5f33dc16c573abca537ffb79f9135cc5ad143f410cb38f3d4c9adc94aeaf38df

General

Target

chthonic_2.0.8.0.vir.exe
Size

175KB
MD5

ceb583f418c8f2bb06966b9a5458d704
SHA1

31bf98fbff22cb03604e2fc758575120f9915b2c
SHA256

5f33dc16c573abca537ffb79f9135cc5ad143f410cb38f3d4c9adc94aeaf38df
SHA512

41d1c03e8ee85adc9426bb4bf5af59c83cec7619f1b35c9b68011cae99b170646721d97c46eec649717ed3d860a1066b43bcb8485856cad69f776f0ae7f8cb27

Score

10^/10

evasion trojan persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

chthonic_2.0.8.0.vir.exe

description	pid	process	target process
PID 1304 wrote to memory of 1000	1304	chthonic_2.0.8.0.vir.exe	msiexec.exe
PID 1304 wrote to memory of 1000	1304	chthonic_2.0.8.0.vir.exe	msiexec.exe
PID 1304 wrote to memory of 1000	1304	chthonic_2.0.8.0.vir.exe	msiexec.exe
PID 1304 wrote to memory of 1000	1304	chthonic_2.0.8.0.vir.exe	msiexec.exe
PID 1304 wrote to memory of 1000	1304	chthonic_2.0.8.0.vir.exe	msiexec.exe
PID 1304 wrote to memory of 1000	1304	chthonic_2.0.8.0.vir.exe	msiexec.exe
PID 1304 wrote to memory of 1000	1304	chthonic_2.0.8.0.vir.exe	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\1514472035 = "C:\\PROGRA~3\\WatchConvertFrom.xsl\\TrayWatchConvertFrom.xsl.exe"	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

chthonic_2.0.8.0.vir.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1304	chthonic_2.0.8.0.vir.exe
Token: SeBackupPrivilege	1304	chthonic_2.0.8.0.vir.exe
Token: SeRestorePrivilege	1304	chthonic_2.0.8.0.vir.exe
Token: SeDebugPrivilege	1000	msiexec.exe
Token: SeBackupPrivilege	1000	msiexec.exe
Token: SeRestorePrivilege	1000	msiexec.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

msiexec.exe

pid process

1000 msiexec.exe

pid	process
1000	msiexec.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

chthonic_2.0.8.0.vir.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\WINE	chthonic_2.0.8.0.vir.exe
Key opened	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\WINE	msiexec.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

chthonic_2.0.8.0.vir.exemsiexec.exe

pid	process
1304	chthonic_2.0.8.0.vir.exe
1304	chthonic_2.0.8.0.vir.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe
1000	msiexec.exe

Blacklisted process makes network request 12 IoCs

Processes:

msiexec.exe

flow	pid	process
1	1000	msiexec.exe
2	1000	msiexec.exe
3	1000	msiexec.exe
5	1000	msiexec.exe
6	1000	msiexec.exe
7	1000	msiexec.exe
9	1000	msiexec.exe
10	1000	msiexec.exe
11	1000	msiexec.exe
13	1000	msiexec.exe
14	1000	msiexec.exe
15	1000	msiexec.exe

Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\PROGRA~3\WatchConvertFrom.xsl\TrayWatchConvertFrom.xsl.exe msiexec.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\WatchConvertFrom.xsl\TrayWatchConvertFrom.xsl.exe	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	msiexec.exe

Disables taskbar notifications via registry modification
evasion
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

chthonic_2.0.8.0.vir.exemsiexec.exe

pid process

1304 chthonic_2.0.8.0.vir.exe
1304 chthonic_2.0.8.0.vir.exe
1000 msiexec.exe
1000 msiexec.exe
1000 msiexec.exe
Modifies visiblity of hidden/system files in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

C:\Users\Admin\AppData\Local\Temp\chthonic_2.0.8.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.0.8.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Identifies Wine through registry keys
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
PID:1304

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe
2⤵
- Adds policy Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself
- Identifies Wine through registry keys
- Suspicious behavior: MapViewOfSection
- Blacklisted process makes network request
- Drops file in Program Files directory
- System policy modification
- Suspicious behavior: EnumeratesProcesses
PID:1000