Overview

overview

10

Static

static

10

_98cc01dcd...39.exe

windows10-2004-x64

10

_98cc01dcd...39.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 15:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39.exe
  • Size 6.0MB
  • Sample260604-sfpw2ahs41
  • SHA256 98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoveryevasionembargoransomwarespywarestealer

Malware Config

Extracted

Path

  • F:\$RECYCLE.BIN\S-1-5-21-2409539145-3342400454-2096821238-1000\HOW_TO_RECOVER_FILES.txt

Ransom Note
  • Your network has been chosen for Security Audit by EMBARGO Team. We successfully infiltrated your network, downloaded all important and sensitive documents, files, databases, and encrypted your systems. You must contact us before the deadline 2024-05-21 06:25:37 +0000 UTC, to decrypt your systems and prevent your sensitive information from disclosure on our blog: http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/ Do not modify any files or file extensions. Your data maybe lost forever. Instructions: 1. Download torbrowser: https://www.torproject.org/download/ 2. Go to your registration link: ================================= http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8 ================================= 3. Register an account then login If you have problems with this instructions, you can contact us on TOX: 9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47 After payment for our services, you will receive: - decrypt app for all systems - proof that we delete your data from our systems - full detail pentest report - 48 hours support from our professional team to help you recover systems and develop Disaster Recovery plan IMPORTANT: After 2024-05-21 06:25:37 +0000 UTC deadline, your registration link will be disabled and no new registrations will be allowed. If no account has been registered, your keys will be deleted, and your data will be automatically publish to our blog and/or sold to data brokers. WARNING: Speak for yourself. Our team has many years experience, and we will not waste time with professional negotiators. If we suspect you to speaking by professional negotiators, your keys will be immediate deleted and data will be published/sold.
URLs

  • http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion/

  • http://5ntlvn7lmkezscee2vhatjaigkcu2rzj3bwhqaz32snmqc4jha3gcjad.onion/#/37f1061d6f6281a4598f130979ad77c8

Signatures

  • Family: Embargo Ransomware

    A Rust-based ransomware first observed in 2024.

    ransomwareembargo
  • Embargo Ransomware 2 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Renames multiple (8758) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\_98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39.exe
    "C:\Users\Admin\AppData\Local\Temp\_98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /q /c bcdedit /set {default} recoveryenabled no
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:5028
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /q /c ping localhost -n 5 > nul & del C:\Users\Admin\AppData\Local\Temp\_98cc01dcd4c36c47fc13e4853777ca170c734613564a5a764e4d2541a6924d39.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:12632
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 5
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:18284

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        HOW_TO_RECOVER_FILES.txt
        • Path F:\$RECYCLE.BIN\S-1-5-21-2409539145-3342400454-2096821238-1000\HOW_TO_RECOVER_FILES.txt
        • Size 1KB
        • SHA256 a9db836bdbf007aa6b13cfb9ad280be457138db4464990356d682128c3d2a0be
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3372-15241-0x0000000000B40000-0x0000000001150000-memory.dmp
        Download

        memory/3372-29789-0x0000000000B40000-0x0000000001150000-memory.dmp
        Download