910bd288e7777b7d3df9b81e3e7527b73a3c5383c5d2aa5789e8a1ca90cc287e

General

Target

chthonic_2.4.3.0.vir.exe
Size

220KB
MD5

334a321d1771607ef73d2a1eb2216a77
SHA1

93efa0670ef341c0e51a9b146410f69a9199e69d
SHA256

910bd288e7777b7d3df9b81e3e7527b73a3c5383c5d2aa5789e8a1ca90cc287e
SHA512

1adc52334915b2b246d6d309216080d82175a24ef624b134f5e779f71b9344815d7805f177a35d42de76128539f8f77bfc2bc6deb33d50439cf073decb8e8093

Score

10^/10

persistence evasion trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

setap.exesetap.exe

pid process

3792 setap.exe
3912 setap.exe

pid	process
3792	setap.exe
3912	setap.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

msiexec.exe

pid	process
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe
1908	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\AgentWindowsPhotoViewer = "C:\\ProgramData\\Windows Photo Viewer\\AgentWindowsPhotoViewer.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe

Disables taskbar notifications via registry modification
evasion
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

chthonic_2.4.3.0.vir.exesetap.exe

pid process

3588 chthonic_2.4.3.0.vir.exe
3792 setap.exe

pid	process
3588	chthonic_2.4.3.0.vir.exe
3792	setap.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

chthonic_2.4.3.0.vir.exechthonic_2.4.3.0.vir.exesetap.exesetap.exe

description	pid	process	target process
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3588 wrote to memory of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 4068 wrote to memory of 3792	4068	chthonic_2.4.3.0.vir.exe	setap.exe
PID 4068 wrote to memory of 3792	4068	chthonic_2.4.3.0.vir.exe	setap.exe
PID 4068 wrote to memory of 3792	4068	chthonic_2.4.3.0.vir.exe	setap.exe
PID 3792 wrote to memory of 3912	3792	setap.exe	setap.exe
PID 3792 wrote to memory of 3912	3792	setap.exe	setap.exe
PID 3792 wrote to memory of 3912	3792	setap.exe	setap.exe
PID 3792 wrote to memory of 3912	3792	setap.exe	setap.exe
PID 3792 wrote to memory of 3912	3792	setap.exe	setap.exe
PID 3792 wrote to memory of 3912	3792	setap.exe	setap.exe
PID 3792 wrote to memory of 3912	3792	setap.exe	setap.exe
PID 3792 wrote to memory of 3912	3792	setap.exe	setap.exe
PID 3912 wrote to memory of 1908	3912	setap.exe	msiexec.exe
PID 3912 wrote to memory of 1908	3912	setap.exe	msiexec.exe
PID 3912 wrote to memory of 1908	3912	setap.exe	msiexec.exe
PID 3912 wrote to memory of 1908	3912	setap.exe	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

chthonic_2.4.3.0.vir.exesetap.exe

description	pid	process	target process
PID 3588 set thread context of 4068	3588	chthonic_2.4.3.0.vir.exe	chthonic_2.4.3.0.vir.exe
PID 3792 set thread context of 3912	3792	setap.exe	setap.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

C:\Users\Admin\AppData\Local\Temp\chthonic_2.4.3.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.4.3.0.vir.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3588

C:\Users\Admin\AppData\Local\Temp\chthonic_2.4.3.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.4.3.0.vir.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4068

C:\Users\Admin\AppData\Local\Temp\setap.exe
C:\Users\Admin\AppData\Local\Temp\setap.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3792

C:\Users\Admin\AppData\Local\Temp\setap.exe
C:\Users\Admin\AppData\Local\Temp\setap.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Adds policy Run key to start application
- Modifies Internet Explorer settings
- System policy modification
- Checks whether UAC is enabled
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Modify Registry

4

T1112

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\setap.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\setap.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\setap.exe

Download Submit
memory/1908-15-0x0000000000000000-mapping.dmp

Download
memory/3792-6-0x0000000000000000-mapping.dmp

Download
memory/3912-11-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3912-12-0x0000000000401D8E-mapping.dmp

Download
memory/3912-13-0x0000000000401D8E-mapping.dmp

Download
memory/4068-2-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4068-3-0x0000000000402F6D-mapping.dmp

Download
memory/4068-4-0x0000000000402F6D-mapping.dmp

Download
memory/4068-5-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads