Overview

overview

10

Static

static

10

Red-Flaged...3b.exe

windows10-2004-x64

10

Red-Flaged...3b.exe

windows11-ltsc_2024-x64

10

Red-Flaged...6a.exe

windows10-2004-x64

10

Red-Flaged...6a.exe

windows11-ltsc_2024-x64

10

Red-Flaged...eb.exe

windows10-2004-x64

10

Red-Flaged...eb.exe

windows11-ltsc_2024-x64

10

Red-Flaged...02.exe

windows10-2004-x64

10

Red-Flaged...02.exe

windows11-ltsc_2024-x64

10

Red-Flaged...c5.exe

windows10-2004-x64

10

Red-Flaged...c5.exe

windows11-ltsc_2024-x64

10

Red-Flaged...37.exe

windows10-2004-x64

10

Red-Flaged...37.exe

windows11-ltsc_2024-x64

10

Red-Flaged...e7.exe

windows10-2004-x64

10

Red-Flaged...e7.exe

windows11-ltsc_2024-x64

10

Red-Flaged...64.exe

windows10-2004-x64

8

Red-Flaged...64.exe

windows11-ltsc_2024-x64

8

Red-Flaged...5d.exe

windows10-2004-x64

10

Red-Flaged...5d.exe

windows11-ltsc_2024-x64

10

Red-Flaged...d6.exe

windows10-2004-x64

10

Red-Flaged...d6.exe

windows11-ltsc_2024-x64

10

Red-Flaged...e7.exe

windows10-2004-x64

10

Red-Flaged...e7.exe

windows11-ltsc_2024-x64

10

Red-Flaged...d8.exe

windows10-2004-x64

10

Red-Flaged...d8.exe

windows11-ltsc_2024-x64

10

Red-Flaged...55.exe

windows10-2004-x64

10

Red-Flaged...55.exe

windows11-ltsc_2024-x64

10

Red-Flaged...bc.exe

windows10-2004-x64

10

Red-Flaged...bc.exe

windows11-ltsc_2024-x64

10

Red-Flaged...6a.exe

windows10-2004-x64

10

Red-Flaged...6a.exe

windows11-ltsc_2024-x64

10

Red-Flaged...03.exe

windows10-2004-x64

10

Red-Flaged...03.exe

windows11-ltsc_2024-x64

10

Resubmissions

20/09/2026, 10:36

260920-mnczjsab7710

20/09/2026, 07:07

260920-hx3jcadp5x10

08/09/2026, 15:38

260908-s27nzagd93

15/08/2026, 21:05

260815-zw6ytat1ez

15/08/2026, 20:50

260815-zmxnsatzgs

15/08/2026, 20:46

260815-zkklfatcnf

15/08/2026, 20:40

260815-zf5e2stcjb

15/08/2026, 20:39

260815-zfqlwstydz

14/08/2026, 18:03

260814-wm9fssyyev

06/08/2026, 22:09

260806-124lbabl4s

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Red-Flaged/df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe
  • Size 418KB
  • Sample260712-p5a8dsas8k
  • SHA256 df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverydevmanransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\ProgramData\readme.txt

  • devman

Ransom Note
  • Good afternoon, As you can see you have been attacked by a ransomware program! We The DragonForce Ransomware Cartel offer you to make a deal with us. We can make a deal with you, all you need to do is contact us by following the instructions below. We are in no way connected to politics, we always keep our word. You have a chance to decrypt your files and avoid being published on our blog! Use this opportunity and also don't waste your time. The approximate date of deletion of the decryptor program, as well as publication on our blog 08/05/2025 00:00 UTC. - # 1 Communication Process, In order to contact us you need to click on the special link below, which is listed in #2. After that the negotiation process begins, in which you have the opportunity to request several things from us, 1. make a test decrypt. 2. get a list of the files stolen from you. At the conclusion of our negotiations we agree on a price, we set the price ourselves based on your income/your insurance. We scrutinize your documents and are well aware of how much income your company has per year. - # 2 Access to the meeting room, To access us please download Tor Browser which is available here. (https://www.torproject.org/) Once you download the special anonymous browser you need to follow this link, http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion Your unique ID: 64BF675FE526B88464BF675FE526B884 - use it to enter our meeting room. - # 3 Additional Support Contacts, Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 - # 4 Recommendations, Do not try to recover your files with third-party programs, you will only do harm. Do not turn off / reboot your computer. Be courteous in our meeting room. Do not procrastinate. - # 5 Blog and News, Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion DragonNews: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/news
URLs

  • http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion

  • http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion

  • http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/news

Signatures

  • Family: Devman

    Devman is a ransomware forked from the DragonForce ransomware.

    ransomwaredevman
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Red-Flaged\df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe
    "C:\Users\Admin\AppData\Local\Temp\Red-Flaged\df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{99F3F33E-051D-4963-8254-34376AE7C8C0}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{99F3F33E-051D-4963-8254-34376AE7C8C0}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2496
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4068

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        readme.txt
        • Path C:\ProgramData\readme.txt
        • Size 1KB
        • SHA256 f26bb5d17eff4a6566e09783d21ff40db7d5c7ec8f2e76681ab72e9f992dd7ad
        • MD5 SHA1 SHA512 TLSH
        Submit Download