Overview

overview

10

Static

static

8

63ec7434b0...c8.exe

windows7-x64

10

63ec7434b0...c8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2022 15:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63ec7434b06bed61e4029a8592a3be46bf59a533ca7fc44b43486a509d0995c8.exe

  • Size

    446KB

  • MD5

    2cd0b38ee73521578c487b744606c63c

  • SHA1

    9fa52716f72d2950acbbcdc63fb8521cd85e9440

  • SHA256

    63ec7434b06bed61e4029a8592a3be46bf59a533ca7fc44b43486a509d0995c8

  • SHA512

    0ec80eb5d7f41b50c30e2d6211830a27afa37a686cf3b32c7e44aa1ed4461641ff25493299e9493abd7c618e650bf0f0ec71acb637e18ec9f3c671c628920b3e

Score
10/10
dharmapersistenceransomwarespywarestealerupx

Malware Config

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63ec7434b06bed61e4029a8592a3be46bf59a533ca7fc44b43486a509d0995c8.exe
    "C:\Users\Admin\AppData\Local\Temp\63ec7434b06bed61e4029a8592a3be46bf59a533ca7fc44b43486a509d0995c8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Users\Admin\AppData\Local\Temp\63ec7434b06bed61e4029a8592a3be46bf59a533ca7fc44b43486a509d0995c8.exe
      C:\Users\Admin\AppData\Local\Temp\63ec7434b06bed61e4029a8592a3be46bf59a533ca7fc44b43486a509d0995c8.exe
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          4⤵
            PID:2680
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:4884
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3264
          • C:\Windows\system32\mode.com
            mode con cp select=1251
            4⤵
              PID:2204
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:4120
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3932

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      File Deletion

      2
      T1107

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Inhibit System Recovery

      2
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\logs\myeasylog.log
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

        Download Submit
      • memory/632-133-0x0000000000000000-mapping.dmp
        Download
      • memory/632-134-0x0000000000400000-0x0000000000419000-memory.dmp
        Filesize

        100KB

        Download
      • memory/632-139-0x0000000000400000-0x0000000000419000-memory.dmp
        Filesize

        100KB

        Download
      • memory/2204-146-0x0000000000000000-mapping.dmp
        Download
      • memory/2680-142-0x0000000000000000-mapping.dmp
        Download
      • memory/3264-145-0x0000000000000000-mapping.dmp
        Download
      • memory/4120-147-0x0000000000000000-mapping.dmp
        Download
      • memory/4548-131-0x0000000000400000-0x0000000000530000-memory.dmp
        Filesize

        1.2MB

        Download
      • memory/4548-132-0x0000000000630000-0x0000000000663000-memory.dmp
        Filesize

        204KB

        Download
      • memory/4548-141-0x0000000000400000-0x0000000000530000-memory.dmp
        Filesize

        1.2MB

        Download
      • memory/4548-130-0x0000000000400000-0x0000000000530000-memory.dmp
        Filesize

        1.2MB

        Download
      • memory/4884-143-0x0000000000000000-mapping.dmp
        Download
      • memory/5096-140-0x0000000000000000-mapping.dmp
        Download