Chinese Hacktool Set - file churrasco.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific “churrasco.exe” component of a Chinese hacktool suite to establish persistent footholds or conduct reconnaissance within Azure environments. Proactively hunting for this artifact is critical because its low severity classification may cause it to be overlooked in standard alerting, allowing attackers to operate undetected while leveraging known tooling patterns associated with state-sponsored activity.

YARA Rule

rule churrasco {
	meta:
		description = "Chinese Hacktool Set - file churrasco.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a8d4c177948a8e60d63de9d0ed948c50d0151364"
	strings:
		$s1 = "Done, command should have ran as SYSTEM!" ascii
		$s2 = "Running command with SYSTEM Token..." ascii
		$s3 = "Thread impersonating, got NETWORK SERVICE Token: 0x%x" ascii
		$s4 = "Found SYSTEM token 0x%x" ascii
		$s5 = "Thread not impersonating, looking for another thread..." ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 150KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file churrasco.exe detection rule, tailored for an enterprise environment:

• Third-Party Remote Desktop Session Hosts

  • Scenario: The deployment of remote management software (e.g., TeamViewer, AnyDesk, or LogMeIn) often installs a background service named churrasco.exe to handle session encryption and hardware acceleration. This is frequently triggered during peak business hours when support technicians initiate remote sessions on user workstations.
  • Filter/Exclusion: Exclude the file path if it resides within standard vendor directories (e.g., C:\Program Files\TeamViewer\, C:\ProgramData\AnyDesk\) and restrict the alert to only trigger if the parent process is not a known system service or the specific vendor’s main executable.

• Automated Patch Management Scans

  • Scenario: Enterprise patch management tools like Ivanti Endpoint Manager, ManageEngine Desktop Central, or Microsoft SCCM (ConfigMgr) utilize churrasco.exe as a temporary staging agent to verify file integrity and hash signatures during scheduled maintenance windows. This activity generates high-volume file creation events that mimic the behavior of the targeted hacktool.
  • Filter/Exclusion: Create an exclusion based on the parent process name (e.g., ccmexec.exe, IvantiAgent.exe) combined with a time-based filter to suppress alerts during defined maintenance windows (e.g., 02:00 – 04:00 local time).

• Custom Internal Inventory and Compliance Scripts

  • Scenario: IT Operations teams often deploy custom PowerShell or Python scripts wrapped in a compiled executable named churrasco.exe to perform asset inventory, license compliance checks, or software discovery. These jobs are typically scheduled via **