Analysis
- max time kernel
150s - max time network
144s - platform
windows7_x64 - resource
win7 - submitted
19/07/2020, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
chthonic_2.23.15.12.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
chthonic_2.23.15.12.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target chthonic_2.23.15.12.vir.exe
- Size 427KB
- Sample200719-48wrbmg9we
- SHA256 b6f9f9fa970bf7ec730e0944b1bb0ba8d17a3715de0730bc417aae149ae048dd
- MD5 8296372373a0e63024143e6beee29a82
- SHA1 4fae40c361e7f2da23a7984e06320b89cbad654d
- SHA512 3bf80ceb5cdb03fd5419741c4fabd293ab9003d972ef9bc329528664197287d81f03522d6b3852d480898f2477615d6178995bdc82bc1783978850a5b5647cce
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 672 wrote to memory of 776 672 chthonic_2.23.15.12.vir.exe 24 PID 672 wrote to memory of 776 672 chthonic_2.23.15.12.vir.exe 24 PID 672 wrote to memory of 776 672 chthonic_2.23.15.12.vir.exe 24 PID 672 wrote to memory of 776 672 chthonic_2.23.15.12.vir.exe 24 PID 672 wrote to memory of 776 672 chthonic_2.23.15.12.vir.exe 24 PID 672 wrote to memory of 776 672 chthonic_2.23.15.12.vir.exe 24 PID 672 wrote to memory of 776 672 chthonic_2.23.15.12.vir.exe 24 PID 672 wrote to memory of 776 672 chthonic_2.23.15.12.vir.exe 24 PID 776 wrote to memory of 1056 776 msiexec.exe 25 PID 776 wrote to memory of 1056 776 msiexec.exe 25 PID 776 wrote to memory of 1056 776 msiexec.exe 25 PID 776 wrote to memory of 1056 776 msiexec.exe 25 PID 1056 wrote to memory of 1532 1056 cmd.exe 27 PID 1056 wrote to memory of 1532 1056 cmd.exe 27 PID 1056 wrote to memory of 1532 1056 cmd.exe 27 PID 1056 wrote to memory of 1532 1056 cmd.exe 27 PID 1532 wrote to memory of 1832 1532 MozillaMaintenanceService1.exe 30 PID 1532 wrote to memory of 1832 1532 MozillaMaintenanceService1.exe 30 PID 1532 wrote to memory of 1832 1532 MozillaMaintenanceService1.exe 30 PID 1532 wrote to memory of 1832 1532 MozillaMaintenanceService1.exe 30 PID 1532 wrote to memory of 1832 1532 MozillaMaintenanceService1.exe 30 PID 1532 wrote to memory of 1832 1532 MozillaMaintenanceService1.exe 30 PID 1532 wrote to memory of 1832 1532 MozillaMaintenanceService1.exe 30 PID 1532 wrote to memory of 1832 1532 MozillaMaintenanceService1.exe 30 - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 776 msiexec.exe 776 msiexec.exe 1832 msiexec.exe - Loads dropped DLL 1 IoCs
pid Process 1056 cmd.exe - Executes dropped EXE 1 IoCs
pid Process 1532 MozillaMaintenanceService1.exe - Blacklisted process makes network request 11 IoCs
flow pid Process 3 776 msiexec.exe 6 776 msiexec.exe 7 776 msiexec.exe 8 776 msiexec.exe 9 776 msiexec.exe 10 776 msiexec.exe 11 776 msiexec.exe 14 776 msiexec.exe 15 776 msiexec.exe 16 776 msiexec.exe 17 776 msiexec.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\software\microsoft\windows\currentversion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\MozillaMaintenanceService1 = "C:\\Users\\Admin\\AppData\\Roaming\\MozillaMaintenanceService1\\MozillaMaintenanceService1.exe" msiexec.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 672 chthonic_2.23.15.12.vir.exe 776 msiexec.exe 1532 MozillaMaintenanceService1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.12.vir.exe"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.12.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
PID:672 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
PID:776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MozillaMaintenanceService1\MozillaMaintenanceService1.exe"3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Roaming\MozillaMaintenanceService1\MozillaMaintenanceService1.exeC:\Users\Admin\AppData\Roaming\MozillaMaintenanceService1\MozillaMaintenanceService1.exe4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1532 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1832
-
-
-
-