Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:25
Static task
static1
Behavioral task
behavioral1
Sample
citadel_1.3.3.5.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
citadel_1.3.3.5.vir.exe
Resource
win10
General
-
Target
citadel_1.3.3.5.vir.exe
-
Size
213KB
-
MD5
ebcc956a463733ff3b8b7f3e10c7bf4a
-
SHA1
8a4757afbef49a27272961dca870d69780b2abee
-
SHA256
d29b6d3a43795f840214bdc2e46255566c9840e8aa16cce8704b8eaf34cfba83
-
SHA512
a33f89d697ea77042a7c4dd0340ddda5e57ec8a28d8c955e410c8161ae76237ce477ae4c064c71a2e4a55f957d81fb828345053a4a5bd7ac16ed36902b816d33
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
abaxu.exepid process 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe 1696 abaxu.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\1E7A20A4-00000001.eml:OECustomProperty WinMail.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1504 cmd.exe -
Processes:
citadel_1.3.3.5.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy citadel_1.3.3.5.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" citadel_1.3.3.5.vir.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
citadel_1.3.3.5.vir.exedescription pid process target process PID 1492 set thread context of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
citadel_1.3.3.5.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1492 citadel_1.3.3.5.vir.exe Token: SeSecurityPrivilege 1492 citadel_1.3.3.5.vir.exe Token: SeSecurityPrivilege 1492 citadel_1.3.3.5.vir.exe Token: SeSecurityPrivilege 1492 citadel_1.3.3.5.vir.exe Token: SeSecurityPrivilege 1492 citadel_1.3.3.5.vir.exe Token: SeSecurityPrivilege 1492 citadel_1.3.3.5.vir.exe Token: SeSecurityPrivilege 1492 citadel_1.3.3.5.vir.exe Token: SeSecurityPrivilege 1492 citadel_1.3.3.5.vir.exe Token: SeManageVolumePrivilege 1864 WinMail.exe -
Loads dropped DLL 2 IoCs
Processes:
citadel_1.3.3.5.vir.exepid process 1492 citadel_1.3.3.5.vir.exe 1492 citadel_1.3.3.5.vir.exe -
Executes dropped EXE 1 IoCs
Processes:
abaxu.exepid process 1696 abaxu.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1864 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1864 WinMail.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
citadel_1.3.3.5.vir.exeabaxu.exedescription pid process target process PID 1492 wrote to memory of 1696 1492 citadel_1.3.3.5.vir.exe abaxu.exe PID 1492 wrote to memory of 1696 1492 citadel_1.3.3.5.vir.exe abaxu.exe PID 1492 wrote to memory of 1696 1492 citadel_1.3.3.5.vir.exe abaxu.exe PID 1492 wrote to memory of 1696 1492 citadel_1.3.3.5.vir.exe abaxu.exe PID 1696 wrote to memory of 1084 1696 abaxu.exe taskhost.exe PID 1696 wrote to memory of 1084 1696 abaxu.exe taskhost.exe PID 1696 wrote to memory of 1084 1696 abaxu.exe taskhost.exe PID 1696 wrote to memory of 1084 1696 abaxu.exe taskhost.exe PID 1696 wrote to memory of 1084 1696 abaxu.exe taskhost.exe PID 1696 wrote to memory of 1156 1696 abaxu.exe Dwm.exe PID 1696 wrote to memory of 1156 1696 abaxu.exe Dwm.exe PID 1696 wrote to memory of 1156 1696 abaxu.exe Dwm.exe PID 1696 wrote to memory of 1156 1696 abaxu.exe Dwm.exe PID 1696 wrote to memory of 1156 1696 abaxu.exe Dwm.exe PID 1696 wrote to memory of 1212 1696 abaxu.exe Explorer.EXE PID 1696 wrote to memory of 1212 1696 abaxu.exe Explorer.EXE PID 1696 wrote to memory of 1212 1696 abaxu.exe Explorer.EXE PID 