Overview

overview

10

Static

static

10

Chaos Rans...v4.exe

windows10-2004-x64

10

Resubmissions

05-09-2024 01:33

240905-byp63szhkm 10

04-09-2024 16:32

240904-t19mlsvdqd 10

Analysis

  • max time kernel
    95s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-09-2024 01:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Chaos Ransomware Builder v4.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 58 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder v4.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lch3xxip\lch3xxip.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDF1.tmp" "c:\Users\Admin\Downloads\CSCCCBFD3846F3A4DC6B0652CA91648F22F.TMP"
        3⤵
          PID:2236
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4760
      • C:\Users\Admin\Downloads\niggertoucher.exe
        "C:\Users\Admin\Downloads\niggertoucher.exe"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5028
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          2⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:852
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
            3⤵
            • Opens file in notepad (likely ransom note)
            PID:4396

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\RESBDF1.tmp
        Filesize

        1KB

        MD5

        0e4252d920aa4a5911f6baff7230aaca

        SHA1

        b295bf8a1142b4ee00ec471f9825d70fb027f027

        SHA256

        182b29e5b455dcf496b05d505d47bd4000dca5cc33d113aca37c86753bfdf50d

        SHA512

        0014b4aa6b44cd062b0c0574d9b90db8ea0d7e86745446d6db044e1961914ea7e54ceb9c18ce28fb6029183cdc40d96602e4075320360ae1f006961c3bc83087

        Download Submit

      • C:\Users\Admin\Desktop\read_it.txt
        Filesize

        964B

        MD5

        4217b8b83ce3c3f70029a056546f8fd0

        SHA1

        487cdb5733d073a0427418888e8f7070fe782a03

        SHA256

        7d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121

        SHA512

        2a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740

        Download Submit

      • C:\Users\Admin\Downloads\niggertoucher.exe
        Filesize

        23KB

        MD5

        bcfb4aa40387e5a3b00fee9231f0cda0

        SHA1

        e45d4dcd06d636a3f4077cd00d1af34f5739ffcc

        SHA256

        c7b09dd95c16731b3c409cef64e5d98f25695bd0bd36c9bc89cb827baf4f0252

        SHA512

        c104550b3ca29844449b8ad364ab1f65da782b88b36d57009cfcc6b785f02e9287ecb41b93998d983a466c8d74dbfc58abd6e5c8f051d9eeec2d4fbff91e14a0

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\lch3xxip\lch3xxip.0.cs
        Filesize

        30KB

        MD5

        76e03563ee3ab915bce443d213332ee7

        SHA1

        145d7da3c060b50eec81085a8fd05fcc3d849e78

        SHA256

        4c83fba26f2af551ca9044aca13e24ee109228b0c06563ebe75e36a0d294c607

        SHA512

        d40bb7d1d1427557198332d7ccd82182179a5cf2d61d0674f16d1b80104d6a1b111473f32965bbdb48f9e98ac386be5bf0bff7a0f80121bed58e6a482731bc1f

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\lch3xxip\lch3xxip.cmdline
        Filesize

        341B

        MD5

        2a505a8f84e2bb3ec724e708e5fc3c44

        SHA1

        40a02c62625199e5a1fcb07b36b075602990690c

        SHA256

        0fd45f8f20828d8d07a93465094929cbe003a6915a4e57087f57bb885092a220

        SHA512

        b4fd7f92fe9ad65e4483b1257ae197f3b46944dc2417a0cd903d269866283c9af1f4086a4851237130f78ed11a514e3a78036bc57551bab72f0fbaa7e50115ff

        Download Submit

      • \??\c:\Users\Admin\Downloads\CSCCCBFD3846F3A4DC6B0652CA91648F22F.TMP
        Filesize

        1KB

        MD5

        1402bb2aa90da6b8d56ceb0684f4441d

        SHA1

        9b22b04dc7dd0c924648b826d24cef63e5106bfd

        SHA256

        c419a464fb0d9ae5e531e4b145d4796d638bc59cacf8b611319f4095a6266dd0

        SHA512

        95b28eeb7c520e589d15ebcda4069d747bcfb00fdade92515d3b70f452f1e4b92203da779051e213241ea3360d8da4ae04a8c3e3992ce2a8a3ec4c4dc52eb573

        Download Submit

      • memory/4328-5-0x00007FFCB1360000-0x00007FFCB1E21000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4328-6-0x00007FFCB1360000-0x00007FFCB1E21000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4328-7-0x00007FFCB1360000-0x00007FFCB1E21000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4328-0-0x00007FFCB1363000-0x00007FFCB1365000-memory.dmp

        Filesize

        8KB

        Download

      • memory/4328-4-0x00007FFCB1360000-0x00007FFCB1E21000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4328-3-0x00007FFCB1360000-0x00007FFCB1E21000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4328-2-0x00007FFCB1360000-0x00007FFCB1E21000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4328-1-0x0000000000CB0000-0x0000000000D3E000-memory.dmp

        Filesize

        568KB

        Download

      • memory/4328-89-0x00007FFCB1360000-0x00007FFCB1E21000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5028-22-0x0000000000760000-0x000000000076C000-memory.dmp

        Filesize

        48KB

        Download