Overview

overview

10

Static

static

7

1c5e1d9991...cs.exe

windows7-x64

10

1c5e1d9991...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 23:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1c5e1d99914b1ab4ee2ab0cb2f797180_NeikiAnalytics.exe

  • Size

    70KB

  • MD5

    1c5e1d99914b1ab4ee2ab0cb2f797180

  • SHA1

    a198fbb7f17c66573282dfad0b9f6806afe5879e

  • SHA256

    2c12a87761f5477679ddfe8440b5bd0170919f5b3b0ed5bc8f89fde58609abd8

  • SHA512

    cacd476abcd12e02ee768457c4280c8dbdb89a2a230c5b2306df46fa6146e86d74c9cb3ff1f6c608806210dc6ba6abc676e480d39dbb424447730966632f48d6

  • SSDEEP

    1536:/clu3E0ty5RM6EUJZWxZB2w+iQkz927b3zGXyneTr:iu3NURAUSxZcw+iB9O6CeT

Score
10/10
dharmadefense_evasionexecutionimpactpersistenceransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (513) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c5e1d99914b1ab4ee2ab0cb2f797180_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1c5e1d99914b1ab4ee2ab0cb2f797180_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3092
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:4880
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:5144
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:304
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:6188
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:7460
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
            PID:7620
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            2⤵
              PID:1992
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:6704

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Initial Access

          Execution

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Indicator Removal

          2
          T1070

          File Deletion

          2
          T1070.004

          Modify Registry

          1
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Exfiltration

          Command and Control

          Impact

          Inhibit System Recovery

          2
          T1490

          Resource Development

          Reconnaissance

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-8C33C5D4.[[email protected]].rxx
            Filesize

            2.7MB

            MD5

            561dd7362dd3f2a8cffa531e2a7d8732

            SHA1

            6f34c019e452118c45b6595d94c88c49c89d5eae

            SHA256

            38b7219bfcba2b32ca52a8f7afc2867c82d4f7c315ba7d8499dd0ab708ab45fe

            SHA512

            164e5f1c61ecfa60380db93e212cabae325e60f4f77e6b83f186279fc81956668c1d81854354cf47c4202159690aa0b7915e6a463fd3b2115050850d5d6aadf6

            Download Submit
          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
            Filesize

            7KB

            MD5

            10407c097d89ec2360e0ca3de2c2ce3f

            SHA1

            3b11542b3127b7e3cabf966acc8d4f1c81d6fbda

            SHA256

            702a375f8af2372561211566a19a075b8f7f5a8c21f74860b1be20994eaf8c5d

            SHA512

            8b022aa8de1e38f4e7350787616d4809f97acd29118ce646ff3446479450ed1c5c271b4285921bc5ce9ac8d27c7fda1d45b0b9eb5de3b701f0f569333bfcd412

            Download Submit
          • memory/2376-0-0x0000000000400000-0x000000000041D000-memory.dmp
            Filesize

            116KB

            Download
          • memory/2376-10244-0x0000000000400000-0x000000000041D000-memory.dmp
            Filesize

            116KB

            Download