bbeaa86003be4d14ff5643c47d20ca8a44e4d7e655bda8a93439fbe7dd4e9066

General

Target
chthonic_2.23.17.8.vir.exe
Size 414KB
Sample200719-1sxpyhnd4x
SHA256 bbeaa86003be4d14ff5643c47d20ca8a44e4d7e655bda8a93439fbe7dd4e9066
MD5 1f9b928b344e22ea51231035d780c098
SHA1 b9fea85e753702620038d7ae498fe78360dddd1c
SHA512 a8cd355326908b9c4161e8df7c9177bd7210049a52009d77ab4b15388ab8d1721607cfffbc7666e5ca17d44d59d834f8e5d1696e7b1f932e7c4dce08ee66484d
MD5 SHA1 SHA512

Score

8^/10

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1976	1612	chthonic_2.23.17.8.vir.exe	26
PID 1612 wrote to memory of 1976	1612	chthonic_2.23.17.8.vir.exe	26
PID 1612 wrote to memory of 1976	1612	chthonic_2.23.17.8.vir.exe	26
PID 1612 wrote to memory of 1976	1612	chthonic_2.23.17.8.vir.exe	26
PID 1612 wrote to memory of 1976	1612	chthonic_2.23.17.8.vir.exe	26
PID 1612 wrote to memory of 1976	1612	chthonic_2.23.17.8.vir.exe	26
PID 1612 wrote to memory of 1976	1612	chthonic_2.23.17.8.vir.exe	26
PID 1612 wrote to memory of 1976	1612	chthonic_2.23.17.8.vir.exe	26
PID 1976 wrote to memory of 1844	1976	msiexec.exe	27
PID 1976 wrote to memory of 1844	1976	msiexec.exe	27
PID 1976 wrote to memory of 1844	1976	msiexec.exe	27
PID 1976 wrote to memory of 1844	1976	msiexec.exe	27
PID 1844 wrote to memory of 2004	1844	cmd.exe	29
PID 1844 wrote to memory of 2004	1844	cmd.exe	29
PID 1844 wrote to memory of 2004	1844	cmd.exe	29
PID 1844 wrote to memory of 2004	1844	cmd.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1976	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\antivirservice	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	msiexec.exe

Loads dropped DLL 3 IoCs

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1612	chthonic_2.23.17.8.vir.exe
1976	msiexec.exe

Deletes itself 1 IoCs

pid	Process
1976	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	Adobed.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\software\microsoft\windows\currentversion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobed = "C:\\Users\\Admin\\AppData\\Roaming\\Adobed\\Adobed.exe"	msiexec.exe