Managed XDR

vtdl_1789808922_c86kqz5g (Dharma) — malware analysis report

File info

Filename
vtdl_1789808922_c86kqz5g
File type
PE32+ executable (console) x86-64, for MS Windows
File size
1.1 MB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
01b184d42d168d153c7c65a0d3bb645e25e3817b
SHA256
127cb224e0cc8ce40b5743c60ef28148180f058bafe4955f16ded97b2cff8968
MD5
184d0eb1b9ae9da1a916605933e1bc14

Malwares

  • Dharma

Signatures

Execution

T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1047 antivm_wmi: Uses WMI to detect virtual environment
T1047 has_wmi: Executes one or several WMI requests

Persistence

T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1562.001 disables_security: Disables Windows Security options
T1564.001 stealth_file: Creates hidden or system files
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1222 icacls: May obtain or change Discretionary access control lists (DACLs)
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497 evasion_diskenum: Sandbox evasion using enumeration of partitions
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1082 has_wmi: Executes one or several WMI requests
T1082 uses_windows_utilities: Uses Windows utilities for basic Windows functionality
T1057 has_wmi: Executes one or several WMI requests
T1057 process_interest: Enumerates processes
T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497 evasion_diskenum: Sandbox evasion using enumeration of partitions
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization

Command and Control

T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Impact

T1486 modifies_files: Cryptolocker indicators detected (renamed 500 or more files)
T1486 modifies_files2: Cryptolocker indicators detected (500 or more files are modified)
T1486 ransomware_files_2: Ransomware(s) Roger indicators detected (creates keys and the instruction on how to unlock the files)
T1486 ransomware_message: Ransomware indicators detected (possible ransom message creation)

Other

suricata_alert: Malicious traffic detected
ransomware_dharma: Detected Dharma ransomware
locker_taskmgr: Disables Windows Task Manager
creates_exe: Creates executable files in the file system
prevents_safeboot: Prevents booting in Safe Mode
copies_self: Creates a copy of itself
ip_domains: Identifies an IP address using external resources
network_bind: Starts servers listening at None
telegram_api: Telegram Messenger API is used
creates_suspended_process: Creates suspended process
break_limit_exceeded: Warning: function calls limit has been exceeded
creates_in_programdata: Creates files in the ProgramData directory
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
writes_data: Writes big amount of data to disk
js_suspicious: Suspicious javascript
yara_rules: Static rules

Related reports