Analysis
- user interaction
yes - max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 23:21
General
- Target ChimiEngine/ChimiEngine.exe
- Size 49KB
- Sample261029-3cacaatz4n
- SHA256 f1bbc490831d481c5083d9f5f5b2d78602d43ff2c1d0337a947ca00be0efd946
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChimiEngine\ChimiEngine.exe"C:\Users\Admin\AppData\Local\Temp\ChimiEngine\ChimiEngine.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ChimiEngine\runtime\bin\javaw.exe"C:\Users\Admin\AppData\Local\Temp\ChimiEngine\runtime\bin\javaw.exe" -Xmx1g -jar "C:\Users\Admin\AppData\Local\Temp\ChimiEngine\ChimiEngine.jar"2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1228-55-0x0000024F612D0000-0x0000024F612E0000-memory.dmp
memory/1228-57-0x0000024F612E0000-0x0000024F612F0000-memory.dmp
memory/1228-59-0x0000024F612F0000-0x0000024F61300000-memory.dmp
memory/1228-17-0x0000024F68A90000-0x0000024F68D00000-memory.dmp
memory/1228-29-0x0000024F68500000-0x0000024F68770000-memory.dmp
memory/1228-30-0x0000024F60FD0000-0x0000024F61240000-memory.dmp
memory/1228-31-0x0000024F68A90000-0x0000024F68D00000-memory.dmp
memory/1228-33-0x0000024F61240000-0x0000024F61250000-memory.dmp
memory/1228-35-0x0000024F61250000-0x0000024F61260000-memory.dmp
memory/1228-36-0x0000024F61240000-0x0000024F61250000-memory.dmp
memory/1228-37-0x0000024F61250000-0x0000024F61260000-memory.dmp
memory/1228-39-0x0000024F61260000-0x0000024F61270000-memory.dmp
memory/1228-40-0x0000024F61260000-0x0000024F61270000-memory.dmp
memory/1228-42-0x0000024F61270000-0x0000024F61280000-memory.dmp
memory/1228-44-0x0000024F61280000-0x0000024F61290000-memory.dmp
memory/1228-45-0x0000024F61280000-0x0000024F61290000-memory.dmp
memory/1228-47-0x0000024F61290000-0x0000024F612A0000-memory.dmp
memory/1228-49-0x0000024F612A0000-0x0000024F612B0000-memory.dmp
memory/1228-51-0x0000024F612B0000-0x0000024F612C0000-memory.dmp
memory/1228-53-0x0000024F612C0000-0x0000024F612D0000-memory.dmp
memory/1228-6-0x0000024F68500000-0x0000024F68770000-memory.dmp
memory/1228-91-0x0000024F613A0000-0x0000024F613B0000-memory.dmp
memory/1228-16-0x0000024F60FD0000-0x0000024F61240000-memory.dmp
memory/1228-61-0x0000024F61300000-0x0000024F61310000-memory.dmp
memory/1228-64-0x0000024F61310000-0x0000024F61320000-memory.dmp
memory/1228-67-0x0000024F61320000-0x0000024F61330000-memory.dmp
memory/1228-73-0x0000024F612A0000-0x0000024F612B0000-memory.dmp
memory/1228-72-0x0000024F61340000-0x0000024F61350000-memory.dmp
memory/1228-71-0x0000024F61330000-0x0000024F61340000-memory.dmp
memory/1228-70-0x0000024F61290000-0x0000024F612A0000-memory.dmp
memory/1228-75-0x0000024F612B0000-0x0000024F612C0000-memory.dmp
memory/1228-76-0x0000024F61350000-0x0000024F61360000-memory.dmp
memory/1228-79-0x0000024F61360000-0x0000024F61370000-memory.dmp
memory/1228-78-0x0000024F612C0000-0x0000024F612D0000-memory.dmp
memory/1228-81-0x0000024F612D0000-0x0000024F612E0000-memory.dmp
memory/1228-82-0x0000024F61370000-0x0000024F61380000-memory.dmp
memory/1228-84-0x0000024F612E0000-0x0000024F612F0000-memory.dmp
memory/1228-85-0x0000024F61380000-0x0000024F61390000-memory.dmp
memory/1228-88-0x0000024F61390000-0x0000024F613A0000-memory.dmp
memory/1228-87-0x0000024F612F0000-0x0000024F61300000-memory.dmp
memory/1228-90-0x0000024F61300000-0x0000024F61310000-memory.dmp
memory/3356-0-0x00007FF64A240000-0x00007FF64A254000-memory.dmp