dmalocker | 33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0

General

Target

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe
Size

203KB
MD5

3cd4ec69277564714e1821c979939412
SHA1

67872dfa3607aca69aa0307af8c13bc86c2a02c6
SHA256

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0
SHA512

ab0a9da426e92ff7b43d999ba787c866207b2731853ab7873a3772e0f8e53087ce578de7316589f36009cee757db51eeca1453e4d4f99a4e0813eb33ed0d361b

Score

10^/10

dmalocker persistence ransomware

Malware Config

Extracted

Path

C:\ProgramData\cryptinfo.txt

Ransom Note

Attention! ! ! All of your copies of your system have been permanently deleted and the data on all partitions and workstations have been encrypted! Stay calm. You can recover all your data by making a payment of 4 BTC (1072 GBP) in Bitcoin currency in order to receive a decryption key. In order to purchase Bitcions you can use https://coincafe.com/signup.php After buying BTC send the equivalent of 4 BTC (1072 GBP) to our BTC adress: 1NaRMgB35pGH3hpoYYCUm4cKatA36pxtxs After payment contact us to receive your decryption key. In mail title write your unique ID: DMALOCK 57:29:79:75:80:37:51:32 Our e-mail: [email protected] ATTENTION! To ensure you that you can recover your data we are able to decrypt two files of your choice that are not larger than 1MB! ATTENTION! Even if your antivirus has removed our program, your data may be still recovered!

Emails

[email protected]

Wallets

1NaRMgB35pGH3hpoYYCUm4cKatA36pxtxs

Signatures

DMA Locker
Ransomware family with some advanced features, like encryption of unmapped network shares.
ransomware dmalocker

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\svchosd.exe"	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "notepad C:\\ProgramData\\cryptinfo.txt"	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 2988	680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe	76
PID 680 wrote to memory of 2988	680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe	76
PID 680 wrote to memory of 2988	680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe	76

C:\Users\Admin\AppData\Local\Temp\33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe
"C:\Users\Admin\AppData\Local\Temp\33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:680
- C:\ProgramData\svchosd.exe
  "C:\ProgramData\svchosd.exe"
  2⤵
  PID:2988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads