Overview

overview

10

Static

static

10

BuilderCha...re.exe

windows10-2004-x64

10

Resubmissions

01/04/2025, 18:11

250401-wssegawl13 10

01/04/2025, 18:09

250401-wrkm8sttcv 10

Analysis

  • max time kernel
    82s
  • max time network
    68s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2025, 18:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BuilderChaosRansomware.exe

  • Size

    550KB

  • MD5

    8b855e56e41a6e10d28522a20c1e0341

  • SHA1

    17ea75272cfe3749c6727388fd444d2c970f9d01

  • SHA256

    f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

  • SHA512

    eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

  • SSDEEP

    3072:9UJAYdi2YcRVm16Pn6tpzqJG/sX9i2YcRPm16Pn6ckCjSH5EyR9aKZt18rTu+i2S:9aiWm162qJEsNiym16ryAiym168

Score
10/10
chaosransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Chaos family
    chaos
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 57 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BuilderChaosRansomware.exe
    "C:\Users\Admin\AppData\Local\Temp\BuilderChaosRansomware.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sc4e0gr5\sc4e0gr5.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2863.tmp" "c:\Users\Admin\Downloads\CSC1E8FF9E984B14EE4A0583C6996162464.TMP"
        3⤵
          PID:3812
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3488
      • C:\Users\Admin\Downloads\Test.exe
        "C:\Users\Admin\Downloads\Test.exe"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1300
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          2⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2452
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
            3⤵
            • Opens file in notepad (likely ransom note)
            PID:2272

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\RES2863.tmp
        Filesize

        1KB

        MD5

        acef0b89c8665a86f70497175dac8806

        SHA1

        6813f3692da08c1137e2d912bd8e57ecf21b9e12

        SHA256

        ff895f654c8d08b53e69340a6753ba13dee61bcebdf97ef53b4b1d0ef6fba143

        SHA512

        211f813e511d61651276e610829e6f249749adf2d53926a3d61379541ce486682d948a325e271e411c07452ffd22a9f639cfa2b4069b4fa2f5cddbe09975e876

        Download Submit

      • C:\Users\Admin\Desktop\read_it.txt
        Filesize

        964B

        MD5

        4217b8b83ce3c3f70029a056546f8fd0

        SHA1

        487cdb5733d073a0427418888e8f7070fe782a03

        SHA256

        7d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121

        SHA512

        2a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740

        Download Submit

      • C:\Users\Admin\Downloads\Test.exe
        Filesize

        22KB

        MD5

        779e47030320ae4fe065c05036eccf7c

        SHA1

        94acb06bd4f546897c48b2d70026649904274000

        SHA256

        c86021dae3da21d9a16f6e77f8d17600e48a2768a476e750113c4e6d59b600c2

        SHA512

        9f307036f78ac921a667df86c4204bbc2fe1bf4c23b276405eed1446a500b4a9a30df70ac985790381e1f3381c8dd2f65e29f2385514aa116cf50e85d5ba385a

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\sc4e0gr5\sc4e0gr5.0.cs
        Filesize

        30KB

        MD5

        76e03563ee3ab915bce443d213332ee7

        SHA1

        145d7da3c060b50eec81085a8fd05fcc3d849e78

        SHA256

        4c83fba26f2af551ca9044aca13e24ee109228b0c06563ebe75e36a0d294c607

        SHA512

        d40bb7d1d1427557198332d7ccd82182179a5cf2d61d0674f16d1b80104d6a1b111473f32965bbdb48f9e98ac386be5bf0bff7a0f80121bed58e6a482731bc1f

        Download Submit

      • \??\c:\Users\Admin\AppData\Local\Temp\sc4e0gr5\sc4e0gr5.cmdline
        Filesize

        332B

        MD5

        53d12b3473501ee86e727a6b84d0f845

        SHA1

        b2082043491f0a476a2e6193a5cc78e19a51f5cf

        SHA256

        eddf42df7dc5bb1e3cb2eb1715dfc2a4d6d0c1b692ca9bed885770c43dbbb372

        SHA512

        ce42056fe10a15e27b4d3670acc9c59ea1f64a1272e16ae7b550e0d291e1680ecd2004fa5cb499435a0654e11373348f95956e13a3f1f62a6a29ab820884f9d0

        Download Submit

      • \??\c:\Users\Admin\Downloads\CSC1E8FF9E984B14EE4A0583C6996162464.TMP
        Filesize

        1KB

        MD5

        53f9528956eec96f97dfe47f140d0c73

        SHA1

        0dbfca8b4416085afd7705fa57461c80efe43c68

        SHA256

        bab68b1c606914d4e578edc547ccb57aabc0356167aabd92c8456612e7d39d44

        SHA512

        c0fb66b2bf84fea7f867f5214d2c50f8e41ae35c51da082080043dc9d7242f67874ebb93c51d54d0242ff0361525e2ed348b3d29141a2e520105864c010c4d16

        Download Submit

      • memory/1300-23-0x0000000000CC0000-0x0000000000CCC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/3876-4-0x00007FFAE0793000-0x00007FFAE0795000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3876-8-0x00007FFAE0790000-0x00007FFAE1251000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3876-7-0x00007FFAE0790000-0x00007FFAE1251000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3876-6-0x00007FFAE0790000-0x00007FFAE1251000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3876-5-0x00007FFAE0790000-0x00007FFAE1251000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3876-0-0x00007FFAE0793000-0x00007FFAE0795000-memory.dmp

        Filesize

        8KB

        Download

      • memory/3876-3-0x00007FFAE0790000-0x00007FFAE1251000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3876-2-0x00007FFAE0790000-0x00007FFAE1251000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3876-1-0x00000000008E0000-0x000000000096E000-memory.dmp

        Filesize

        568KB

        Download