Overview
overview
9Static
static
7Chaos V3/A...o).exe
windows7-x64
1Chaos V3/A...o).exe
windows10-2004-x64
1Chaos V3/C...V3.exe
windows7-x64
9Chaos V3/C...V3.exe
windows10-2004-x64
9Chaos V3/d...ix.exe
windows7-x64
7Chaos V3/d...ix.exe
windows10-2004-x64
7Chaos V3/f...er.exe
windows7-x64
1Chaos V3/f...er.exe
windows10-2004-x64
1Chaos V3/p...nd.exe
windows7-x64
1Chaos V3/p...nd.exe
windows10-2004-x64
1Analysis
-
max time kernel
1798s -
max time network
1171s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 16:08
Behavioral task
behavioral1
Sample
Chaos V3/Anti-Crash (Anti-Crash method by 13ooeo).exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Chaos V3/Anti-Crash (Anti-Crash method by 13ooeo).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Chaos V3/Chaos Launcher V3.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Chaos V3/Chaos Launcher V3.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Chaos V3/datamodelfix.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Chaos V3/datamodelfix.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
Chaos V3/fpsunlocker.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
Chaos V3/fpsunlocker.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
Chaos V3/pssuspend.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Chaos V3/pssuspend.exe
Resource
win10v2004-20240412-en
General
-
Target
Chaos V3/fpsunlocker.exe
-
Size
666KB
-
MD5
f0c71376e55ba3c65942e90348169921
-
SHA1
239085aa264e9eb743dde706231169820c32e03c
-
SHA256
94f4140b6e7c3e73364205829da26479dad5257752c009dca4dec4a6ce9f9637
-
SHA512
4ce20f764aac880362fbf9f9ade18c89e19eaa697e73cb08ce37b2eb25b3b655ec569de180c33ded00ca42147dd2c84d21b837224b318d56f258a6e881b6057f
-
SSDEEP
12288:4KOjJsDc2+WC+D+4H/xeGofENaTSuGCC709:4KyacgDD+4fwG1NaTSw
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fpsunlocker.exepid process 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe 408 fpsunlocker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
fpsunlocker.exepid process 408 fpsunlocker.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
fpsunlocker.exepid process 408 fpsunlocker.exe