e746f10a245a5cb3d8bf010dfa30e7de6430e1f248e88d9acbb88596d01c53be

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chimera-1.4/lib/memory_management.py
Size

1KB
MD5

7e35724c32f0edc30dcc579495f036ed
SHA1

947e18e6e88a8d46f966511f3670512beac8b700
SHA256

3af4bc6c1e246fd3f474f60f8797d024fcc094998de1c60dd6b8fc4c4535f9ac
SHA512

423f8291be0f96885f623eec8ff065e52b6daf845d3674442a67517b2a1fae537aace9bc714c8ba8ed01facbca847fb60439960cabd90f140ac4e20cc2eeed39

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2632	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2632	AcroRd32.exe
2632	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2676	2272	cmd.exe	29
PID 2272 wrote to memory of 2676	2272	cmd.exe	29
PID 2272 wrote to memory of 2676	2272	cmd.exe	29
PID 2676 wrote to memory of 2632	2676	rundll32.exe	30
PID 2676 wrote to memory of 2632	2676	rundll32.exe	30
PID 2676 wrote to memory of 2632	2676	rundll32.exe	30
PID 2676 wrote to memory of 2632	2676	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Chimera-1.4\lib\memory_management.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Chimera-1.4\lib\memory_management.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Chimera-1.4\lib\memory_management.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
74bd2aea41eeefefb27bab4c3ec6c08c

SHA1
c6f5754fa26751e0cf8f48d6d542158e5aef8105

SHA256
70c0aceac4cd705a3036baf1ca4ec64fb3386f2723daf0696b45545860b49d06

SHA512
f30dc71ed0c512a23dbf22bed674e8389bcb12f617b82f9bc00fe829deb9022daf78325a3b28bb556bd4d8340541b676497032748d34302df778e91000b309b6

Download Submit