Overview

overview

10

Static

static

10

2026-10-15...ex.exe

windows10-2004-x64

10

2026-10-15...ex.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/10/2026, 09:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-15_9ad96acb6fd24d7cb641253580a99bc6_coinminer_crysis_dharma_elex.exe
  • Size 92KB
  • Sample261016-llk2pswt9k
  • SHA256 48f6ce1fc9ba2409e876f8d075bddf76ba1576433558ab3733914a9600b5f1d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutiondharmaimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Windows\System32\Info.hta

Ransom Note
  • <!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='UTF-8'> <title>[email protected]</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body {font:15px Tahoma;margin:10px;line-height:20px;background:#FFFFF0;color:#000000} .bold {font-weight:bold;} .mark {color:#000000;padding:8px 10px;} img {display:block;margin:auto;} .header {text-align:center;font-size:30px;line-height:75px;font-weight:bold;margin-bottom:20px;} .info {background:#c0c2bc;border-left:10px solid #FFE4E4;} .alert {background:#008080;border-left:40px solid #FF4500;} .private {border:5px dashed #000000;background:#000FEF;} .note {height:auto;padding-bottom:5px;margin:15px 0;} .note .title {font-weight:bold;text-indent:10px;height:30px;line-height:30px;padding-top:10px;} .note .mark {background:#A2A2B5;} .note ul {margin-top:0;} .note pre {margin-left:15px;line-height:13px;font-size:13px;}</style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files has been encrypted!</div> </div> <div class='bold'>Don't worry, you can return all your files!</span></div> <div class='bold'>If you want to restore them, contact us:<span class='mark'> [email protected] </span> YOUR ID <body bgcolor=#00FFFF> <font color=#000000>0B1A65C9</font></div> <div class='bold'> <body> If you have not answered by mail within 12 hours, contact mail:<span class='mark'>[email protected]</span></div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. </ul> <ul>The total size of files must be less than 3Mb (non archived), files should not contain valuable information. (databases,backups, large excel sheets, etc.)</ul> </div> <div class='note info'> <div class='title'>Some of your data has been downloaded</div> <ul> <br>In case if you refuse to cooperate all downloaded data will be transfered to third parties.</ul> <ul>Financial implications: The threat of data breach could result in significant fines and legal action.</ul> <ul>Reputational risks: Data breach may lead to a loss of trust from customers and partners, as well as negative consequences for your future work.</ul> <ul>We strongly recommend you to contact us directly, to avoid the extra fee from middlemans and lower the risks of scam.</ul> <br><a href=</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul>Do not rename encrypted files.</ul> <ul>Do not try to decrypt your data using third party software, it may cause permanent data loss.</ul> <ul>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</ul> </div> </body>
Emails
URLs

  • http://www.w3.org/TR/html4/strict.dtd'>

Signatures

  • Family: Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects win.dharma. 1 IoCs
  • Identifies DHARMA ransomware 4 IoCs
  • Renames multiple (852) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Creates a file in the Startup directory 1 TTPs 5 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-15_9ad96acb6fd24d7cb641253580a99bc6_coinminer_crysis_dharma_elex.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-15_9ad96acb6fd24d7cb641253580a99bc6_coinminer_crysis_dharma_elex.exe"
    1⤵
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5948
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5772
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:2420
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2888
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:4508
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:4876
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
            PID:4564
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            2⤵
              PID:3404
          • C:\Windows\System32\2026-10-15_9ad96acb6fd24d7cb641253580a99bc6_coinminer_crysis_dharma_elex.exe
            C:\Windows\System32\2026-10-15_9ad96acb6fd24d7cb641253580a99bc6_coinminer_crysis_dharma_elex.exe
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1092
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:956

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Windows Management Instrumentation

                1
                T1047

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Defense Evasion

                Direct Volume Access

                1
                T1006

                Indicator Removal

                2
                T1070

                File Deletion

                2
                T1070.004

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                2
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Windows Credential Manager

                1
                T1555.004

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                System Information Discovery

                1
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Inhibit System Recovery

                2
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                appvcleaner.exe.id-0B1A65C9.[[email protected]].has
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-0B1A65C9.[[email protected]].has
                • Size 2.9MB
                • SHA256 a9e27a20c4e5db0f6167bb6bf564644377ded05014378a05abaec59cb1dc6193
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                osmia64.msi.id-0B1A65C9.[[email protected]].has
                • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia64.msi.id-0B1A65C9.[[email protected]].has
                • Size 4.1MB
                • SHA256 604138bcb7f16821bf5b915dae4b088115e7ff5f0a5023dd2658657c5e9ad050
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mfc140u.dll.id-0B1A65C9.[[email protected]].has
                • Path C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140u.dll.id-0B1A65C9.[[email protected]].has
                • Size 5.6MB
                • SHA256 653750f1b44fef31b4640015d08d6e442d7f636ab52c63cb39b5f37a61987b1b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mfc140u.dll.id-0B1A65C9.[[email protected]].has
                • Path C:\Program Files\Microsoft Office\root\vfs\System\mfc140u.dll.id-0B1A65C9.[[email protected]].has
                • Size 6.3MB
                • SHA256 d1e64bbb4551249ce4209a9a7f7888e528bfc698dbf880dd54e72ad63f16ac52
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ApproveSave.rle.id-0B1A65C9.[[email protected]].has
                • Path C:\Users\Admin\Downloads\ApproveSave.rle.id-0B1A65C9.[[email protected]].has
                • Size 880KB
                • SHA256 fd3056171750d9a49b14a0e4b8dbc1fda83fe3a669978f2278ba1be4f6eb40b7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DisableMount.emz.id-0B1A65C9.[[email protected]].has
                • Path C:\Users\Admin\Downloads\DisableMount.emz.id-0B1A65C9.[[email protected]].has
                • Size 462KB
                • SHA256 7a70f35dd954076dfa6f6124ffaebbdb4ee4a84de6d62fe41267d500c17d4555
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                desktop.ini.id-0B1A65C9.[[email protected]].has
                • Path C:\Users\Admin\Downloads\desktop.ini.id-0B1A65C9.[[email protected]].has
                • Size 522B
                • SHA256 5e465e67df1da4f9e4f460cb693e719d873a9ef7d05e77aff06da65dbaee7214
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                2026-10-15_9ad96acb6fd24d7cb641253580a99bc6_coinminer_crysis_dharma_elex.exe
                • Path C:\Windows\System32\2026-10-15_9ad96acb6fd24d7cb641253580a99bc6_coinminer_crysis_dharma_elex.exe
                • Size 92KB
                • SHA256 48f6ce1fc9ba2409e876f8d075bddf76ba1576433558ab3733914a9600b5f1d8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Info.hta
                • Path C:\Windows\System32\Info.hta
                • Size 4KB
                • SHA256 5699db0399dbdcdb534a0e52099b74b657124ede490fd0a7b4fe1b02fb59377b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                info.txt
                • Path F:\info.txt
                • Size 198B
                • SHA256 404663842e832d2bf00e567557478fafca9cc55bac91700301ed28aa91f772ce
                • MD5 SHA1 SHA512 TLSH
                Submit Download