Overview

overview

9

Static

static

7

Chaos.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    13s
  • max time network
    12s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22/04/2024, 02:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Chaos.exe
  • Size 14.0MB
  • Sample240422-ckad5sec25
  • SHA256 1ee3f47c9d057cfcbc3620a9a44f8050928ba7fe4f0c9fc81c92a57a54107508
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 21 IoCs
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\Chaos.exe
      "C:\Users\Admin\AppData\Local\Temp\Chaos.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4840
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c
        3⤵
          PID:4060
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:4116
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            3⤵
              PID:3060

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
              • Size 120KB
              • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              cacert.pem
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
              • Size 285KB
              • SHA256 7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              md__mypyc.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd
              • Size 116KB
              • SHA256 3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libcrypto-1_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
              • Size 3.3MB
              • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
              • Size 34KB
              • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libssl-1_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll
              • Size 686KB
              • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
              • Size 28KB
              • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              unicodedata.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
              • Size 1.1MB
              • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              backend_c.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd
              • Size 512KB
              • SHA256 b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Chaos.exe
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\Chaos.exe
              • Size 18.9MB
              • SHA256 bfb77a84d0e78d6e1473f1e2ee5c5587a61b4153028aad79764833cdf5487f78
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\VCRUNTIME140.dll
              • Size 96KB
              • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\_bz2.pyd
              • Size 81KB
              • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\_hashlib.pyd
              • Size 62KB
              • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\_lzma.pyd
              • Size 154KB
              • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\_queue.pyd
              • Size 30KB
              • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\_socket.pyd
              • Size 76KB
              • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\_ssl.pyd
              • Size 155KB
              • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              md.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\charset_normalizer\md.pyd
              • Size 10KB
              • SHA256 790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _psutil_windows.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\psutil\_psutil_windows.pyd
              • Size 65KB
              • SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              python3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\python3.dll
              • Size 64KB
              • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              python311.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1252_133582253755376209\python311.dll
              • Size 5.5MB
              • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/1252-0-0x00007FF8898E0000-0x00007FF889AE9000-memory.dmp
              Download

              memory/1252-3-0x00007FF7D9C60000-0x00007FF7DB043000-memory.dmp
              Download

              memory/1252-2-0x00007FF7D9C60000-0x00007FF7DB043000-memory.dmp
              Download

              memory/1252-1-0x00007FF7D9C60000-0x00007FF7DB043000-memory.dmp
              Download

              memory/1252-75-0x00007FF7D9C60000-0x00007FF7DB043000-memory.dmp
              Download

              memory/4840-76-0x00007FF708DC0000-0x00007FF70A0E4000-memory.dmp
              Download