef552a351264205ea5e2bc3b80e505feaa5d0e43
MD5 55bbf335f75f2a2fe0a5daf603964d41
SHA1 f1b9686e8a9f10682722fc5e08c02c016b597804
SHA512 af49055234cb4a0ddbc68212db094c7a7a1058ccf6a1a5830238fe3ff96fa35390d242322436839d6d7e419bd9e4ad8962e213222470625cffb46423dec44db6
SSDEEP 768:Ss62anwZWdmSDvNHhf97jWvoI6TKqoRkePfP4ED2AnIBPZ0wdC04oEPg+:82aFdL7DdjWvw/oRRPn7It1Cl4+
TLSH
T158436D163A90C032E5535A304DB4D2A25F7BBD6265B5864F3BD803BE9FB13C06E2935B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetMachineSID.tmp

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp
Size 41B
SHA256 272f108de3f98eeb4af3232ec221884afb30f0bd47a7be9113c5ada8a9166a0a
MD5 f5294f40611fc54de0cb804b3dd766dc
SHA1 502ec8f11bfce2b19752580417413c0a3fea5b2d
SHA512 105c50133451f932c153f25a7cc0da167f407a226b4514bb3681967bac0b5d8b92ee6ba730b4fee61fae4100148b5e584712694ce26ac95ddd060343d89e0d14
MD5 SHA1 SHA512

Submit Download

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMP
Size 98KB
SHA256 455681c51c499cd3c5f1789a82e6717e94d33e912f9add0892c678d137ebf03e
MD5 43466ed7f8bc6a516e384af7402b80cc
SHA1 9d9d17d5e5109b1e10a13c142818bf4f10a5a836
SHA512 fc7dcfbdf1a14531e9a99baa14afe81a642e94dfe972617463ec0b1b9ba6291aa184a15fe4b9e77c1896bd9f5fe29126fdef3cf3b7c8459e12aae6b269995d6c
SSDEEP 24:GpUz0BShugDBFpAE3GR4BG9zDfhkWi1qVgrmKD/6Ege7MBSaviw+4uyBK6gejFJC:D
TLSH
T160A3AF417119B0A9DD3C823CC8F8F396908ABCCA6E6DF9B1FB77339915F6102C999944
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stardock EULA.html

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Stardock EULA.html
Size 28KB
SHA256 9f7358e2b84b39de6e58c79411eae6fb68ad97a30ea171daa7a217ff6b4665d6
MD5 a22e40c21c94e671c1589a9b595902c7
SHA1 6cba5593959a7d456fb69a122da88ac14e5ebe1f
SHA512 50b5aaf9419cb85608e029f51e0a8f17f7ace496a8ca2a738f67cfc69983e0888afe63b030bdc1172601bdf0cff58caa08bb00b52ce6e81d1c751707ecf85ea7
SSDEEP 768:uXLyW67qI/inwkCElbg0RZkBnobwSJvh1zpkwL/L:uXLyW67qI/inwkCEhNZkBRSP1zpzD
TLSH
T1B0D2EB267611233266B30361A51A66C2F612D16F733A5585307E910E3FB3E76C3FB68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.2MB
SHA256 6e48c7a94c709fb4d8dc280c256adbf9180a2ebbc3ad31eea0a39ec7f0a47bfb
MD5 3f63dbe73bbb854d12a7c85baa13bc78
SHA1 484276666d707c97078f51b13559b35103f39b01
SHA512 be268456d9d7b95f408f174dcd901092a6749a4fc9d5d8cac4b2a2de57be5d04101102321e2b8b6f0147a881e877069eb15f62883742f93d81e6d61cd052e3c1
SSDEEP 24576:KgREWuIhBlB7eMR53ylaUxlbka0R/FzVfzdPqIGx95zVSpwAz:vWIhnJ5iopRGx9rSCA
TLSH
T1EC4533C0F31890ACC16E9A316F657E13B923BE2A9E1D57537BCC784943621C9A3E7254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Size 326KB
SHA256 e6cb42ce5a0245dcaf635cd2950b2811ae5f4990cbc11126e2e8e769556144ab
MD5 ecc57f7d6507c2cb63aeb1f9d18210d3
SHA1 54fdc4c48690fbc118cadcd119b2c67f5584b4a9
SHA512 1d24e9b2edd9a76df666f643b592c47439b583b96cab6979a6cf0675e4c0d3b8266227d0ebd6df28f4ed3ad6972a4e9b4b9c080ef8e89d25eb5d033b89b828e2
SSDEEP 6144:9pF7LK5bwfYggoCQxltnoqhMQ3WxAOj+JzOgm37h:17Igvnoz0Wx8x07h
TLSH
T1F464AE02B293C072D59600B90569D7BA4E7A79714776D4F7AFD01AAD8E203E0EB3734E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2628-26-0x0000000007770000-0x0000000007773000-memory.dmp

Download

memory/2628-25-0x0000000010000000-0x0000000010144000-memory.dmp

Download

memory/2628-10-0x0000000000D20000-0x000000000110A000-memory.dmp

Download

memory/2628-76-0x0000000000D20000-0x000000000110A000-memory.dmp

Download

memory/2628-78-0x0000000010000000-0x0000000010144000-memory.dmp

Download

memory/2628-77-0x0000000000D20000-0x000000000110A000-memory.dmp

Download

memory/2628-79-0x0000000007770000-0x0000000007773000-memory.dmp

Download

memory/2628-80-0x0000000000D20000-0x000000000110A000-memory.dmp

Download

memory/2628-85-0x0000000010000000-0x0000000010144000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads