Analysis
-
max time kernel
60s -
max time network
75s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:25
Static task
static1
Behavioral task
behavioral1
Sample
chthonic_2.2.2.0.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
chthonic_2.2.2.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
chthonic_2.2.2.0.vir.exe
-
Size
124KB
-
MD5
eeac9de24d64a8cdbc5a3efabf736b2f
-
SHA1
b57aef1904ffd2e7a0014848ba1870048f150816
-
SHA256
262a89d01968ca23f76f345aeb75d88cc6c65b02fd471d7d2adaa083d3d57d03
-
SHA512
3b185cbde217e92cbdd2abf17a68b4977338abc47a121f8d4bd14cf6ae6d4725c9c7cefa0cf1f397037ee452a3c701b8313830e789058455d09a57283d5c5f3d
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
Processes:
winver.exepid process 1504 winver.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
Drops file in Program Files directory 1 IoCs
Processes:
winver.exedescription ioc process File opened for modification C:\PROGRA~3\Macromedia\Macromediaxpers.exe winver.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
chthonic_2.2.2.0.vir.exepid process 1132 chthonic_2.2.2.0.vir.exe 1132 chthonic_2.2.2.0.vir.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
chthonic_2.2.2.0.vir.exedescription pid process target process PID 1132 set thread context of 1296 1132 chthonic_2.2.2.0.vir.exe iexplore.exe PID 1132 set thread context of 1412 1132 chthonic_2.2.2.0.vir.exe chthonic_2.2.2.0.vir.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
chthonic_2.2.2.0.vir.exewinver.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1412 chthonic_2.2.2.0.vir.exe Token: SeBackupPrivilege 1412 chthonic_2.2.2.0.vir.exe Token: SeRestorePrivilege 1412 chthonic_2.2.2.0.vir.exe Token: SeDebugPrivilege 1504 winver.exe Token: SeBackupPrivilege 1504 winver.exe Token: SeRestorePrivilege 1504 winver.exe Token: SeDebugPrivilege 1296 iexplore.exe Token: SeBackupPrivilege 1296 iexplore.exe Token: SeRestorePrivilege 1296 iexplore.exe -
Disables taskbar notifications via registry modification
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
chthonic_2.2.2.0.vir.exechthonic_2.2.2.0.vir.exedescription pid process target process PID 1132 wrote to memory of 1296 1132 chthonic_2.2.2.0.vir.exe iexplore.exe PID 1132 wrote to memory of 1296 1132 chthonic_2.2.2.0.vir.exe iexplore.exe PID 1132 wrote to memory of 1296 1132 chthonic_2.2.2.0.vir.exe iexplore.exe PID 1132 wrote to memory of 1296 1132 chthonic_2.2.2.0.vir.exe iexplore.exe PID 1132 wrote to memory of 1296 1132 chthonic_2.2.2.0.vir.exe iexplore.exe PID 1132 wrote to memory of 1296 1132 chthonic_2.2.2.0.vir.exe iexplore.exe PID 1132 wrote to memory of 1296 1132 chthonic_2.2.2.0.vir.exe iexplore.exe PID 1132 wrote to memory of 1296 1132 chthonic_2.2.2.0.vir.exe iexplore.exe PID 1132 wrote to memory of 1412 1132 chthonic_2.2.2.0.vir.exe chthonic_2.2.2.0.vir.exe PID 1132 wrote to memory of 1412 1132 chthonic_2.2.2.0.vir.exe chthonic_2.2.2.0.vir.exe PID 1132 wrote to memory of 1412 1132 chthonic_2.2.2.0.vir.exe chthonic_2.2.2.0.vir.exe PID 1132 wrote to memory of 1412 1132 chthonic_2.2.2.0.vir.exe chthonic_2.2.2.0.vir.exe PID 1132 wrote to memory of 1412 1132 chthonic_2.2.2.0.vir.exe chthonic_2.2.2.0.vir.exe PID 1132 wrote to memory of 1412 1132 chthonic_2.2.2.0.vir.exe chthonic_2.2.2.0.vir.exe PID 1132 wrote to memory of 1412 1132 chthonic_2.2.2.0.vir.exe chthonic_2.2.2.0.vir.exe PID 1132 wrote to memory of 1412 1132 chthonic_2.2.2.0.vir.exe chthonic_2.2.2.0.vir.exe PID 1412 wrote to memory of 1504 1412 chthonic_2.2.2.0.vir.exe winver.exe PID 1412 wrote to memory of 1504 1412 chthonic_2.2.2.0.vir.exe winver.exe PID 1412 wrote to memory of 1504 1412 chthonic_2.2.2.0.vir.exe winver.exe PID 1412 wrote to memory of 1504 1412 chthonic_2.2.2.0.vir.exe winver.exe PID 1412 wrote to memory of 1504 1412 chthonic_2.2.2.0.vir.exe winver.exe -
Processes:
resource yara_rule behavioral1/memory/1296-0-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1296-3-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1296-4-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Processes:
winver.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winver.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run winver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\2292364352 = "C:\\PROGRA~3\\Macromedia\\Macromediaxpers.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
chthonic_2.2.2.0.vir.exechthonic_2.2.2.0.vir.exewinver.exeiexplore.exepid process 1132 chthonic_2.2.2.0.vir.exe 1412 chthonic_2.2.2.0.vir.exe 1412 chthonic_2.2.2.0.vir.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1296 iexplore.exe 1296 iexplore.exe -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
winver.exepid process 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe 1504 winver.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system winver.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\chthonic_2.2.2.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\chthonic_2.2.2.0.vir.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\chthonic_2.2.2.0.vir.exeC:\Users\Admin\AppData\Local\Temp\chthonic_2.2.2.0.vir.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Suspicious behavior: RenamesItself
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Checks whether UAC is enabled
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1296-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1296-1-0x0000000000412110-mapping.dmp
-
memory/1296-3-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1296-4-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1296-7-0x0000000000412110-mapping.dmp
-
memory/1412-2-0x0000000000400000-0x0000000006800000-memory.dmpFilesize
100.0MB
-
memory/1412-5-0x0000000000401CBF-mapping.dmp
-
memory/1504-6-0x0000000000000000-mapping.dmp