Overview

overview

10

Static

static

3

CoronaVirus.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    8s
  • max time network
    22s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 01:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CoronaVirus.exe

  • Size

    1.0MB

  • MD5

    055d1462f66a350d9886542d4d79bc2b

  • SHA1

    f1086d2f667d807dbb1aa362a7a809ea119f2565

  • SHA256

    dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

  • SHA512

    2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

  • SSDEEP

    24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2

Score
10/10
dharmadiscoverypersistenceransomware

Malware Config

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Dharma family
    dharma
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe
    "C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
        PID:4744
    • C:\Windows\System32\DataExchangeHost.exe
      C:\Windows\System32\DataExchangeHost.exe -Embedding
      1⤵
        PID:32588

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-30D7B771.[[email protected]].ncov
        Filesize

        2.7MB

        MD5

        55089af3956ae7213b9c8618d6e64504

        SHA1

        8e12dafcb9628ea65fc1d324f805584159066b1b

        SHA256

        864f2ec060a629437aeccbc3ffa087ac0d5a7717e54fca42666d7ab5e905b12f

        SHA512

        67aab8d58a9d2a0425e750b7bddb6c65bf2b29cd50517e27f065f609581a0ad434f071e0d503f9bc6dc795bbb129c8c0ee0dedfa4f28d8f9d9c27255ff54546c

        Download Submit

      • memory/4576-0-0x0000000000400000-0x000000000056F000-memory.dmp

        Filesize

        1.4MB

        Download

      • memory/4576-1-0x000000000AC80000-0x000000000ACB4000-memory.dmp

        Filesize

        208KB

        Download

      • memory/4576-3-0x0000000000400000-0x000000000056F000-memory.dmp

        Filesize

        1.4MB

        Download

      • memory/4576-6016-0x0000000000400000-0x000000000056F000-memory.dmp

        Filesize

        1.4MB

        Download