cbe916ed6f941dc6e106ef625b972727927cf152e7c94498fc4bbb533ffc30cd

General

Target

chthonic_2.0.1.0.vir.exe
Size

133KB
MD5

148563b1ca625bbdbb60673db2edb74a
SHA1

8670b4ed16f2d92323f76a403657263b22a1a542
SHA256

cbe916ed6f941dc6e106ef625b972727927cf152e7c94498fc4bbb533ffc30cd
SHA512

8b26fed52f05e4d6780ba20ed19a5501b36d178fb3747264df07b5318142ca96ec6921e4bc985efd0d16a7fdb5869b9259af24fee24283e1d35acc14c29f4e36

Score

10^/10

persistence evasion trojan

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\PROGRA~3\msmqzt.exe msiexec.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\msmqzt.exe	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

chthonic_2.0.1.0.vir.exe

description	pid	process	target process
PID 1100 wrote to memory of 616	1100	chthonic_2.0.1.0.vir.exe	msiexec.exe
PID 1100 wrote to memory of 616	1100	chthonic_2.0.1.0.vir.exe	msiexec.exe
PID 1100 wrote to memory of 616	1100	chthonic_2.0.1.0.vir.exe	msiexec.exe
PID 1100 wrote to memory of 616	1100	chthonic_2.0.1.0.vir.exe	msiexec.exe
PID 1100 wrote to memory of 616	1100	chthonic_2.0.1.0.vir.exe	msiexec.exe
PID 1100 wrote to memory of 616	1100	chthonic_2.0.1.0.vir.exe	msiexec.exe
PID 1100 wrote to memory of 616	1100	chthonic_2.0.1.0.vir.exe	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\3284267163 = "C:\\PROGRA~3\\msmqzt.exe"	msiexec.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

chthonic_2.0.1.0.vir.exemsiexec.exe

pid	process
1100	chthonic_2.0.1.0.vir.exe
1100	chthonic_2.0.1.0.vir.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe
616	msiexec.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

msiexec.exe

pid process

616 msiexec.exe

pid	process
616	msiexec.exe

Blacklisted process makes network request 12 IoCs

Processes:

msiexec.exe

flow	pid	process
1	616	msiexec.exe
2	616	msiexec.exe
3	616	msiexec.exe
5	616	msiexec.exe
6	616	msiexec.exe
7	616	msiexec.exe
9	616	msiexec.exe
10	616	msiexec.exe
11	616	msiexec.exe
13	616	msiexec.exe
14	616	msiexec.exe
15	616	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Modifies visiblity of hidden/system files in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

chthonic_2.0.1.0.vir.exemsiexec.exe

pid process

1100 chthonic_2.0.1.0.vir.exe
616 msiexec.exe
616 msiexec.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

chthonic_2.0.1.0.vir.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1100	chthonic_2.0.1.0.vir.exe
Token: SeBackupPrivilege	1100	chthonic_2.0.1.0.vir.exe
Token: SeRestorePrivilege	1100	chthonic_2.0.1.0.vir.exe
Token: SeDebugPrivilege	616	msiexec.exe
Token: SeBackupPrivilege	616	msiexec.exe
Token: SeRestorePrivilege	616	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.0.1.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.0.1.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe
2⤵
- Drops file in Program Files directory
- Checks whether UAC is enabled
- Adds policy Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Blacklisted process makes network request
- System policy modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:616