Extracted

• • Target
    https://www.dropbox.com/scl/fo/qy2qk79x2gtuwswxjxcla/h?rlkey=9ophpx1zlqaopl8j3d53sf3wi&dl=0

  Score

  10^/10

  dharmamodiloaderremcosrevengerathostdiscoveryevasionmacromacro_on_actionmotwpersistencephishingransomwareratspywarestealertrojanupx

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • UAC bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • ModiLoader First Stage

  • Renames multiple (553) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • RevengeRat Executable

    stealer

  • Contacts a large (645) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1