Overview

overview

10

Static

static

chthonic_2...ir.exe

windows7_x64

chthonic_2...ir.exe

windows10_x64

8

Analysis

  • max time kernel
    135s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    19-07-2020 19:42

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    chthonic_2.23.17.10.vir.exe

  • Size

    1.8MB

  • MD5

    73613b116ebb614b2964038b3f937db0

  • SHA1

    7872e57d9e89fb65f22f51d93a5ac3ca39fc30da

  • SHA256

    b39a13030095984b1a1a5584c8aa7d974a40aa631ef5b27ab933cc5d40799deb

  • SHA512

    5d87c3bf9e438bbee3287d00b267f31d7bcb93b1fbc1fbc6aa2035bc502f5ca73d4e03e2711b6dfc73b06044e746ae15b23b95bf8dce394889073bdc0890b334

Score
10/10
evasiontrojandiscoverypersistence

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Drops file in Program Files directory 125 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • UAC bypass 3 TTPs
    evasiontrojan
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Blacklisted process makes network request 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Adds Run key to start application 2 TTPs 14 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 73 IoCs
  • Executes dropped EXE 5 IoCs
  • System policy modification 1 TTPs 5 IoCs
    evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Modifies registry class 92 IoCs
  • Disables taskbar notifications via registry modification
    evasion
  • Modifies service 2 TTPs 2 IoCs
    persistence
  • Loads dropped DLL 97 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.10.vir.exe
    "C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.10.vir.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Loads dropped DLL
    PID:900
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\ProgramData\MixerMood\informer.vbs"
      2⤵
      • Modifies system certificate store
      • Blacklisted process makes network request
      PID:1288
    • C:\ProgramData\MixerMood\logs.exe
      "C:\ProgramData\MixerMood\logs.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of UnmapMainImage
      PID:1416
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\system32\msiexec.exe
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        • System policy modification
        • Checks whether UAC is enabled
        • Modifies registry class
        • Modifies service
        PID:1116
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\wnew\wnew.com"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:872
          • C:\Users\Admin\AppData\Roaming\wnew\wnew.com
            C:\Users\Admin\AppData\Roaming\wnew\wnew.com
            5⤵
            • Suspicious behavior: GetForegroundWindowSpam
            • Executes dropped EXE
            • Suspicious use of UnmapMainImage
            PID:1820
            • C:\Windows\SysWOW64\msiexec.exe
              C:\Windows\system32\msiexec.exe
              6⤵
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious behavior: EnumeratesProcesses
              PID:1084
    • C:\ProgramData\MixerMood\Mixer.exe
      "C:\ProgramData\MixerMood\Mixer.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:912
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\ActualSoftware\cert.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\ProgramData\ActualSoftware\logs.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          • Loads dropped DLL
          PID:1828
          • C:\ProgramData\ActualSoftware\update.exe
            update.exe /S
            5⤵
            • Drops file in Program Files directory
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            • Executes dropped EXE
            • Modifies registry class
            • Loads dropped DLL
            PID:1264
            • C:\Program Files (x86)\Power Mixer\srvman.exe
              "C:\Program Files (x86)\Power Mixer\srvman.exe" -u
              6⤵
              • Executes dropped EXE
              PID:844
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1884
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:1508

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Modify Existing Service

      2
      T1031

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Bypass User Account Control

      1
      T1088

      Defense Evasion

      Modify Registry

      7
      T1112

      Disabling Security Tools

      2
      T1089

      Install Root Certificate

      1
      T1130

      Bypass User Account Control

      1
      T1088

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Web Service

      1
      T1102

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads