Overview

overview

9

Static

static

7

Chaos.exe

windows7-x64

9

Chaos.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    30s
  • max time network
    23s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2024, 11:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Chaos.exe
  • Size 14.0MB
  • Sample240422-nv2f6aba2x
  • SHA256 1ee3f47c9d057cfcbc3620a9a44f8050928ba7fe4f0c9fc81c92a57a54107508
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 21 IoCs
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\Chaos.exe
      "C:\Users\Admin\AppData\Local\Temp\Chaos.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c
        3⤵
          PID:2956
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:4820

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
            • Size 81KB
            • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
            • Size 76KB
            • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
            • Size 1.1MB
            • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            backend_c.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd
            • Size 512KB
            • SHA256 b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Chaos.exe
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\Chaos.exe
            • Size 18.9MB
            • SHA256 bfb77a84d0e78d6e1473f1e2ee5c5587a61b4153028aad79764833cdf5487f78
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\VCRUNTIME140.dll
            • Size 96KB
            • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\_ctypes.pyd
            • Size 120KB
            • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\_hashlib.pyd
            • Size 62KB
            • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\_lzma.pyd
            • Size 154KB
            • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\_queue.pyd
            • Size 30KB
            • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\_ssl.pyd
            • Size 155KB
            • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            md.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\charset_normalizer\md.pyd
            • Size 10KB
            • SHA256 790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            md__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\charset_normalizer\md__mypyc.pyd
            • Size 116KB
            • SHA256 3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\libffi-8.dll
            • Size 34KB
            • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\libssl-1_1.dll
            • Size 686KB
            • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\psutil\_psutil_windows.pyd
            • Size 65KB
            • SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\python3.dll
            • Size 64KB
            • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            python311.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\python311.dll
            • Size 5.5MB
            • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_3716_133582598988351128\select.pyd
            • Size 28KB
            • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/3716-1-0x00007FF725D50000-0x00007FF727133000-memory.dmp
            Download

            memory/3716-0-0x00007FFE4B7D0000-0x00007FFE4B9C5000-memory.dmp
            Download

            memory/3716-2-0x00007FF725D50000-0x00007FF727133000-memory.dmp
            Download

            memory/3716-3-0x00007FF725D50000-0x00007FF727133000-memory.dmp
            Download

            memory/3716-74-0x00007FF725D50000-0x00007FF727133000-memory.dmp
            Download

            memory/3716-78-0x00007FFE4B7D0000-0x00007FFE4B9C5000-memory.dmp
            Download

            memory/4532-75-0x00007FF79C020000-0x00007FF79D344000-memory.dmp
            Download