b39a13030095984b1a1a5584c8aa7d974a40aa631ef5b27ab933cc5d40799deb

Analysis

max time kernel
10s
max time network
7s
platform
windows10_x64
resource
win10v200430
submitted
19-07-2020 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

chthonic_2.23.17.10.vir.exe
Size

1.8MB
MD5

73613b116ebb614b2964038b3f937db0
SHA1

7872e57d9e89fb65f22f51d93a5ac3ca39fc30da
SHA256

b39a13030095984b1a1a5584c8aa7d974a40aa631ef5b27ab933cc5d40799deb
SHA512

5d87c3bf9e438bbee3287d00b267f31d7bcb93b1fbc1fbc6aa2035bc502f5ca73d4e03e2711b6dfc73b06044e746ae15b23b95bf8dce394889073bdc0890b334

Score

8^/10

persistence discovery

Malware Config

Signatures

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

chthonic_2.23.17.10.vir.exeMixer.exeWScript.execmd.exeupdate.exe

description	pid	process	target process
PID 2016 wrote to memory of 2136	2016	chthonic_2.23.17.10.vir.exe	WScript.exe
PID 2016 wrote to memory of 2136	2016	chthonic_2.23.17.10.vir.exe	WScript.exe
PID 2016 wrote to memory of 2136	2016	chthonic_2.23.17.10.vir.exe	WScript.exe
PID 2016 wrote to memory of 2148	2016	chthonic_2.23.17.10.vir.exe	logs.exe
PID 2016 wrote to memory of 2148	2016	chthonic_2.23.17.10.vir.exe	logs.exe
PID 2016 wrote to memory of 2148	2016	chthonic_2.23.17.10.vir.exe	logs.exe
PID 2016 wrote to memory of 2756	2016	chthonic_2.23.17.10.vir.exe	Mixer.exe
PID 2016 wrote to memory of 2756	2016	chthonic_2.23.17.10.vir.exe	Mixer.exe
PID 2016 wrote to memory of 2756	2016	chthonic_2.23.17.10.vir.exe	Mixer.exe
PID 2756 wrote to memory of 2528	2756	Mixer.exe	WScript.exe
PID 2756 wrote to memory of 2528	2756	Mixer.exe	WScript.exe
PID 2756 wrote to memory of 2528	2756	Mixer.exe	WScript.exe
PID 2528 wrote to memory of 3024	2528	WScript.exe	cmd.exe
PID 2528 wrote to memory of 3024	2528	WScript.exe	cmd.exe
PID 2528 wrote to memory of 3024	2528	WScript.exe	cmd.exe
PID 3024 wrote to memory of 3928	3024	cmd.exe	update.exe
PID 3024 wrote to memory of 3928	3024	cmd.exe	update.exe
PID 3024 wrote to memory of 3928	3024	cmd.exe	update.exe
PID 3928 wrote to memory of 1888	3928	update.exe	srvman.exe
PID 3928 wrote to memory of 1888	3928	update.exe	srvman.exe
PID 3928 wrote to memory of 1888	3928	update.exe	srvman.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

logs.exe

pid process

2148 logs.exe

Loads dropped DLL 77 IoCs

Processes:

logs.exeupdate.exe

pid	process
2148	logs.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe
3928	update.exe

Modifies registry class 71 IoCs

Processes:

