06c893904f277dff0e318a0f775bc13322a11573eecc55237d4b55b968ca51ba | Triage

Analysis

max time kernel
67s
max time network
63s
platform
windows10_x64
resource
win10
submitted
19-07-2020 17:21

Sharing

Report Analysis Logs

General

Target

chthonic_2.1.2.0.vir.exe
Size

140KB
MD5

07d81914c4513c32be7e36ae0b6b4604
SHA1

f6856595de408ad73135ab0d1fe58cce73cd4300
SHA256

06c893904f277dff0e318a0f775bc13322a11573eecc55237d4b55b968ca51ba
SHA512

e245e17150917a9dec8161808453579984db2705f49d662d6b0fecc9fc83de9602213caab84c08dca7585f62c589c9c3815908aee73294d532684298b092a106

Score

5^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

chthonic_2.1.2.0.vir.exe

pid process

3892 chthonic_2.1.2.0.vir.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

chthonic_2.1.2.0.vir.exe

description	pid	process	target process
PID 3892 wrote to memory of 3852	3892	chthonic_2.1.2.0.vir.exe	chthonic_2.1.2.0.vir.exe
PID 3892 wrote to memory of 3852	3892	chthonic_2.1.2.0.vir.exe	chthonic_2.1.2.0.vir.exe
PID 3892 wrote to memory of 3852	3892	chthonic_2.1.2.0.vir.exe	chthonic_2.1.2.0.vir.exe
PID 3892 wrote to memory of 3852	3892	chthonic_2.1.2.0.vir.exe	chthonic_2.1.2.0.vir.exe
PID 3892 wrote to memory of 3852	3892	chthonic_2.1.2.0.vir.exe	chthonic_2.1.2.0.vir.exe
PID 3892 wrote to memory of 3852	3892	chthonic_2.1.2.0.vir.exe	chthonic_2.1.2.0.vir.exe
PID 3892 wrote to memory of 3852	3892	chthonic_2.1.2.0.vir.exe	chthonic_2.1.2.0.vir.exe
PID 3892 wrote to memory of 3852	3892	chthonic_2.1.2.0.vir.exe	chthonic_2.1.2.0.vir.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

chthonic_2.1.2.0.vir.exe

description pid process target process

PID 3892 set thread context of 3852 3892 chthonic_2.1.2.0.vir.exe chthonic_2.1.2.0.vir.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.1.2.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.1.2.0.vir.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3892

C:\Users\Admin\AppData\Local\Temp\chthonic_2.1.2.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.1.2.0.vir.exe"
2⤵
PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3852-3-0x0000000000401BE3-mapping.dmp

Download