dmalocker | 33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0

General

Target

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample
Size

203KB
Sample

210726-gfgckxd97j
MD5

3cd4ec69277564714e1821c979939412
SHA1

67872dfa3607aca69aa0307af8c13bc86c2a02c6
SHA256

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0
SHA512

ab0a9da426e92ff7b43d999ba787c866207b2731853ab7873a3772e0f8e53087ce578de7316589f36009cee757db51eeca1453e4d4f99a4e0813eb33ed0d361b

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\cryptinfo.txt

Ransom Note

Attention! ! ! All of your copies of your system have been permanently deleted and the data on all partitions and workstations have been encrypted! Stay calm. You can recover all your data by making a payment of 4 BTC (1072 GBP) in Bitcoin currency in order to receive a decryption key. In order to purchase Bitcions you can use https://coincafe.com/signup.php After buying BTC send the equivalent of 4 BTC (1072 GBP) to our BTC adress: 1NaRMgB35pGH3hpoYYCUm4cKatA36pxtxs After payment contact us to receive your decryption key. In mail title write your unique ID: DMALOCK 57:29:79:75:80:37:51:32 Our e-mail: [email protected] ATTENTION! To ensure you that you can recover your data we are able to decrypt two files of your choice that are not larger than 1MB! ATTENTION! Even if your antivirus has removed our program, your data may be still recovered!

Emails

[email protected]

Wallets

1NaRMgB35pGH3hpoYYCUm4cKatA36pxtxs

Targets

- Target
  
  33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample
- Size
  
  203KB
- MD5
  
  3cd4ec69277564714e1821c979939412
- SHA1
  
  67872dfa3607aca69aa0307af8c13bc86c2a02c6
- SHA256
  
  33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0
- SHA512
  
  ab0a9da426e92ff7b43d999ba787c866207b2731853ab7873a3772e0f8e53087ce578de7316589f36009cee757db51eeca1453e4d4f99a4e0813eb33ed0d361b
Score

10^/10

dmalocker persistence ransomware
- DMA Locker
  Ransomware family with some advanced features, like encryption of unmapped network shares.
  ransomware dmalocker
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

DMA Locker

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2