52d821d8e86473f0a69a044741e9f64b68a4f1677a298f292a560aae740f286c

General

Target

chthonic_2.0.5.0.vir.exe
Size

88KB
MD5

77b42fb633369de146785c83270bb289
SHA1

db21636a6e3784701cd41ffa60398a5f110cec10
SHA256

52d821d8e86473f0a69a044741e9f64b68a4f1677a298f292a560aae740f286c
SHA512

99be184430c0d1d0d078cf27fbed9936fe533b1e980d320467af6d9d8073ce1ce89c50be8e4f8ee571e910d25596b87cccb839cbcc774e350d6b2a5715da39cf

Score

10^/10

evasion trojan persistence

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

chthonic_2.0.5.0.vir.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1020	chthonic_2.0.5.0.vir.exe
Token: SeBackupPrivilege	1020	chthonic_2.0.5.0.vir.exe
Token: SeRestorePrivilege	1020	chthonic_2.0.5.0.vir.exe
Token: SeDebugPrivilege	1624	msiexec.exe
Token: SeBackupPrivilege	1624	msiexec.exe
Token: SeRestorePrivilege	1624	msiexec.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1242322730 = "C:\\PROGRA~3\\msnlnnej.exe"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

chthonic_2.0.5.0.vir.exemsiexec.exe

pid process

1020 chthonic_2.0.5.0.vir.exe
1624 msiexec.exe
1624 msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

chthonic_2.0.5.0.vir.exe

description	pid	process	target process
PID 1020 wrote to memory of 1624	1020	chthonic_2.0.5.0.vir.exe	msiexec.exe
PID 1020 wrote to memory of 1624	1020	chthonic_2.0.5.0.vir.exe	msiexec.exe
PID 1020 wrote to memory of 1624	1020	chthonic_2.0.5.0.vir.exe	msiexec.exe
PID 1020 wrote to memory of 1624	1020	chthonic_2.0.5.0.vir.exe	msiexec.exe
PID 1020 wrote to memory of 1624	1020	chthonic_2.0.5.0.vir.exe	msiexec.exe
PID 1020 wrote to memory of 1624	1020	chthonic_2.0.5.0.vir.exe	msiexec.exe
PID 1020 wrote to memory of 1624	1020	chthonic_2.0.5.0.vir.exe	msiexec.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

chthonic_2.0.5.0.vir.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\WINE	chthonic_2.0.5.0.vir.exe
Key opened	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\WINE	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "0"	msiexec.exe

Suspicious behavior: MapViewOfSection 23 IoCs

Processes:

chthonic_2.0.5.0.vir.exemsiexec.exe

pid	process
1020	chthonic_2.0.5.0.vir.exe
1020	chthonic_2.0.5.0.vir.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe

Blacklisted process makes network request 12 IoCs

Processes:

msiexec.exe

flow	pid	process
3	1624	msiexec.exe
4	1624	msiexec.exe
5	1624	msiexec.exe
7	1624	msiexec.exe
8	1624	msiexec.exe
9	1624	msiexec.exe
11	1624	msiexec.exe
12	1624	msiexec.exe
14	1624	msiexec.exe
16	1624	msiexec.exe
17	1624	msiexec.exe
18	1624	msiexec.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

msiexec.exe

pid process

1624 msiexec.exe
Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\PROGRA~3\msnlnnej.exe msiexec.exe

pid	process
1624	msiexec.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\msnlnnej.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.0.5.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.0.5.0.vir.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Identifies Wine through registry keys
- Suspicious behavior: MapViewOfSection
PID:1020

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- System policy modification
- Suspicious behavior: MapViewOfSection
- Blacklisted process makes network request
- Suspicious behavior: RenamesItself
- Drops file in Program Files directory
PID:1624