1027585d5cdfe3bcad3dd38117459c220b6fe9da346ae5cd59790551d6dfcaa1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_8d02dec71b3d2bba7045cde11b307a62_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe
Size 6.6MB
Sample261101-228eyade78
SHA256 1027585d5cdfe3bcad3dd38117459c220b6fe9da346ae5cd59790551d6dfcaa1
MD5 8d02dec71b3d2bba7045cde11b307a62
SHA1 90597f6352ecb39195ab50eb9e28053e0a354c2c
SHA512 7202e6d024e708c415ff58bc518caf32caa9b83da5d5d80aa24dc4742d0be50ec3889c3dcb8b8e129dda38550a6f0c1d22df73f1d003220ce46010ae1f964706
SSDEEP 98304:+t+ww48YTRGrjsYrXa1PSELk/GEAUfZ82ub8GRprbGJ1y1xWcdGWLpDi5PdjDJiN:+xaELkaUfdOMeXdVlG5Fp+
TLSH
T13B661240B983C071E0FE24305175E6B6593CA9302FF4AED7A3891A392E709D9957DE3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5588	2026-14xkwpzw7699.exe

Executes dropped EXE 1 IoCs

pid	Process
5588	2026-14xkwpzw7699.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_8d02dec71b3d2bba7045cde11b307a62_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-14xkwpzw7699.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5588	2026-14xkwpzw7699.exe
5588	2026-14xkwpzw7699.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3744	2026-10-31_8d02dec71b3d2bba7045cde11b307a62_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 5588	3744	2026-10-31_8d02dec71b3d2bba7045cde11b307a62_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-31_8d02dec71b3d2bba7045cde11b307a62_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_8d02dec71b3d2bba7045cde11b307a62_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Users\Admin\AppData\Local\Temp\2026-14xkwpzw7699.exe
  "2026-14xkwpzw7699.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-14xkwpzw7699.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-14xkwpzw7699.exe
Size 6.6MB
SHA256 8f7c3a9bfabfa2237a09d3b327140286864154de2a26d1f6781be0f1644671ea
MD5 66671d04202dd7d43a5558f1bb60b234
SHA1 9880387b4d3f980b1346487eaa0c4bcfb20a61c0
SHA512 566055c3be1dd12eaecd314cd5e2f9c0cef19e6783dd6e800d04c5b6bf82c6ce5d6d081cc28fad9cb73986524107f9e404fc198888840dbde664493c5e7b7244
SSDEEP 98304:+t+ww48YTRGrjsYrXa1PSELk/GEAUfZ82ub8GRprbGJ1y1xWcdGWLpDi5PdjDJiN:+xaELkaUfdOMeXdVlG5Fp+
TLSH
T1E6661240B983C071E0FE24305175E6B6593CA9302FF4AED7A3891A392E709D9957DE3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfg.ini

Path C:\Users\Admin\AppData\Local\Temp\cfg.ini
Size 19B
SHA256 cb0acf9fffa067e1a6a3ad718e9e53a1c862991aca2dc88c82d653e609cf8520
MD5 185a4b6705f356e336defc8e086efad7
SHA1 b787122fb1bf05e9884ef6a2c4af9272c76a9e3f
SHA512 40496fb80a30ac21d356b999c13578bddcd7a7caef7bdabefeffce9077e2e8c3312ea53e535a37760a276455ff2bfced50f45e0f722054c3cba44860d23e1914
MD5 SHA1 SHA512

Submit Download

memory/3744-6-0x0000000000420000-0x00000000009AF000-memory.dmp

Download