Analysis
- max time kernel
150s - max time network
124s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:48
Static task
static1
Behavioral task
behavioral1
Sample
citadel_3.1.0.0.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
citadel_3.1.0.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target citadel_3.1.0.0.vir.exe
- Size 307KB
- Sample200719-4twkr22ebs
- SHA256 1ec347934db2ded3a012479882732bfb3cdc85b0d4b2911e3402c1fa693a2235
- MD5 3d3ef329a4d920735fbc6c56d2a15691
- SHA1 74c7c9c8470ea55c04ee3c7fe168793ee32d4686
- SHA512 0e2d88ef2f8f8d1a65f63473e89c345cb73630efa5c717e7a8f721ae8703077d651ee66ee4756c4a4d6e6e1a007c6246b007c20689be195763353bcb7654c9ed
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 116 IoCs
pid Process 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe 3876 nyve.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2460 set thread context of 3456 2460 citadel_3.1.0.0.vir.exe 69 - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run nyve.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qazemu = "C:\\Users\\Admin\\AppData\\Roaming\\Luedo\\nyve.exe" nyve.exe - Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\MACHINE\Software\WOW6432Node\WINE nyve.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\WINE nyve.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 2460 citadel_3.1.0.0.vir.exe Token: SeSecurityPrivilege 2460 citadel_3.1.0.0.vir.exe Token: SeSecurityPrivilege 2460 citadel_3.1.0.0.vir.exe Token: SeSecurityPrivilege 2460 citadel_3.1.0.0.vir.exe - Executes dropped EXE 1 IoCs
pid Process 3876 nyve.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 71 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3876 2460 citadel_3.1.0.0.vir.exe 67 PID 2460 wrote to memory of 3876 2460 citadel_3.1.0.0.vir.exe 67 PID 2460 wrote to memory of 3876 2460 citadel_3.1.0.0.vir.exe 67 PID 3876 wrote to memory of 2692 3876 nyve.exe 51 PID 3876 wrote to memory of 2692 3876 nyve.exe 51 PID 3876 wrote to memory of 2692 3876 nyve.exe 51 PID 3876 wrote to memory of 2692 3876 nyve.exe 51 PID 3876 wrote to memory of 2692 3876 nyve.exe 51 PID 3876 wrote to memory of 2708 3876 nyve.exe 52 PID 3876 wrote to memory of 2708 3876 nyve.exe 52 PID 3876 wrote to memory of 2708 3876 nyve.exe 52 PID 3876 wrote to memory of 2708 3876 nyve.exe 52 PID 3876 wrote to memory of 2708 3876 nyve.exe 52 PID 3876 wrote to memory of 2836 3876 nyve.exe 55 PID 3876 wrote to memory of 2836 3876 nyve.exe 55 PID 3876 wrote to memory of 2836 3876 nyve.exe 55 PID 3876 wrote to memory of 2836 3876 nyve.exe 55 PID 3876 wrote to memory of 2836 3876 nyve.exe 55 PID 3876 wrote to memory of 2988 3876 nyve.exe 56 PID 3876 wrote to memory of 2988 3876 nyve.exe 56 PID 3876 wrote to memory of 2988 3876 nyve.exe 56 PID 3876 wrote to memory of 2988 3876 nyve.exe 56 PID 3876 wrote to memory of 2988 3876 nyve.exe 56 PID 3876 wrote to memory of 3140 3876 nyve.exe 57 PID 3876 wrote to memory of 3140 3876 nyve.exe 57 PID 3876 wrote to memory of 3140 3876 nyve.exe 57 PID 3876 wrote to memory of 3140 3876 nyve.exe 57 PID 3876 wrote to memory of 3140 3876 nyve.exe 57 PID 3876 wrote to memory of 3156 3876 nyve.exe 58 PID 3876 wrote to memory of 3156 3876 nyve.exe 58 PID 3876 wrote to memory of 3156 3876 nyve.exe 58 PID 3876 wrote to memory of 3156 3876 nyve.exe 58 PID 3876 wrote to memory of 3156 3876 nyve.exe 58 PID 3876 wrote to memory of 3356 3876 nyve.exe 59 PID 3876 wrote to memory of 3356 3876 nyve.exe 59 PID 3876 wrote to memory of 3356 3876 nyve.exe 59 PID 3876 wrote to memory of 3356 3876 nyve.exe 59 PID 3876 wrote to memory of 3356 3876 nyve.exe 59 PID 3876 wrote to memory of 3652 3876 nyve.exe 60 PID 3876 wrote to memory of 3652 3876 nyve.exe 60 PID 3876 wrote to memory of 3652 3876 nyve.exe 60 PID 3876 wrote to memory of 3652 3876 nyve.exe 60 PID 3876 wrote to memory of 3652 3876 nyve.exe 60 PID 3876 wrote to memory of 3692 3876 nyve.exe 64 PID 3876 wrote to memory of 3692 3876 nyve.exe 64 PID 3876 wrote to memory of 3692 3876 nyve.exe 64 PID 3876 wrote to memory of 3692 3876 nyve.exe 64 PID 3876 wrote to memory of 3692 3876 nyve.exe 64 PID 3876 wrote to memory of 2460 3876 nyve.exe 66 PID 3876 wrote to memory of 2460 3876 nyve.exe 66 PID 3876 wrote to memory of 2460 3876 nyve.exe 66 PID 3876 wrote to memory of 2460 3876 nyve.exe 66 PID 3876 wrote to memory of 2460 3876 nyve.exe 66 PID 2460 wrote to memory of 3456 2460 citadel_3.1.0.0.vir.exe 69 PID 2460 wrote to memory of 3456 2460 citadel_3.1.0.0.vir.exe 69 PID 2460 wrote to memory of 3456 2460 citadel_3.1.0.0.vir.exe 69 PID 2460 wrote to memory of 3456 2460 citadel_3.1.0.0.vir.exe 69 PID 2460 wrote to memory of 3456 2460 citadel_3.1.0.0.vir.exe 69 PID 2460 wrote to memory of 3456 2460 citadel_3.1.0.0.vir.exe 69 PID 2460 wrote to memory of 3456 2460 citadel_3.1.0.0.vir.exe 69 PID 2460 wrote to memory of 3456 2460 citadel_3.1.0.0.vir.exe 69 PID 3876 wrote to memory of 2540 3876 nyve.exe 70 PID 3876 wrote to memory of 2540 3876 nyve.exe 70 PID 3876 wrote to memory of 2540 3876 nyve.exe 70 PID 3876 wrote to memory of 2540 3876 nyve.exe 70 PID 3876 wrote to memory of 2540 3876 nyve.exe 70 PID 3876 wrote to memory of 1668 3876 nyve.exe 77 PID 3876 wrote to memory of 1668 3876 nyve.exe 77 PID 3876 wrote to memory of 1668 3876 nyve.exe 77 PID 3876 wrote to memory of 1668 3876 nyve.exe 77 PID 3876 wrote to memory of 1668 3876 nyve.exe 77 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Privacy citadel_3.1.0.0.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" citadel_3.1.0.0.vir.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2692
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2708
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2836
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\citadel_3.1.0.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\citadel_3.1.0.0.vir.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
PID:2460 -
C:\Users\Admin\AppData\Roaming\Luedo\nyve.exe"C:\Users\Admin\AppData\Roaming\Luedo\nyve.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Identifies Wine through registry keys
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp757f529d.bat"3⤵PID:3456
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2540
-
-
-
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3140
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3156
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3356
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3652
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵PID:3692
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵PID:3928
-
C:\Windows\System32\slui.exeC:\Windows\System32\slui.exe -Embedding1⤵PID:1668