Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10_x64 -
resource
win10 -
submitted
19-07-2020 17:28
General
-
Target
chthonic_0.3.29.0.vir.exe
-
Size
228KB
-
MD5
a9cedbccefb07a18d56a360be2aeb4bb
-
SHA1
ed6043735ef990b3b9fa5fd53df82b3e577fc02a
-
SHA256
51c8e10c77c9f131b207be4bff0e37a09cf4f24b3b941416ae22bc438d1730c4
-
SHA512
610670b89af3014d303e55f6d90dce22edb9f7ac74e4a9f7c73952875884074180500deb5b8d98ff8824f443de848cce22aee972c9bdd6a6faca588b9bd8ef06
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 116 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\chthonic_0.3.29.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\chthonic_0.3.29.0.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
-
C:\Users\Admin\AppData\Roaming\Adobe\xpersAdobe.exe"C:\Users\Admin\AppData\Roaming\Adobe\xpersAdobe.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
- Identifies Wine through registry keys
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp012d5d7f.bat"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp012d5d7f.bat
-
C:\Users\Admin\AppData\Roaming\Adobe\xpersAdobe.exe
-
C:\Users\Admin\AppData\Roaming\Adobe\xpersAdobe.exe
-
memory/3496-0-0x0000000000000000-mapping.dmp
-
memory/3740-3-0x0000000000000000-mapping.dmp