1696 wrote to memory of 1212 1696 abaxu.exe Explorer.EXE PID 1696 wrote to memory of 1212 1696 abaxu.exe Explorer.EXE PID 1696 wrote to memory of 1492 1696 abaxu.exe citadel_1.3.3.5.vir.exe PID 1696 wrote to memory of 1492 1696 abaxu.exe citadel_1.3.3.5.vir.exe PID 1696 wrote to memory of 1492 1696 abaxu.exe citadel_1.3.3.5.vir.exe PID 1696 wrote to memory of 1492 1696 abaxu.exe citadel_1.3.3.5.vir.exe PID 1696 wrote to memory of 1492 1696 abaxu.exe citadel_1.3.3.5.vir.exe PID 1696 wrote to memory of 1864 1696 abaxu.exe WinMail.exe PID 1696 wrote to memory of 1864 1696 abaxu.exe WinMail.exe PID 1696 wrote to memory of 1864 1696 abaxu.exe WinMail.exe PID 1696 wrote to memory of 1864 1696 abaxu.exe WinMail.exe PID 1696 wrote to memory of 1864 1696 abaxu.exe WinMail.exe PID 1492 wrote to memory of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe PID 1492 wrote to memory of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe PID 1492 wrote to memory of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe PID 1492 wrote to memory of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe PID 1492 wrote to memory of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe PID 1492 wrote to memory of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe PID 1492 wrote to memory of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe PID 1492 wrote to memory of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe PID 1492 wrote to memory of 1504 1492 citadel_1.3.3.5.vir.exe cmd.exe PID 1696 wrote to memory of 1044 1696 abaxu.exe DllHost.exe PID 1696 wrote to memory of 1044 1696 abaxu.exe DllHost.exe PID 1696 wrote to memory of 1044 1696 abaxu.exe DllHost.exe PID 1696 wrote to memory of 1044 1696 abaxu.exe DllHost.exe PID 1696 wrote to memory of 1044 1696 abaxu.exe DllHost.exe PID 1696 wrote to memory of 1548 1696 abaxu.exe DllHost.exe PID 1696 wrote to memory of 1548 1696 abaxu.exe DllHost.exe PID 1696 wrote to memory of 1548 1696 abaxu.exe DllHost.exe PID 1696 wrote to memory of 1548 1696 abaxu.exe DllHost.exe PID 1696 wrote to memory of 1548 1696 abaxu.exe DllHost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1864 WinMail.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
abaxu.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run abaxu.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\Currentversion\Run abaxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ynemak = "C:\\Users\\Admin\\AppData\\Roaming\\Emmaos\\abaxu.exe" abaxu.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\citadel_1.3.3.5.vir.exe"C:\Users\Admin\AppData\Local\Temp\citadel_1.3.3.5.vir.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Emmaos\abaxu.exe"C:\Users\Admin\AppData\Roaming\Emmaos\abaxu.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp08f4a25d.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp08f4a25d.bat
-
C:\Users\Admin\AppData\Roaming\Emmaos\abaxu.exe
-
C:\Users\Admin\AppData\Roaming\Emmaos\abaxu.exe
-
C:\Users\Admin\AppData\Roaming\Ogki\ufys.lep
-
\Users\Admin\AppData\Roaming\Emmaos\abaxu.exe
-
\Users\Admin\AppData\Roaming\Emmaos\abaxu.exe
-
memory/1504-64-0x0000000000190000-0x00000000001C6000-memory.dmpFilesize
216KB
-
memory/1504-65-0x000000000019C477-mapping.dmp
-
memory/1696-2-0x0000000000000000-mapping.dmp
-
memory/1864-28-0x0000000003E40000-0x0000000003E42000-memory.dmpFilesize
8KB
-
memory/1864-32-0x00000000044B0000-0x00000000044B2000-memory.dmpFilesize
8KB
-
memory/1864-10-0x0000000003930000-0x0000000003B30000-memory.dmpFilesize
2.0MB
-
memory/1864-11-0x0000000003A30000-0x0000000003B30000-memory.dmpFilesize
1024KB
-
memory/1864-15-0x00000000024E0000-0x00000000024E2000-memory.dmpFilesize
8KB
-
memory/1864-16-0x00000000024F0000-0x00000000024F2000-memory.dmpFilesize
8KB
-
memory/1864-17-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/1864-18-0x0000000003DD0000-0x0000000003DD2000-memory.dmpFilesize
8KB
-
memory/1864-19-0x0000000003C80000-0x0000000003C82000-memory.dmpFilesize
8KB
-
memory/1864-20-0x0000000003DD0000-0x0000000003DD2000-memory.dmpFilesize
8KB
-
memory/1864-21-0x0000000003C70000-0x0000000003C72000-memory.dmpFilesize
8KB
-
memory/1864-22-0x0000000003C80000-0x0000000003C82000-memory.dmpFilesize
8KB
-
memory/1864-23-0x00000000024F0000-0x00000000024F2000-memory.dmpFilesize
8KB
-
memory/1864-24-0x0000000003E60000-0x0000000003E62000-memory.dmpFilesize
8KB
-
memory/1864-25-0x00000000044C0000-0x00000000044C2000-memory.dmpFilesize
8KB
-
memory/1864-26-0x0000000004550000-0x0000000004552000-memory.dmpFilesize
8KB
-
memory/1864-27-0x0000000003CA0000-0x0000000003CA2000-memory.dmpFilesize
8KB
-
memory/1864-7-0x0000000003930000-0x0000000003B30000-memory.dmpFilesize
2.0MB
-
memory/1864-29-0x0000000004550000-0x0000000004552000-memory.dmpFilesize
8KB
-
memory/1864-30-0x0000000004580000-0x0000000004582000-memory.dmpFilesize
8KB
-
memory/1864-31-0x0000000003CA0000-0x0000000003CA2000-memory.dmpFilesize
8KB
-
memory/1864-9-0x0000000003930000-0x0000000003A30000-memory.dmpFilesize
1024KB
-
memory/1864-33-0x0000000003E60000-0x0000000003E62000-memory.dmpFilesize
8KB
-
memory/1864-34-0x0000000003CA0000-0x0000000003CA2000-memory.dmpFilesize
8KB
-
memory/1864-35-0x00000000044B0000-0x00000000044B2000-memory.dmpFilesize
8KB
-
memory/1864-36-0x0000000004580000-0x0000000004582000-memory.dmpFilesize
8KB
-
memory/1864-37-0x0000000004420000-0x0000000004422000-memory.dmpFilesize
8KB
-
memory/1864-38-0x0000000003B90000-0x0000000003B92000-memory.dmpFilesize
8KB
-
memory/1864-39-0x0000000003E60000-0x0000000003E62000-memory.dmpFilesize
8KB
-
memory/1864-40-0x00000000044B0000-0x00000000044B2000-memory.dmpFilesize
8KB
-
memory/1864-41-0x0000000003CA0000-0x0000000003CA2000-memory.dmpFilesize
8KB
-
memory/1864-42-0x0000000003C80000-0x0000000003C82000-memory.dmpFilesize
8KB
-
memory/1864-43-0x0000000003C60000-0x0000000003C62000-memory.dmpFilesize
8KB
-
memory/1864-45-0x0000000003BA0000-0x0000000003BA2000-memory.dmpFilesize
8KB
-
memory/1864-44-0x0000000003C90000-0x0000000003C92000-memory.dmpFilesize
8KB
-
memory/1864-46-0x0000000003DF0000-0x0000000003DF2000-memory.dmpFilesize
8KB
-
memory/1864-47-0x0000000004410000-0x0000000004412000-memory.dmpFilesize
8KB
-
memory/1864-48-0x0000000004400000-0x0000000004402000-memory.dmpFilesize
8KB
-
memory/1864-49-0x00000000041D0000-0x00000000041D2000-memory.dmpFilesize
8KB
-
memory/1864-5-0x0000000003930000-0x0000000003A30000-memory.dmpFilesize
1024KB
-
memory/1864-50-0x0000000003930000-0x0000000003A30000-memory.dmpFilesize
1024KB
-
memory/1864-52-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/1864-58-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB