Overview

overview

10

Static

static

10

863809b036...cN.exe

windows7-x64

10

863809b036...cN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    112s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • submitted
    06/10/2024, 05:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    863809b03627315676be588f4027d45989029eb627e7361adbada53adb44345cN.exe

  • Size

    777KB

  • MD5

    d570b2529c442ad6b2c51a727a580800

  • SHA1

    b95185702eb795a6f1e36c1ef6e6fb55ea4b2a17

  • SHA256

    863809b03627315676be588f4027d45989029eb627e7361adbada53adb44345c

  • SHA512

    954d0b529441c4654237da996a69a9e609f66a56f35bb831e356bcf1119401061d287c6e88f658668c6d7fb78db19bb7f4b267ec07231a7020d66c5dff3a5eb3

  • SSDEEP

    12288:SMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9tnIj:SnsJ39LyjbJkQFMhmC+6GD99o

Score
10/10
chaosxredbackdoordefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Path

C:\Users\Admin\Documents\READ_THIS.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted and stolen Your computer was infected with a ransomware virus. Your files have been encrypted and stolen and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $150. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.00240923 BTC Bitcoin Address: bc1q5dct32xckc9352ze647cf8lsv0vjaldp9vpvk6

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 7 IoCs
  • Chaos family
    chaos
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 5 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\863809b03627315676be588f4027d45989029eb627e7361adbada53adb44345cN.exe
    "C:\Users\Admin\AppData\Local\Temp\863809b03627315676be588f4027d45989029eb627e7361adbada53adb44345cN.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Users\Admin\AppData\Local\Temp\._cache_863809b03627315676be588f4027d45989029eb627e7361adbada53adb44345cN.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_863809b03627315676be588f4027d45989029eb627e7361adbada53adb44345cN.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            5⤵
            • Interacts with shadow copies
            PID:3764
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2760
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3916
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} bootstatuspolicy ignoreallfailures
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:4348
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} recoveryenabled no
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:4528
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            5⤵
            • Deletes backup catalog
            PID:3284
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\READ_THIS.txt
          4⤵
          • Opens file in notepad (likely ransom note)
          PID:2308
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1616
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3820
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5016
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1456
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:5088
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4576

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Direct Volume Access

    1
    T1006

    Indicator Removal

    3
    T1070

    File Deletion

    3
    T1070.004

    Modify Registry

    1
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    5
    T1012

    System Information Discovery

    5
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    4
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Synaptics\Synaptics.exe
      Filesize

      777KB

      MD5

      d570b2529c442ad6b2c51a727a580800

      SHA1

      b95185702eb795a6f1e36c1ef6e6fb55ea4b2a17

      SHA256

      863809b03627315676be588f4027d45989029eb627e7361adbada53adb44345c

      SHA512

      954d0b529441c4654237da996a69a9e609f66a56f35bb831e356bcf1119401061d287c6e88f658668c6d7fb78db19bb7f4b267ec07231a7020d66c5dff3a5eb3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\._cache_863809b03627315676be588f4027d45989029eb627e7361adbada53adb44345cN.exe
      Filesize

      23KB

      MD5

      a264ca73aaced0a81a0b7fa14bc201f4

      SHA1

      77a1624cbc6d2d5066f7e23b42f05fd2703fb394

      SHA256

      5404595684deb101a7d8d6a11c104dc1401151149f69cb9a60ebb223b6f7e5b2

      SHA512

      d141ce0021b3352a79eb1401401f072e25fa06773ed567b9922d99967740e07a88e5d5b1daa77a61d9f8a53b51a36441c8e3c1a00a25de203ad05d82b1929ed4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\05B75E00
      Filesize

      23KB

      MD5

      d42b466e674876dc97c985bec0fd9ea0

      SHA1

      057236ebb80c69c5d2e1be6bb02fa5b908ac6298

      SHA256

      2194469a83dfc479524cf156bd41433fce061a67c2dfe997143a155e16b83080

      SHA512

      2f24b6a46dd7af93bc29c30ec10289aec672bc9bbd0c7233d3c3df1eede25d703598130beba6cde47080cda056348986d867d1978c5c91abe1c5f96a0c67f998

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\GOTHb8kX.xlsm
      Filesize

      17KB

      MD5

      e566fc53051035e1e6fd0ed1823de0f9

      SHA1

      00bc96c48b98676ecd67e81a6f1d7754e4156044

      SHA256

      8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

      SHA512

      a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

      Download Submit

    • C:\Users\Admin\Documents\READ_THIS.txt
      Filesize

      985B

      MD5

      46839c94712706c9b4bea9c0b5f89693

      SHA1

      af8af5265aa72bd8c30c63d7999f7f52c738b9ff

      SHA256

      4afb727589a35a9ee9422855723f7e8a6b95a09e72d1683c57f92b3e3e0e9ca6

      SHA512

      afd0bae86ab302883f83f1ab0534fb6a49d45a155e7320958387dc5a2721f854c6cd34f546931ea3b8da932b8f8bb13e0869d42b41684671cd606fb4023db382

      Download Submit

    • memory/1772-130-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

      Download

    • memory/1772-0-0x00000000007C0000-0x00000000007C1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2512-65-0x0000000000D10000-0x0000000000D1C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2512-66-0x00007FFD8B303000-0x00007FFD8B305000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2644-833-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

      Download

    • memory/2644-806-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

      Download

    • memory/2644-407-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

      Download

    • memory/2644-410-0x0000000000540000-0x0000000000541000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2644-131-0x0000000000540000-0x0000000000541000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3820-195-0x00007FFD692F0000-0x00007FFD69300000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3820-198-0x00007FFD669E0000-0x00007FFD669F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3820-197-0x00007FFD669E0000-0x00007FFD669F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3820-196-0x00007FFD692F0000-0x00007FFD69300000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3820-194-0x00007FFD692F0000-0x00007FFD69300000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3820-193-0x00007FFD692F0000-0x00007FFD69300000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3820-192-0x00007FFD692F0000-0x00007FFD69300000-memory.dmp

      Filesize

      64KB

      Download