Analysis
-
max time kernel
177s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2023 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Chi.exe
Resource
win7-20230831-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Chi.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Chi.exe
-
Size
384KB
-
MD5
e6922a68fca90016584ac48fc7722ef8
-
SHA1
a039ae3f86f31a569966a94ad45dbe7e87f118ad
-
SHA256
ffb4a81fc336b1d77c81eef96eab0a5249ebb053c8920dd0c02e1d9f3ac257b0
-
SHA512
33671f3ce8ae5ce1b2852aeb3a601db82b9b8c83bc682abdebf69fb96d878edeb91a21183f1f456d18dd5ed59c797389de912c627d060866fccb580548c96319
-
SSDEEP
3072:2FHH5FeD8D/6XyNj41ozQDameUGkI81m9+ntccr8jQSaeA83KHGcQ3f4MdwtTDKd:2h5AD876CNmhza9V88A8rcw4MdmxqA
Score
10/10
Malware Config
Signatures
-
Chimera 47 IoCs
Ransomware which infects local and network files, often distributed via Dropbox links.
description flow ioc Process File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe 8 bot.whatismyipaddress.com Process not Found File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\VideoLAN\VLC\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jre1.8.0_66\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt Chi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jre1.8.0_66\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jre1.8.0_66\lib\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe -
Chimera Ransomware Loader DLL 1 IoCs
Drops/unpacks executable file which resembles Chimera's Loader.dll.
resource yara_rule behavioral2/memory/3484-3-0x0000000010000000-0x0000000010010000-memory.dmp chimera_loader_dll -
Renames multiple (200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 bot.whatismyipaddress.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\hy.txt Chi.exe File opened for modification C:\Program Files\7-Zip\readme.txt Chi.exe File created C:\Program Files\7-Zip\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt Chi.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf Chi.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jvm.hprof.txt Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt Chi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\office.odf Chi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\index.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt Chi.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\office.odf Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt Chi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Third Party Notices.txt Chi.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf Chi.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\List.txt Chi.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_US\List.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt Chi.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt Chi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt Chi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt Chi.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt Chi.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jvm.hprof.txt Chi.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\YOUR_FILES_ARE_ENCRYPTED.HTML Chi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt Chi.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3484 Chi.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD58401affed8b638de39ec8b09b93de45a
SHA1cb8abef5f13c85b04ca68fb347c2c9df6322c547
SHA25673e6b5f07d864073da673271f95f59dfe483eb2d5d49c468e2eac33dc356dcf7
SHA512f2dc095064f040d478bd268035e41bfbc7f9336eca82ed22677134b9ea8a02e9fb8b7f43cb2fc00993cc1ab92e5ab1a4d3beca4162737222ab60f973213acb24