Analysis
- max time kernel
150s - max time network
122s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:24
Static task
static1
Behavioral task
behavioral1
Sample
citadel_1.1.0.0.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
citadel_1.1.0.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target citadel_1.1.0.0.vir.exe
- Size 401KB
- Sample200719-3rnfybhh2j
- SHA256 fcce249643f7fe240695fdbc393b54a543fa4a49942b56ad8aad6f219c4f896d
- MD5 5abefe1af6518c5daccbe0833b75858b
- SHA1 0bc40dc4b0d380b42b2bfbd89eedfc9669be9367
- SHA512 e4cb2d745533dc2dd4efd360d7bebf8f5cbebe4572130d0e874e021629b2d58d43fd05f7b146d60e6b87bc16b7be7e86b69bf6dcb1c984fcb9251c6f1613f28f
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2920 citadel_1.1.0.0.vir.exe 3840 etfi.exe - Suspicious use of WriteProcessMemory 72 IoCs
description pid Process procid_target PID 2920 wrote to memory of 3556 2920 citadel_1.1.0.0.vir.exe 67 PID 2920 wrote to memory of 3556 2920 citadel_1.1.0.0.vir.exe 67 PID 2920 wrote to memory of 3556 2920 citadel_1.1.0.0.vir.exe 67 PID 2920 wrote to memory of 3556 2920 citadel_1.1.0.0.vir.exe 67 PID 2920 wrote to memory of 3556 2920 citadel_1.1.0.0.vir.exe 67 PID 2920 wrote to memory of 3556 2920 citadel_1.1.0.0.vir.exe 67 PID 2920 wrote to memory of 3556 2920 citadel_1.1.0.0.vir.exe 67 PID 2920 wrote to memory of 3556 2920 citadel_1.1.0.0.vir.exe 67 PID 3556 wrote to memory of 3840 3556 citadel_1.1.0.0.vir.exe 68 PID 3556 wrote to memory of 3840 3556 citadel_1.1.0.0.vir.exe 68 PID 3556 wrote to memory of 3840 3556 citadel_1.1.0.0.vir.exe 68 PID 3840 wrote to memory of 3800 3840 etfi.exe 69 PID 3840 wrote to memory of 3800 3840 etfi.exe 69 PID 3840 wrote to memory of 3800 3840 etfi.exe 69 PID 3840 wrote to memory of 3800 3840 etfi.exe 69 PID 3840 wrote to memory of 3800 3840 etfi.exe 69 PID 3840 wrote to memory of 3800 3840 etfi.exe 69 PID 3840 wrote to memory of 3800 3840 etfi.exe 69 PID 3840 wrote to memory of 3800 3840 etfi.exe 69 PID 3556 wrote to memory of 3772 3556 citadel_1.1.0.0.vir.exe 70 PID 3556 wrote to memory of 3772 3556 citadel_1.1.0.0.vir.exe 70 PID 3556 wrote to memory of 3772 3556 citadel_1.1.0.0.vir.exe 70 PID 3800 wrote to memory of 2784 3800 etfi.exe 53 PID 3800 wrote to memory of 2784 3800 etfi.exe 53 PID 3800 wrote to memory of 2784 3800 etfi.exe 53 PID 3800 wrote to memory of 2784 3800 etfi.exe 53 PID 3800 wrote to memory of 2784 3800 etfi.exe 53 PID 3800 wrote to memory of 2796 3800 etfi.exe 54 PID 3800 wrote to memory of 2796 3800 etfi.exe 54 PID 3800 wrote to memory of 2796 3800 etfi.exe 54 PID 3800 wrote to memory of 2796 3800 etfi.exe 54 PID 3800 wrote to memory of 2796 3800 etfi.exe 54 PID 3800 wrote to memory of 2848 3800 etfi.exe 55 PID 3800 wrote to memory of 2848 3800 etfi.exe 55 PID 3800 wrote to memory of 2848 3800 etfi.exe 55 PID 3800 wrote to memory of 2848 3800 etfi.exe 55 PID 3800 wrote to memory of 2848 3800 etfi.exe 55 PID 3800 wrote to memory of 2992 3800 etfi.exe 56 PID 3800 wrote to memory of 2992 3800 etfi.exe 56 PID 3800 wrote to memory of 2992 3800 etfi.exe 56 PID 3800 wrote to memory of 2992 3800 etfi.exe 56 PID 3800 wrote to memory of 2992 3800 etfi.exe 56 PID 3800 wrote to memory of 3136 3800 etfi.exe 57 PID 3800 wrote to memory of 3136 3800 etfi.exe 57 PID 3800 wrote to memory of 3136 3800 etfi.exe 57 PID 3800 wrote to memory of 3136 3800 etfi.exe 57 PID 3800 wrote to memory of 3136 3800 etfi.exe 57 PID 3800 wrote to memory of 3148 3800 etfi.exe 58 PID 3800 wrote to memory of 3148 3800 etfi.exe 58 PID 3800 wrote to memory of 3148 3800 etfi.exe 58 PID 3800 wrote to memory of 3148 3800 etfi.exe 58 PID 3800 wrote to memory of 3148 3800 etfi.exe 58 PID 3800 wrote to memory of 3360 3800 etfi.exe 59 PID 3800 wrote to memory of 3360 3800 etfi.exe 59 PID 3800 wrote to memory of 3360 3800 etfi.exe 59 PID 3800 wrote to memory of 3360 3800 etfi.exe 59 PID 3800 wrote to memory of 3360 3800 etfi.exe 59 PID 3800 wrote to memory of 3592 3800 etfi.exe 60 PID 3800 wrote to memory of 3592 3800 etfi.exe 60 PID 3800 wrote to memory of 3592 3800 etfi.exe 60 PID 3800 wrote to memory of 3592 3800 etfi.exe 60 PID 3800 wrote to memory of 3592 3800 etfi.exe 60 PID 3800 wrote to memory of 2552 3800 etfi.exe 64 PID 3800 wrote to memory of 2552 3800 etfi.exe 64 PID 3800 wrote to memory of 2552 3800 etfi.exe 64 PID 3800 wrote to memory of 2552 3800 etfi.exe 64 PID 3800 wrote to memory of 2552 3800 etfi.exe 64 PID 3800 wrote to memory of 532 3800 etfi.exe 78 PID 3800 wrote to memory of 532 3800 etfi.exe 78 PID 3800 wrote to memory of 532 3800 etfi.exe 78 PID 3800 wrote to memory of 532 3800 etfi.exe 78 PID 3800 wrote to memory of 532 3800 etfi.exe 78 - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2920 set thread context of 3556 2920 citadel_1.1.0.0.vir.exe 67 PID 3840 set thread context of 3800 3840 etfi.exe 69 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 3556 citadel_1.1.0.0.vir.exe Token: SeSecurityPrivilege 3556 citadel_1.1.0.0.vir.exe - Executes dropped EXE 2 IoCs
pid Process 3840 etfi.exe 3800 etfi.exe - Suspicious behavior: EnumeratesProcesses 146 IoCs
pid Process 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe 3800 etfi.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Razequ = "C:\\Users\\Admin\\AppData\\Roaming\\Ecet\\etfi.exe" etfi.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run etfi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\Currentversion\Run etfi.exe - Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE etfi.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\WINE etfi.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2784
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2796
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2848
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\citadel_1.1.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\citadel_1.1.0.0.vir.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\citadel_1.1.0.0.vir.exe昆㹠Ȝခ3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3556 -
C:\Users\Admin\AppData\Roaming\Ecet\etfi.exe"C:\Users\Admin\AppData\Roaming\Ecet\etfi.exe"4⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Roaming\Ecet\etfi.exe昆㹠Ȟခ5⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Identifies Wine through registry keys
PID:3800
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe8d12196.bat"4⤵PID:3772
-
-
-
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3136
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3148
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3360
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3592
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵PID:2552
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵PID:532