chimera | 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

General

Target

1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
Size

232KB
MD5

60fabd1a2509b59831876d5e2aa71a6b
SHA1

8b91f3c4f721cb04cc4974fc91056f397ae78faa
SHA256

1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838
SHA512

3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

Score

10^/10

ransomware chimera spyware

Malware Config

Signatures

Chimera 23 IoCs

Ransomware which infects local and network files, often distributed via Dropbox links.

ransomware chimera

Processes:

1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jre7\lib\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
6	bot.whatismyipaddress.com
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jre7\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\VideoLAN\VLC\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jre7\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe

Chimera Ransomware Loader DLL 2 IoCs

Drops/unpacks executable file which resembles Chimera's Loader.dll.

ransomware

Processes:

resource	yara_rule
behavioral1/memory/1124-0-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll
behavioral1/memory/1124-0-0x0000000010000000-0x0000000010010000-memory.dmp	chimera_loader_dll

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 bot.whatismyipaddress.com

flow	ioc
6	bot.whatismyipaddress.com

Drops file in Program Files directory 170 IoCs

Processes:

1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\VideoLAN\VLC\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jvm.hprof.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jre7\lib\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\DataServices\+Connect to New Data Source.odc	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File created	C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe

description pid process

Token: SeDebugPrivilege 1124 1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe

description	pid	process
Token: SeDebugPrivilege	1124	1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe

C:\Users\Admin\AppData\Local\Temp\1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe
"C:\Users\Admin\AppData\Local\Temp\1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838.exe"
1⤵
- Chimera
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1124-1-0x0000000000504000-0x0000000000505000-memory.dmp

Filesize
4KB

Download
memory/1900-2-0x000007FEF6B70000-0x000007FEF6DEA000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads