chaos | 0c7dc8232e38db06a2d6ae99c4e1e3f947981a2a67712e3b28488ebdc92c7cf4

Analysis

user interaction
yes
max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 15:19

Target
Crypted(1).exe
Size 80.0MB
Sample261110-sql8wsyz7n
SHA256 0c7dc8232e38db06a2d6ae99c4e1e3f947981a2a67712e3b28488ebdc92c7cf4
MD5 b9d30a1b78df6f7f562740187318939e
SHA1 a7db068b5fff4e4816be055c4485fcf408c35a44
SHA512 3f038baed076135ee8f09368a1617366b7e48bdb81040a26bb87da5bc9845fde0cb85b2e3cb821b6fc030545f4e668628dc81d0fbaeeb15366b82af8461b974b
SSDEEP 49152:JweUnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnX:dUX
TLSH
T1DB0802A2BF09BBCBCAF94BB4310AA5842C55031CDB196F4009B7B7BCD395907A35953B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chaos ransomware

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/2420-2-0x0000000000400000-0x0000000000448000-memory.dmp	family_chaos
behavioral2/memory/4632-3-0x0000000140000000-0x0000000140097000-memory.dmp	family_chaos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4632 set thread context of 2420	4632	Crypted(1).exe	88

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2420	4632	Crypted(1).exe	88
PID 4632 wrote to memory of 2420	4632	Crypted(1).exe	88
PID 4632 wrote to memory of 2420	4632	Crypted(1).exe	88
PID 4632 wrote to memory of 2420	4632	Crypted(1).exe	88
PID 4632 wrote to memory of 2420	4632	Crypted(1).exe	88
PID 4632 wrote to memory of 2420	4632	Crypted(1).exe	88

C:\Users\Admin\AppData\Local\Temp\Crypted(1).exe
"C:\Users\Admin\AppData\Local\Temp\Crypted(1).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe"
  2⤵
  PID:2420

memory/2420-2-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4632-0-0x0000000140000000-0x0000000140097000-memory.dmp

Download

memory/4632-1-0x00007FFA1BEA0000-0x00007FFA1C103000-memory.dmp

Download

memory/4632-3-0x0000000140000000-0x0000000140097000-memory.dmp

Download