dmalocker | 33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0

General

Target

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe
Size

203KB
MD5

3cd4ec69277564714e1821c979939412
SHA1

67872dfa3607aca69aa0307af8c13bc86c2a02c6
SHA256

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0
SHA512

ab0a9da426e92ff7b43d999ba787c866207b2731853ab7873a3772e0f8e53087ce578de7316589f36009cee757db51eeca1453e4d4f99a4e0813eb33ed0d361b

Score

10^/10

dmalocker persistence ransomware

Malware Config

Extracted

Path

C:\ProgramData\cryptinfo.txt

Ransom Note

Attention! ! ! All of your copies of your system have been permanently deleted and the data on all partitions and workstations have been encrypted! Stay calm. You can recover all your data by making a payment of 4 BTC (1072 GBP) in Bitcoin currency in order to receive a decryption key. In order to purchase Bitcions you can use https://coincafe.com/signup.php After buying BTC send the equivalent of 4 BTC (1072 GBP) to our BTC adress: 1NaRMgB35pGH3hpoYYCUm4cKatA36pxtxs After payment contact us to receive your decryption key. In mail title write your unique ID: DMALOCK 57:29:79:75:80:37:51:32 Our e-mail: [email protected] ATTENTION! To ensure you that you can recover your data we are able to decrypt two files of your choice that are not larger than 1MB! ATTENTION! Even if your antivirus has removed our program, your data may be still recovered!

Emails

[email protected]

Wallets

1NaRMgB35pGH3hpoYYCUm4cKatA36pxtxs

Signatures

DMA Locker
Ransomware family with some advanced features, like encryption of unmapped network shares.
ransomware dmalocker

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\svchosd.exe"	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "notepad C:\\ProgramData\\cryptinfo.txt"	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

pid process

680 33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

pid process

680 33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

pid	process
680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

pid	process
680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe

description	pid	process	target process
PID 680 wrote to memory of 2988	680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe	svchosd.exe
PID 680 wrote to memory of 2988	680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe	svchosd.exe
PID 680 wrote to memory of 2988	680	33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe	svchosd.exe

C:\Users\Admin\AppData\Local\Temp\33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe
"C:\Users\Admin\AppData\Local\Temp\33223ddfd3805727e70265d1b9ad22207a5667c6e38b802a140d979927e66ed0.sample.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:680

C:\ProgramData\svchosd.exe
"C:\ProgramData\svchosd.exe"
2⤵
PID:2988

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing