Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 16:50
Static task
static1
Behavioral task
behavioral1
Sample
citadel_1.2.0.0b.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
citadel_1.2.0.0b.vir.exe
Resource
win10v200430
General
-
Target
citadel_1.2.0.0b.vir.exe
-
Size
213KB
-
MD5
b7f755dc5616bbf10f6d11a276c88c98
-
SHA1
6a31f670e6b91d246ff88d073d6c0b0cde9e9300
-
SHA256
371b9214f60a70c81ec1756d284e8028ff7603498341ecb7fa5cc09f3b10043e
-
SHA512
a569a9049e1c5a3cd5278400a4a8d53c6b728c685aca6401896c94ddf5efd7226660feaeb3a65e30d8b652fdf7da93053b577cc08fc8b480bb4527c6efa4cc89
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 908 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 908 WinMail.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2044 cmd.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\28536CE4-00000001.eml:OECustomProperty WinMail.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
citadel_1.2.0.0b.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1060 citadel_1.2.0.0b.vir.exe Token: SeSecurityPrivilege 1060 citadel_1.2.0.0b.vir.exe Token: SeSecurityPrivilege 1060 citadel_1.2.0.0b.vir.exe Token: SeSecurityPrivilege 1060 citadel_1.2.0.0b.vir.exe Token: SeSecurityPrivilege 1060 citadel_1.2.0.0b.vir.exe Token: SeSecurityPrivilege 1060 citadel_1.2.0.0b.vir.exe Token: SeSecurityPrivilege 1060 citadel_1.2.0.0b.vir.exe Token: SeSecurityPrivilege 1060 citadel_1.2.0.0b.vir.exe Token: SeManageVolumePrivilege 908 WinMail.exe -
Loads dropped DLL 2 IoCs
Processes:
citadel_1.2.0.0b.vir.exepid process 1060 citadel_1.2.0.0b.vir.exe 1060 citadel_1.2.0.0b.vir.exe -
Processes:
citadel_1.2.0.0b.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy citadel_1.2.0.0b.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" citadel_1.2.0.0b.vir.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
icup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run icup.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\Currentversion\Run icup.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yflaev = "C:\\Users\\Admin\\AppData\\Roaming\\Laumi\\icup.exe" icup.exe -
Suspicious use of WriteProcessMemory 93 IoCs
Processes:
citadel_1.2.0.0b.vir.exeicup.exedescription pid process target process PID 1060 wrote to memory of 1084 1060 citadel_1.2.0.0b.vir.exe icup.exe PID 1060 wrote to memory of 1084 1060 citadel_1.2.0.0b.vir.exe icup.exe PID 1060 wrote to memory of 1084 1060 citadel_1.2.0.0b.vir.exe icup.exe PID 1060 wrote to memory of 1084 1060 citadel_1.2.0.0b.vir.exe icup.exe PID 1084 wrote to memory of 1184 1084 icup.exe taskhost.exe PID 1084 wrote to memory of 1184 1084 icup.exe taskhost.exe PID 1084 wrote to memory of 1184 1084 icup.exe taskhost.exe PID 1084 wrote to memory of 1184 1084 icup.exe taskhost.exe PID 1084 wrote to memory of 1184 1084 icup.exe taskhost.exe PID 1084 wrote to memory of 1268 1084 icup.exe Dwm.exe PID 1084 wrote to memory of 1268 1084 icup.exe Dwm.exe PID 1084 wrote to memory of 1268 1084 icup.exe Dwm.exe PID 1084 wrote to memory of 1268 1084 icup.exe Dwm.exe PID 1084 wrote to memory of 1268 1084 icup.exe Dwm.exe PID 1084 wrote to memory of 1324 1084 icup.exe Explorer.EXE PID 1084 wrote to memory of 1324 1084 icup.exe Explorer.EXE PID 1084 wrote to memory of 1324 1084 icup.exe Explorer.EXE PID 1084 wrote to memory of 1324 1084 icup.exe Explorer.EXE PID 1084 wrote to memory of 1324 1084 icup.exe Explorer.EXE PID 1084 wrote to memory of 1060 1084 icup.exe citadel_1.2.0.0b.vir.exe PID 1084 wrote to memory of 1060 1084 icup.exe citadel_1.2.0.0b.vir.exe PID 1084 wrote to memory of 1060 1084 icup.exe citadel_1.2.0.0b.vir.exe PID 1084 wrote to memory of 1060 1084 icup.exe citadel_1.2.0.0b.vir.exe PID 1084 wrote to memory of 1060 1084 icup.exe citadel_1.2.0.0b.vir.exe PID 1060 wrote to memory of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe PID 1060 wrote to memory of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe PID 1060 wrote to memory of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe PID 1060 wrote to memory of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe PID 1060 wrote to memory of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe PID 1060 wrote to memory of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe PID 1060 wrote to memory of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe PID 1060 wrote to memory of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe PID 1060 wrote to memory of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe PID 1084 wrote to memory of 1068 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1068 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1068 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1068 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1068 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 792 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 792 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 792 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 792 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 792 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1720 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1720 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1720 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1720 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1720 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1260 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1260 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1260 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1260 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1260 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1560 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1560 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1560 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1560 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 1560 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 2016 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 2016 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 2016 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 2016 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 2016 1084 icup.exe DllHost.exe PID 1084 wrote to memory of 2024 1084 icup.exe DllHost.exe -
Executes dropped EXE 1 IoCs
Processes:
icup.exepid process 1084 icup.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
citadel_1.2.0.0b.vir.exedescription pid process target process PID 1060 set thread context of 2044 1060 citadel_1.2.0.0b.vir.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
citadel_1.2.0.0b.vir.exeicup.execmd.exepid process 1060 citadel_1.2.0.0b.vir.exe 1084 icup.exe 1084 icup.exe 1060 citadel_1.2.0.0b.vir.exe 1084 icup.exe 1084 icup.exe 2044 cmd.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe 1084 icup.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 908 WinMail.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\citadel_1.2.0.0b.vir.exe"C:\Users\Admin\AppData\Local\Temp\citadel_1.2.0.0b.vir.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Laumi\icup.exe"C:\Users\Admin\AppData\Roaming\Laumi\icup.exe"3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe4a5c4e0.bat"3⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpe4a5c4e0.bat
-
C:\Users\Admin\AppData\Roaming\Laumi\icup.exe
-
C:\Users\Admin\AppData\Roaming\Laumi\icup.exe
-
C:\Users\Admin\AppData\Roaming\Nyyx\omciu.mul
-
\Users\Admin\AppData\Roaming\Laumi\icup.exe
-
\Users\Admin\AppData\Roaming\Laumi\icup.exe
-
memory/908-5-0x0000000003990000-0x0000000003A90000-memory.dmpFilesize
1024KB
-
memory/908-7-0x0000000003990000-0x0000000003B90000-memory.dmpFilesize
2.0MB
-
memory/908-9-0x0000000003990000-0x0000000003A90000-memory.dmpFilesize
1024KB
-
memory/908-10-0x0000000003990000-0x0000000003B90000-memory.dmpFilesize
2.0MB
-
memory/908-11-0x0000000003A90000-0x0000000003B90000-memory.dmpFilesize
1024KB
-
memory/908-15-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/908-16-0x00000000024E0000-0x00000000024E2000-memory.dmpFilesize
8KB
-
memory/908-17-0x00000000024F0000-0x00000000024F2000-memory.dmpFilesize
8KB
-
memory/908-18-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/908-19-0x00000000024E0000-0x00000000024E2000-memory.dmpFilesize
8KB
-
memory/908-20-0x0000000004090000-0x0000000004092000-memory.dmpFilesize
8KB
-
memory/908-21-0x0000000003E00000-0x0000000003E02000-memory.dmpFilesize
8KB
-
memory/908-22-0x0000000003E30000-0x0000000003E32000-memory.dmpFilesize
8KB
-
memory/908-23-0x0000000003E30000-0x0000000003E32000-memory.dmpFilesize
8KB
-
memory/908-24-0x0000000003DF0000-0x0000000003DF2000-memory.dmpFilesize
8KB
-
memory/908-25-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/908-26-0x0000000003DE0000-0x0000000003DE2000-memory.dmpFilesize
8KB
-
memory/908-27-0x0000000004080000-0x0000000004082000-memory.dmpFilesize
8KB
-
memory/908-28-0x0000000003E10000-0x0000000003E12000-memory.dmpFilesize
8KB
-
memory/908-29-0x0000000003DD0000-0x0000000003DD2000-memory.dmpFilesize
8KB
-
memory/908-30-0x0000000004100000-0x0000000004102000-memory.dmpFilesize
8KB
-
memory/908-31-0x0000000004160000-0x0000000004162000-memory.dmpFilesize
8KB
-
memory/908-32-0x0000000004170000-0x0000000004172000-memory.dmpFilesize
8KB
-
memory/908-33-0x0000000004180000-0x0000000004182000-memory.dmpFilesize
8KB
-
memory/908-34-0x00000000041A0000-0x00000000041A2000-memory.dmpFilesize
8KB
-
memory/908-35-0x0000000004340000-0x0000000004342000-memory.dmpFilesize
8KB
-
memory/908-36-0x0000000004350000-0x0000000004352000-memory.dmpFilesize
8KB
-
memory/908-37-0x0000000003FD0000-0x0000000003FD2000-memory.dmpFilesize
8KB
-
memory/908-38-0x00000000043E0000-0x00000000043E2000-memory.dmpFilesize
8KB
-
memory/908-39-0x0000000003FC0000-0x0000000003FC2000-memory.dmpFilesize
8KB
-
memory/908-40-0x00000000043F0000-0x00000000043F2000-memory.dmpFilesize
8KB
-
memory/908-41-0x0000000003FB0000-0x0000000003FB2000-memory.dmpFilesize
8KB
-
memory/908-42-0x0000000004400000-0x0000000004402000-memory.dmpFilesize
8KB
-
memory/908-43-0x0000000003FA0000-0x0000000003FA2000-memory.dmpFilesize
8KB
-
memory/908-44-0x0000000003F90000-0x0000000003F92000-memory.dmpFilesize
8KB
-
memory/908-45-0x0000000003C30000-0x0000000003C32000-memory.dmpFilesize
8KB
-
memory/908-46-0x00000000025E0000-0x00000000025E2000-memory.dmpFilesize
8KB
-
memory/908-47-0x00000000046E0000-0x00000000046E2000-memory.dmpFilesize
8KB
-
memory/908-48-0x00000000046D0000-0x00000000046D2000-memory.dmpFilesize
8KB
-
memory/908-49-0x0000000004640000-0x0000000004642000-memory.dmpFilesize
8KB
-
memory/908-50-0x0000000004630000-0x0000000004632000-memory.dmpFilesize
8KB
-
memory/908-51-0x0000000003990000-0x0000000003A90000-memory.dmpFilesize
1024KB
-
memory/908-53-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/908-59-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1084-2-0x0000000000000000-mapping.dmp
-
memory/2044-66-0x0000000000050000-0x000000000009A000-memory.dmpFilesize
296KB
-
memory/2044-67-0x000000000006262B-mapping.dmp