d6324644c2a267bea0322c4f817b7a4029129e68959cdeb25f53f8e1f9ddeaad

General

Target

chthonic_2.23.12.10.vir.exe
Size

160KB
MD5

bd733b7cb157275ff7a2b2ff287589a0
SHA1

31eb1df25b5f1e799a451ea536f0674042bd19c8
SHA256

d6324644c2a267bea0322c4f817b7a4029129e68959cdeb25f53f8e1f9ddeaad
SHA512

b2341190d6a76e0d1f752f820a8f14f0a3b492e15c5d56a96a82c631e981f8b0e816287e8894ccb2966dc85f8440a6909a0b2f136d61080efcb00b148cf383bd

Score

10^/10

persistence evasion trojan

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

chthonic_2.23.12.10.vir.exe

pid process

1196 chthonic_2.23.12.10.vir.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1300 msiexec.exe
1300 msiexec.exe

pid	process
1196	chthonic_2.23.12.10.vir.exe

pid	process
1300	msiexec.exe
1300	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wWindowsPhotoViewer = "C:\\ProgramData\\Windows Photo Viewer\\wWindowsPhotoViewer.exe"	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

chthonic_2.23.12.10.vir.exe

description	pid	process	target process
PID 1196 wrote to memory of 1300	1196	chthonic_2.23.12.10.vir.exe	msiexec.exe
PID 1196 wrote to memory of 1300	1196	chthonic_2.23.12.10.vir.exe	msiexec.exe
PID 1196 wrote to memory of 1300	1196	chthonic_2.23.12.10.vir.exe	msiexec.exe
PID 1196 wrote to memory of 1300	1196	chthonic_2.23.12.10.vir.exe	msiexec.exe
PID 1196 wrote to memory of 1300	1196	chthonic_2.23.12.10.vir.exe	msiexec.exe
PID 1196 wrote to memory of 1300	1196	chthonic_2.23.12.10.vir.exe	msiexec.exe
PID 1196 wrote to memory of 1300	1196	chthonic_2.23.12.10.vir.exe	msiexec.exe
PID 1196 wrote to memory of 1300	1196	chthonic_2.23.12.10.vir.exe	msiexec.exe

Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

1300 msiexec.exe

pid	process
1300	msiexec.exe

Blacklisted process makes network request 11 IoCs

Processes:

msiexec.exe

flow	pid	process
1	1300	msiexec.exe
4	1300	msiexec.exe
5	1300	msiexec.exe
10	1300	msiexec.exe
11	1300	msiexec.exe
12	1300	msiexec.exe
13	1300	msiexec.exe
16	1300	msiexec.exe
17	1300	msiexec.exe
18	1300	msiexec.exe
19	1300	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.12.10.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.12.10.vir.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Adds policy Run key to start application
- Modifies Internet Explorer settings
- Deletes itself
- Blacklisted process makes network request
- System policy modification
- Checks whether UAC is enabled
PID:1300