update.exechthonic_2.23.17.10.vir.exeMixer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\TypeLib	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerMixer.Ctrl.1\CLSID	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\MiscStatus\1\ = "131473"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\Insertable	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}\1.0\0	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\ProxyStubClsid32	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21A9D414-7066-4FA2-9B06-A7307195E52A}\InprocServer32\ = "C:\\PROGRA~2\\POWERM~1\\pwmixer.ocx"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\MiscStatus\ = "0"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\Control	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\Version	update.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	chthonic_2.23.17.10.vir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerMixer.Ctrl.1\ = "Power Mixer Control"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\MiscStatus\1	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\Insertable\	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}\1.0\0\win32\ = "C:\\Program Files (x86)\\Power Mixer\\pwmixer.ocx"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}\TypeLib\Version = "1.0"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\ToolboxBitmap32	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\Control\	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerMixer.Ctrl.1\Insertable\	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\ProxyStubClsid32	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\TypeLib\Version = "1.0"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}\ProxyStubClsid32	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}\1.0\HELPDIR\	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\ProgID\ = "PowerMixer.Ctrl.1"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\Version\ = "1.0"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}\1.0\FLAGS	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}\1.0\HELPDIR	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\ = "IPowerMixer"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}	update.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	Mixer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\ = "IPowerMixer"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}\TypeLib\ = "{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\TypeLib\Version = "1.0"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\TypeLib	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\TypeLib\ = "{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\ = "Power Mixer Control"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\ProgID	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}\1.0\FLAGS\ = "2"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21A9D414-7066-4FA2-9B06-A7307195E52A}	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21A9D414-7066-4FA2-9B06-A7307195E52A}\ = "Power Mixer Control Property Page"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\MiscStatus	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerMixer.Ctrl.1\Insertable	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}\ = "IPowerMixerEvents"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21A9D414-7066-4FA2-9B06-A7307195E52A}\InprocServer32	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\TypeLib	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{735C9E3E-9288-4D92-A5B7-13704D8A53E9}\TypeLib\ = "{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}\TypeLib\Version = "1.0"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\InprocServer32	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}\1.0\ = "Power Mixer Control module"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}\1.0\0\win32	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}\TypeLib	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\InprocServer32\ = "C:\\PROGRA~2\\POWERM~1\\pwmixer.ocx"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04261676-A7DB-43B6-92FF-3A95CFFBFE92}\ToolboxBitmap32\ = "C:\\PROGRA~2\\POWERM~1\\pwmixer.ocx, 1"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EAB4CE6-1931-4C2A-94CC-8257D2D400EB}\1.0	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C04378F8-9992-4C12-94BE-5D6B539863F5}\ = "IPowerMixerEvents"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerMixer.Ctrl.1	update.exe

Executes dropped EXE 4 IoCs

Processes:

logs.exeMixer.exeupdate.exesrvman.exe

pid process

2148 logs.exe
2756 Mixer.exe
3928 update.exe
1888 srvman.exe
Blacklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

4 2136 WScript.exe

flow	pid	process
4	2136	WScript.exe

Drops file in Program Files directory 125 IoCs

Processes:

update.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Serbian (Latin).lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\pwmixer.dat	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Dutch.lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Korean.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\help.chm	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Afrikaans.lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Chinese (Simplified).lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\pwmixer.ocx	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Chinese (Traditional).lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\Res\Sounds\osd.wav	update.exe
File created	C:\Program Files (x86)\Power Mixer\Register.htm	update.exe
File created	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Default (Light Text).bmp	update.exe
File created	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Vertical Bar (Multicolor).bmp	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\srvman.dat	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\English.lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Swedish.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\English.lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Catalan.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Polish.lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\srvman.cfg	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Chinese (Simplified).lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\minimix.dat	update.exe
File created	C:\Program Files (x86)\Power Mixer\readme.txt	update.exe
File created	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Chameleon (Light Text).bmp	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\pmocx.dat	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Magyar.lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Portuguese (Brazil).lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\srvhelp.exe	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Ukrainian.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\srvman.cfg	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Hebrew.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Horizontal Bar.bmp	update.exe
File created	C:\Program Files (x86)\Power Mixer\help.chm	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Danish.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Default (Light Text).bmp	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Ukrainian.lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Default.bmp	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\French.lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Magyar.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Romanian.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Chameleon (Light Text).bmp	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Vertical Bar (Multicolor).bmp	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\history.txt	update.exe
File created	C:\Program Files (x86)\Power Mixer\Tools\atedit.exe	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Dutch.lng	update.exe
File created	C:\Program Files (x86)\Power Mixer\pmocx.dat	update.exe
File created	C:\Program Files (x86)\Power Mixer\Tools\Default.csv	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Arabic.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Digits (Multicolor).bmp	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Korean.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Serbian (Cyrillic).lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Chameleon.bmp	update.exe
File created	C:\Program Files (x86)\Power Mixer\Homepage.htm	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\readme.txt	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\license.txt	update.exe
File created	C:\Program Files (x86)\Power Mixer\srvman.dat	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Basic.bmp	update.exe
File created	C:\Program Files (x86)\Power Mixer\Res\Tray Icon\Basic.bmp	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\minimix.dat	update.exe
File created	C:\Program Files (x86)\Power Mixer\pwmixer.exe	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Estonian.lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Res\Sounds\osd.wav	update.exe
File created	C:\Program Files (x86)\Power Mixer\Lang\Chinese (Traditional).lng	update.exe
File opened for modification	C:\Program Files (x86)\Power Mixer\Lang\Russian.lng	update.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

update.exelogs.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Power Mixer = "\"C:\\Program Files (x86)\\Power Mixer\\pwmixer.exe\" /m"	update.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\software\microsoft\windows\currentversion\Run	logs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\gnew = "C:\\Users\\Admin\\AppData\\Roaming\\gnew\\gnew.com"	logs.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.10.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.10.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
PID:2016

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\MixerMood\informer.vbs"
2⤵
- Blacklisted process makes network request
PID:2136

C:\ProgramData\MixerMood\logs.exe
"C:\ProgramData\MixerMood\logs.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Loads dropped DLL
- Executes dropped EXE
- Adds Run key to start application
PID:2148

C:\ProgramData\MixerMood\Mixer.exe
"C:\ProgramData\MixerMood\Mixer.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
- Executes dropped EXE
PID:2756

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\ActualSoftware\cert.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:2528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\ActualSoftware\logs.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\ProgramData\ActualSoftware\update.exe
update.exe /S
5⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Modifies registry class
- Executes dropped EXE
- Drops file in Program Files directory
- Adds Run key to start application
PID:3928

C:\Program Files (x86)\Power Mixer\srvman.exe
"C:\Program Files (x86)\Power Mixer\srvman.exe" -u
6⤵
- Executes dropped EXE
PID:1888

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Power Mixer\srvman.cfg

Download Submit
C:\Program Files (x86)\Power Mixer\srvman.exe

Download Submit
C:\Program Files (x86)\Power Mixer\srvman.exe

Download Submit
C:\ProgramData\ActualSoftware\cert.vbs

Download Submit
C:\ProgramData\ActualSoftware\logs.bat

Download Submit
C:\ProgramData\ActualSoftware\update.exe

Download Submit
C:\ProgramData\ActualSoftware\update.exe

Download Submit
C:\ProgramData\MixerMood\Mixer.exe

Download Submit
C:\ProgramData\MixerMood\Mixer.exe

Download Submit
C:\ProgramData\MixerMood\informer.vbs

Download Submit
C:\ProgramData\MixerMood\logs.exe

Download Submit
C:\ProgramData\MixerMood\logs.exe

Download Submit
\Program Files (x86)\Power Mixer\pwmixer.ocx

Download Submit
\Users\Admin\AppData\Local\Temp\4251753.tmp

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\GetVersion.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\GetVersion.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\Service.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\Service.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\Service.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\Service.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\Service.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\Service.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\Service.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\SetupCfg.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\UserInfo.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsx357F.tmp\UserInfo.dll

Download Submit
memory/1888-90-0x0000000000000000-mapping.dmp

Download
memory/2136-0-0x0000000000000000-mapping.dmp

Download
memory/2148-2-0x0000000000000000-mapping.dmp

Download
memory/2528-8-0x0000000000000000-mapping.dmp

Download
memory/2756-5-0x0000000000000000-mapping.dmp

Download
memory/3024-12-0x0000000000000000-mapping.dmp

Download
memory/3928-14-0x0000000000000000-mapping.dmp

Download
memory/3928-13-0x0000000000000000-mapping.dmp

Download