eb530402b07763a24a506d0e417e2459b38a6c31c67e9ccdc168df04aa6e1782

Analysis

max time kernel
298s
max time network
190s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/07/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kythy.exe
Size 2.0MB
Sample260705-sqffcac19t
SHA256 eb530402b07763a24a506d0e417e2459b38a6c31c67e9ccdc168df04aa6e1782
MD5 06b37b71347ae7cb43fe035fb9d5b2a6
SHA1 16066016b1f97c80c2e56a0c21e06d651c7466cf
SHA512 81b8deddff0a5eb5d72c6e318a617b76261ad0e343735f0000ba6f274b9831ee811d19993972cbafe9205cafdb48f0ba25d10180ff84735a4d6c3cac49c4ed7f
SSDEEP 49152:uuNbYQq2yWuAPv4pZ0oZ0dsbAhdJ6S29acD:bb0WuAyaOb59a
TLSH
T14995331817E490BDF4640B34E8F260A286307CA96B32959F36C5777A9E733E8757234B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2040	AutoIt3.exe
4344	AutoIt3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4344	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 4344	2040	AutoIt3.exe	86

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2040	AutoIt3.exe
2040	AutoIt3.exe
2040	AutoIt3.exe
2040	AutoIt3.exe
2040	AutoIt3.exe
2040	AutoIt3.exe
2040	AutoIt3.exe
2040	AutoIt3.exe
4344	AutoIt3.exe
4344	AutoIt3.exe
4344	AutoIt3.exe
4344	AutoIt3.exe
4344	AutoIt3.exe
4344	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2040	AutoIt3.exe
2040	AutoIt3.exe
2040	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2040	AutoIt3.exe
2040	AutoIt3.exe
2040	AutoIt3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 1444	464	kythy.exe	83
PID 464 wrote to memory of 2040	464	kythy.exe	85
PID 2040 wrote to memory of 4344	2040	AutoIt3.exe	86
PID 2040 wrote to memory of 4344	2040	AutoIt3.exe	86
PID 2040 wrote to memory of 4344	2040	AutoIt3.exe	86

C:\Users\Admin\AppData\Local\Temp\kythy.exe
"C:\Users\Admin\AppData\Local\Temp\kythy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SYSTEM32\at.exe
  at.exe
  2⤵
  PID:1444
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Custom.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Custom.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Custom.a3x
Size 1.4MB
SHA256 cdc5b74ece5df8ee4ab0e4ca2e56281e679d2f8d20e209a7488b1f58751d347c
MD5 5e94af95cdc509b916dd96e6611e0fef
SHA1 200acf0b72639e4e815ac07dbb25d486e6fbae19
SHA512 80772887e4593d4628499d662f7b88bd86aafb4ac83a7ce24ba535dd250ecd28ee2ebc5822e3fbf4ef7a6653e508d1c9ed6c73aa7e6070d75d290cb43d08268a
SSDEEP 24576:2gNXZQ35+0VQC2r8ctXXP0oXuM2JAaVSKZmvCdlIn6s5Ah8sbTzuRwVGr:5LQ8Dx1/SM+zNZmPF5aPbSr
TLSH
T10B65331EDFE646FC3C086D49F83978314681969EB173DAC46D4B2571E9897383A832CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2040-7-0x00007FFF0F070000-0x00007FFF0F268000-memory.dmp

Download

memory/2040-8-0x00000262242E0000-0x00000262242E1000-memory.dmp

Download

memory/4344-10-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-11-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-17-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-18-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-19-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-20-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-21-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-22-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-23-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-24-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-25-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download

memory/4344-27-0x0000013F1DC50000-0x0000013F1DE6A000-memory.dmp

Download