bbeaa86003be4d14ff5643c47d20ca8a44e4d7e655bda8a93439fbe7dd4e9066

General

Target
chthonic_2.23.17.8.vir.exe
Size 414KB
Sample200719-1sxpyhnd4x
SHA256 bbeaa86003be4d14ff5643c47d20ca8a44e4d7e655bda8a93439fbe7dd4e9066
MD5 1f9b928b344e22ea51231035d780c098
SHA1 b9fea85e753702620038d7ae498fe78360dddd1c
SHA512 a8cd355326908b9c4161e8df7c9177bd7210049a52009d77ab4b15388ab8d1721607cfffbc7666e5ca17d44d59d834f8e5d1696e7b1f932e7c4dce08ee66484d
MD5 SHA1 SHA512

Score

8^/10

Loads dropped DLL 2 IoCs

pid	Process
2564	chthonic_2.23.17.8.vir.exe
2196	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2564	chthonic_2.23.17.8.vir.exe
2196	msiexec.exe

Deletes itself 1 IoCs

pid	Process
2196	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
3832	lite1.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\antivirservice	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2196	2564	chthonic_2.23.17.8.vir.exe	72
PID 2564 wrote to memory of 2196	2564	chthonic_2.23.17.8.vir.exe	72
PID 2564 wrote to memory of 2196	2564	chthonic_2.23.17.8.vir.exe	72
PID 2564 wrote to memory of 2196	2564	chthonic_2.23.17.8.vir.exe	72
PID 2196 wrote to memory of 2752	2196	msiexec.exe	73
PID 2196 wrote to memory of 2752	2196	msiexec.exe	73
PID 2196 wrote to memory of 2752	2196	msiexec.exe	73
PID 2752 wrote to memory of 3832	2752	cmd.exe	75
PID 2752 wrote to memory of 3832	2752	cmd.exe	75
PID 2752 wrote to memory of 3832	2752	cmd.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2196	msiexec.exe
2196	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\software\microsoft\windows\currentversion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\lite1 = "C:\\Users\\Admin\\AppData\\Roaming\\lite1\\lite1.exe"	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe