dmalocker | b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c

Analysis

max time kernel
164s
max time network
134s
platform
windows10_x64
resource
win10v20210408
submitted
26-07-2021 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
Size

363KB
MD5

28b44669d6e7bc7ede7f5586a938b1cb
SHA1

8b5afcc257edb2e585fbe5ae9174921bbe51cffd
SHA256

b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c
SHA512

131d4a2baa13e38c3351a49aa3e4630a2766d16333e35b7e6eaf004f3ba46830765af505c5334e7df35e9aaf32bcb917018ea7b6e83f787ce432fe89969f86bd

Score

10^/10

dmalocker persistence ransomware

Malware Config

Extracted

Path

C:\ProgramData\cryptinfo.txt

Ransom Note

Attention! ! ! All of your copies of your system have been permanently deleted and the data on all partitions and workstations have been encrypted! Stay calm. You can recover all your data by making a payment of 1072 GBP in Bitcoin currency in order to receive a decryption key. In order to purchase Bitcions you can use www.coinbase.com After buying BTC send the equivalent of 1072 GBP to our BTC adress: 166vHLnGB1pCQGxdBkRiMkHW5WGQDbsw6s After payment contact us to receive your decryption key. In mail title write your unique ID: DMALOCK 43:41:90:35:25:13:61:92 Our e-mail: [email protected] ATTENTION! To ensure you that you can recover your data we are able to decrypt two files of your choice that are not larger than 1MB! ATTENTION! Even if your antivirus has removed our program, your data may be still recovered!

Emails

[email protected]

Wallets

166vHLnGB1pCQGxdBkRiMkHW5WGQDbsw6s

Signatures

DMA Locker
Ransomware family with some advanced features, like encryption of unmapped network shares.
ransomware dmalocker

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ResumeWait.tiff	svchosd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cssys = "C:\\ProgramData\\svchosd.exe"	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cryptedinfo = "notepad C:\\ProgramData\\cryptinfo.txt"	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cssys = "C:\\ProgramData\\svchosd.exe"	svchosd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cryptedinfo = "notepad C:\\ProgramData\\cryptinfo.txt"	svchosd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe
2836	svchosd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2836	904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe	76
PID 904 wrote to memory of 2836	904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe	76
PID 904 wrote to memory of 2836	904	b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe	76

C:\Users\Admin\AppData\Local\Temp\b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe
"C:\Users\Admin\AppData\Local\Temp\b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:904
- C:\ProgramData\svchosd.exe
  "C:\ProgramData\svchosd.exe"
  2⤵
  - Modifies extensions of user files
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads