74544a16f620605e4812a5e1b9615388f2daafe0af8d96060d1d0a289cc3c656

Resubmissions

20-12-2024 03:49

241220-edjqcaynaz 10

20-12-2024 03:47

241220-ecbcksymgz 10

Analysis

max time kernel
224s
max time network
301s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
20-12-2024 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kthmimu.exe
Size

5.2MB
MD5

3edcde37dcecb1b5a70b727ea36521de
SHA1

0f2df3cae00d30300e6958bb9e9cda2758f9b1c9
SHA256

366b32c15ff2b30da5cafc1407e6dc49aa4bbecffc34c438302022acd1c00b8e
SHA512

16ec6b58a1d0f3fdbb9940245612aea4a8d6024ca71a9393ad2cc48dabd1575444c0d8d98992217d4526eb830523008d7e4961b3653db842c85f0dec4270d791
SSDEEP

98304:/RLRLj41OH4wAIOF+kmcIxJr+fx3k/sc37gz+li0pjY3l50XYarT:nj417x3Msc8Kli0JUuXYa3

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3344	kthmimu.exe
Token: SeLockMemoryPrivilege	3344	kthmimu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3344	kthmimu.exe

C:\Users\Admin\AppData\Local\Temp\kthmimu.exe
"C:\Users\Admin\AppData\Local\Temp\kthmimu.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=3204,i,3154206195988791752,9697906671389759283,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
1⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4840,i,3154206195988791752,9697906671389759283,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:8
1⤵
PID:5000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3344-0-0x000001F5E5660000-0x000001F5E5680000-memory.dmp

Filesize
128KB

Download
memory/3344-2-0x000001F5E56B0000-0x000001F5E56D0000-memory.dmp

Filesize
128KB

Download
memory/3344-5-0x000001F5E5730000-0x000001F5E5750000-memory.dmp

Filesize
128KB

Download
memory/3344-9-0x000001F678D60000-0x000001F678D80000-memory.dmp

Filesize
128KB

Download
memory/3344-8-0x000001F5E5710000-0x000001F5E5730000-memory.dmp

Filesize
128KB

Download
memory/3344-7-0x000001F678B30000-0x000001F678B50000-memory.dmp

Filesize
128KB

Download
memory/3344-6-0x000001F5E5750000-0x000001F5E5770000-memory.dmp

Filesize
128KB

Download
memory/3344-4-0x000001F5E56F0000-0x000001F5E5710000-memory.dmp

Filesize
128KB

Download
memory/3344-3-0x000001F5E56D0000-0x000001F5E56F0000-memory.dmp

Filesize
128KB

Download
memory/3344-16-0x000001F679EF0000-0x000001F679F10000-memory.dmp

Filesize
128KB

Download
memory/3344-18-0x000001F679F10000-0x000001F679F30000-memory.dmp

Filesize
128KB

Download
memory/3344-17-0x000001F679ED0000-0x000001F679EF0000-memory.dmp

Filesize
128KB

Download
memory/3344-15-0x000001F679A80000-0x000001F679AA0000-memory.dmp

Filesize
128KB

Download
memory/3344-14-0x000001F679A60000-0x000001F679A80000-memory.dmp

Filesize
128KB

Download
memory/3344-13-0x000001F679620000-0x000001F679640000-memory.dmp

Filesize
128KB

Download
memory/3344-12-0x000001F6793F0000-0x000001F679410000-memory.dmp

Filesize
128KB

Download
memory/3344-11-0x000001F6791A0000-0x000001F6791C0000-memory.dmp

Filesize
128KB

Download
memory/3344-10-0x000001F6793D0000-0x000001F6793F0000-memory.dmp

Filesize
128KB

Download
memory/3344-19-0x000001F5E56D0000-0x000001F5E56F0000-memory.dmp

Filesize
128KB

Download
memory/3344-24-0x000001F5E5710000-0x000001F5E5730000-memory.dmp

Filesize
128KB

Download
memory/3344-23-0x000001F678B30000-0x000001F678B50000-memory.dmp

Filesize
128KB

Download
memory/3344-22-0x000001F5E5750000-0x000001F5E5770000-memory.dmp

Filesize
128KB

Download
memory/3344-21-0x000001F5E5730000-0x000001F5E5750000-memory.dmp

Filesize
128KB

Download
memory/3344-20-0x000001F5E56F0000-0x000001F5E5710000-memory.dmp

Filesize
128KB

Download
memory/3344-31-0x000001F679A80000-0x000001F679AA0000-memory.dmp

Filesize
128KB

Download
memory/3344-30-0x000001F679A60000-0x000001F679A80000-memory.dmp

Filesize
128KB

Download
memory/3344-29-0x000001F679620000-0x000001F679640000-memory.dmp

Filesize
128KB

Download
memory/3344-28-0x000001F6793F0000-0x000001F679410000-memory.dmp

Filesize
128KB

Download
memory/3344-27-0x000001F6791A0000-0x000001F6791C0000-memory.dmp

Filesize
128KB

Download
memory/3344-26-0x000001F6793D0000-0x000001F6793F0000-memory.dmp

Filesize
128KB

Download
memory/3344-25-0x000001F678D60000-0x000001F678D80000-memory.dmp

Filesize
128KB

Download
memory/3344-32-0x000001F679EF0000-0x000001F679F10000-memory.dmp

Filesize
128KB

Download
memory/3344-34-0x000001F679F10000-0x000001F679F30000-memory.dmp

Filesize
128KB

Download
memory/3344-33-0x000001F679ED0000-0x000001F679EF0000-memory.dmp

Filesize
128KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads