262a89d01968ca23f76f345aeb75d88cc6c65b02fd471d7d2adaa083d3d57d03

General

Target

chthonic_2.2.2.0.vir.exe
Size

124KB
MD5

eeac9de24d64a8cdbc5a3efabf736b2f
SHA1

b57aef1904ffd2e7a0014848ba1870048f150816
SHA256

262a89d01968ca23f76f345aeb75d88cc6c65b02fd471d7d2adaa083d3d57d03
SHA512

3b185cbde217e92cbdd2abf17a68b4977338abc47a121f8d4bd14cf6ae6d4725c9c7cefa0cf1f397037ee452a3c701b8313830e789058455d09a57283d5c5f3d

Score

8^/10

upx

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

chthonic_2.2.2.0.vir.exe

pid process

2784 chthonic_2.2.2.0.vir.exe
2784 chthonic_2.2.2.0.vir.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chthonic_2.2.2.0.vir.exe

pid process

2784 chthonic_2.2.2.0.vir.exe
2784 chthonic_2.2.2.0.vir.exe

pid	process
2784	chthonic_2.2.2.0.vir.exe
2784	chthonic_2.2.2.0.vir.exe

pid	process
2784	chthonic_2.2.2.0.vir.exe
2784	chthonic_2.2.2.0.vir.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

chthonic_2.2.2.0.vir.exe

description	pid	process	target process
PID 2784 wrote to memory of 3844	2784	chthonic_2.2.2.0.vir.exe	iexplore.exe
PID 2784 wrote to memory of 3844	2784	chthonic_2.2.2.0.vir.exe	iexplore.exe
PID 2784 wrote to memory of 3844	2784	chthonic_2.2.2.0.vir.exe	iexplore.exe
PID 2784 wrote to memory of 3844	2784	chthonic_2.2.2.0.vir.exe	iexplore.exe
PID 2784 wrote to memory of 3844	2784	chthonic_2.2.2.0.vir.exe	iexplore.exe
PID 2784 wrote to memory of 3844	2784	chthonic_2.2.2.0.vir.exe	iexplore.exe
PID 2784 wrote to memory of 3844	2784	chthonic_2.2.2.0.vir.exe	iexplore.exe
PID 2784 wrote to memory of 3844	2784	chthonic_2.2.2.0.vir.exe	iexplore.exe
PID 2784 wrote to memory of 3812	2784	chthonic_2.2.2.0.vir.exe	chthonic_2.2.2.0.vir.exe
PID 2784 wrote to memory of 3812	2784	chthonic_2.2.2.0.vir.exe	chthonic_2.2.2.0.vir.exe
PID 2784 wrote to memory of 3812	2784	chthonic_2.2.2.0.vir.exe	chthonic_2.2.2.0.vir.exe
PID 2784 wrote to memory of 3812	2784	chthonic_2.2.2.0.vir.exe	chthonic_2.2.2.0.vir.exe
PID 2784 wrote to memory of 3812	2784	chthonic_2.2.2.0.vir.exe	chthonic_2.2.2.0.vir.exe
PID 2784 wrote to memory of 3812	2784	chthonic_2.2.2.0.vir.exe	chthonic_2.2.2.0.vir.exe
PID 2784 wrote to memory of 3812	2784	chthonic_2.2.2.0.vir.exe	chthonic_2.2.2.0.vir.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

chthonic_2.2.2.0.vir.exe

description	pid	process	target process
PID 2784 set thread context of 3844	2784	chthonic_2.2.2.0.vir.exe	iexplore.exe
PID 2784 set thread context of 3812	2784	chthonic_2.2.2.0.vir.exe	chthonic_2.2.2.0.vir.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3844-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3844-3-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/3844-4-0x0000000000400000-0x0000000000414000-memory.dmp	upx

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\chthonic_2.2.2.0.vir.exe
C:\Users\Admin\AppData\Local\Temp\chthonic_2.2.2.0.vir.exe
2⤵
PID:3812

memory/3812-2-0x0000000000400000-0x0000000006800000-memory.dmp

Filesize
100.0MB

Download
memory/3812-5-0x0000000000401CBF-mapping.dmp

Download
memory/3844-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3844-1-0x0000000000412110-mapping.dmp

Download
memory/3844-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3844-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download