ec6b011c69f58039f6f4d2e6dcd0b32bb62305a5f66a1f29ca6e7cab109afb16

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_cf40d1cadbcbeaa8405fab8a1d0baa88_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe
Size 7.5MB
Sample261102-15vsksfx4m
SHA256 ec6b011c69f58039f6f4d2e6dcd0b32bb62305a5f66a1f29ca6e7cab109afb16
MD5 cf40d1cadbcbeaa8405fab8a1d0baa88
SHA1 63d5e31cc18ea51371c8b4882aadbeb763c90e9c
SHA512 734af3ab290b1a9145c5528dd6d2a402b87a3d2628354ccc5cad8765c10ea7a64863e20a703d223063fbaa27f314f5f1c74c267d5a22e89462fc630db087b39b
SSDEEP 98304:/t+ebVLdahr+YTRi0TGgU8oxKFK7JIhXa1PSELk/GEAUfZ82ub8GRprbGJ1y1xWo:Rh6hoeK71aELkaUfdOMeXdVlG5Fp+
TLSH
T1EB761200B983C072E0FF24315174E6B6593CA5302FF4AED7A3850A796F709D9967DA3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5912	2026-1Q439h.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_cf40d1cadbcbeaa8405fab8a1d0baa88_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-1Q439h.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5912	2026-1Q439h.exe
5912	2026-1Q439h.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4104	2026-11-02_cf40d1cadbcbeaa8405fab8a1d0baa88_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 5912	4104	2026-11-02_cf40d1cadbcbeaa8405fab8a1d0baa88_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-02_cf40d1cadbcbeaa8405fab8a1d0baa88_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_cf40d1cadbcbeaa8405fab8a1d0baa88_amadey_elex_hellokitty_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Users\Admin\AppData\Local\Temp\2026-1Q439h.exe
  "2026-1Q439h.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-1Q439h.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-1Q439h.exe
Size 7.5MB
SHA256 114f4875d68becee8cde00401509e606cd54ca7d340a9fecc00d6465b97a4540
MD5 136772f93828a08c2be07593cef9c193
SHA1 261c4ba85dd2d01176dca84fa2fd711f02dcc03d
SHA512 e247651b9efe97efe8cb5269906c1c90c243f4a4380b22a5fe303e3c43958636581113a4c5f0870f028bd6638bea9c4f1884b33f4d42e87ea2314b69e887bdbf
SSDEEP 98304:/t+ebVLdahr+YTRi0TGgU8oxKFK7JIhXa1PSELk/GEAUfZ82ub8GRprbGJ1y1xWo:Rh6hoeK71aELkaUfdOMeXdVlG5Fp+
TLSH
T131761200B983C072E0FF24315174E6B6593CA5302FF4AED7A3850A796F709D9967DA3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfg.ini

Path C:\Users\Admin\AppData\Local\Temp\cfg.ini
Size 19B
SHA256 a757b9bab3dd34f0283567193647931ccae9c5573140475117f5832477b5e187
MD5 265e071b553c5a497d36ecb30c27510b
SHA1 86695eb4a1b9aa1c074de154bdd7d869091c3425
SHA512 5d66c266edf6f3344ffdf6c062c220e57107ab0c35763fa52c976f62792ed1f1689256767d7fe6a1557d57b818eb891f253d7730553ecc0cf741e4213fc3684d
MD5 SHA1 SHA512

Submit Download

memory/4104-6-0x0000000000DB0000-0x00000000013EE000-memory.dmp

Download