0e3418c1fe660e17a43e8f7568f72d0e21fbed0a52f0e69e4c93b62e3cac3f1a | Triage

Analysis

max time kernel
126s
max time network
126s
platform
windows10_x64
resource
win10
submitted
19-07-2020 16:34

Sharing

Report Analysis Logs

General

Target

chthonic_2.1.4.0.vir.exe
Size

188KB
MD5

42104ac17c4438f016128b643c67e164
SHA1

679699cd53fa56cd89d2f98806a42d78efb3748a
SHA256

0e3418c1fe660e17a43e8f7568f72d0e21fbed0a52f0e69e4c93b62e3cac3f1a
SHA512

70e3d23fe1888e4a438f174c4720eb517cfde01c3b3116f1eb8ebd13e5413cfeca53e0a2da83ce63971620e22a0d986b53b86afa2adbc51598bee832bf13cf33

Score

5^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

chthonic_2.1.4.0.vir.exe

pid process

3884 chthonic_2.1.4.0.vir.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

chthonic_2.1.4.0.vir.exe

description	pid	process	target process
PID 3884 wrote to memory of 3300	3884	chthonic_2.1.4.0.vir.exe	chthonic_2.1.4.0.vir.exe
PID 3884 wrote to memory of 3300	3884	chthonic_2.1.4.0.vir.exe	chthonic_2.1.4.0.vir.exe
PID 3884 wrote to memory of 3300	3884	chthonic_2.1.4.0.vir.exe	chthonic_2.1.4.0.vir.exe
PID 3884 wrote to memory of 3300	3884	chthonic_2.1.4.0.vir.exe	chthonic_2.1.4.0.vir.exe
PID 3884 wrote to memory of 3300	3884	chthonic_2.1.4.0.vir.exe	chthonic_2.1.4.0.vir.exe
PID 3884 wrote to memory of 3300	3884	chthonic_2.1.4.0.vir.exe	chthonic_2.1.4.0.vir.exe
PID 3884 wrote to memory of 3300	3884	chthonic_2.1.4.0.vir.exe	chthonic_2.1.4.0.vir.exe
PID 3884 wrote to memory of 3300	3884	chthonic_2.1.4.0.vir.exe	chthonic_2.1.4.0.vir.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chthonic_2.1.4.0.vir.exe

description pid process target process

PID 3884 set thread context of 3300 3884 chthonic_2.1.4.0.vir.exe chthonic_2.1.4.0.vir.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.1.4.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.1.4.0.vir.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3884

C:\Users\Admin\AppData\Local\Temp\chthonic_2.1.4.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.1.4.0.vir.exe"
2⤵
PID:3300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3300-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3300-3-0x0000000000401B91-mapping.dmp

Download