Overview

overview

10

Static

static

58e5387a57...le.exe

windows7_x64

10

58e5387a57...le.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    94s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    26-07-2021 12:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    58e5387a57aa7a6feeeee884d9e908c73de48412b0036f1f4ea1b9570ce69c2a.sample.exe

  • Size

    216KB

  • MD5

    1dfc1cf679e362a6ba6d0f3f7a92ba7e

  • SHA1

    2af4065eba0bd676c101e6d0ef2271e2a6865a68

  • SHA256

    58e5387a57aa7a6feeeee884d9e908c73de48412b0036f1f4ea1b9570ce69c2a

  • SHA512

    8786dd703b31ed761a2ba0431fb7a42f81c762ebe58918050c73596d3715f1c72d4cc6700edee8406bd1ba563a8c67eb5a1d1d50f8d1f2045a37a2ff62aff605

Score
10/10
dmalockerpersistenceransomware

Malware Config

Extracted

Path

C:\ProgramData\cryptinfo.txt

Ransom Note
Attention! ! ! All of your copies of your system have been permanently deleted and the data on all partitions and workstations have been encrypted! Stay calm. You can recover all your data by making a payment of 30 BTC (24900 GBP) in Bitcoin currency in order to receive a decryption key. In order to purchase Bitcions you can use https://coincafe.com/signup.php After buying BTC send the equivalent of 30 BTC (24900 GBP) to our BTC adress: 1HN1r24sZ79yTS6pAczzyCssCtL8UsaqL6 After payment contact us to receive your decryption key. In mail title write your unique ID: DMALOCK 16:12:73:16:82:70:50:31 Our e-mail: [email protected] ATTENTION! To ensure you that you can recover your data we are able to decrypt two files of your choice that are not larger than 1MB! ATTENTION! Even if your antivirus has removed our program, your data may be still recovered!
Wallets

1HN1r24sZ79yTS6pAczzyCssCtL8UsaqL6

Signatures

  • DMA Locker

    Ransomware family with some advanced features, like encryption of unmapped network shares.

    ransomwaredmalocker
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58e5387a57aa7a6feeeee884d9e908c73de48412b0036f1f4ea1b9570ce69c2a.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\58e5387a57aa7a6feeeee884d9e908c73de48412b0036f1f4ea1b9570ce69c2a.sample.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\ProgramData\svchosd.exe
      "C:\ProgramData\svchosd.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      PID:1820

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1672-59-0x0000000075971000-0x0000000075973000-memory.dmp

    Filesize

    8KB

    Download