chaos

General

Target

lime.ndll
Size

7.8MB
Sample

240711-q2ks4ayenk
MD5

10c074a00debe4a97608e78cb36247ab
SHA1

779125eb7faef7e549eff67eeb55c177a8dfbc70
SHA256

2c1d1c6cc6fea441623d1cdc663656f171fa66d92809a157915c2ada06a121cf
SHA512

86080ba0ad936148f46f3cc56c8b5c474c72b9089657e7bd21286a2a2114eb07f20870e0dd96318685024ab929d17a382529c383049b7bd056553c4565473485
SSDEEP

98304:z0A/ndXX+HO+M16KrdFLJRzdfiHy4AyBS6iHIA198:z0wXX+Hc1nrtRgz

Score

10^/10

Malware Config

Targets

- Target
  
  lime.ndll
- Size
  
  7.8MB
- MD5
  
  10c074a00debe4a97608e78cb36247ab
- SHA1
  
  779125eb7faef7e549eff67eeb55c177a8dfbc70
- SHA256
  
  2c1d1c6cc6fea441623d1cdc663656f171fa66d92809a157915c2ada06a121cf
- SHA512
  
  86080ba0ad936148f46f3cc56c8b5c474c72b9089657e7bd21286a2a2114eb07f20870e0dd96318685024ab929d17a382529c383049b7bd056553c4565473485
- SSDEEP
  
  98304:z0A/ndXX+HO+M16KrdFLJRzdfiHy4AyBS6iHIA198:z0wXX+Hc1nrtRgz
Score

10^/10

chaos defense_evasion evasion execution impact ransomware discovery persistence privilege_escalation spyware stealer trojan
- Chaos
  Ransomware family first seen in June 2021.
  ransomware chaos
- Chaos Ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2