demonware | 3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935

General

Target

3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
Size

20.0MB
MD5

e1cb8de1af8868ef1190b01ef6445ac7
SHA1

c9764ccd30a854c554c2c9a7a08c30878e9b8a07
SHA256

3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935
SHA512

b0f209a504fad071d2e1727d38b28fc1d8a68be5680ee3cb9fa65743d6396a82df4326422867cb91c8a066064c47ffe3730f31025ba3620ba13e9cb47d8565c0

Score

10^/10

demonware ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\README.txt

Ransom Note

! You Have Been Hacked ! Your files have been encrypted by LockRansomware using RSA-2048. [.:Nothing personal just business:.] No one can help you to restore files without our special decryption tool. To get your files back you need to pay : option 1 =(BITCOIN) 1| Buy the equivalent of 50EURO in Bitcoin 2| Send Bitcoin to the following address : 1JJrohHmuCLXd95STzrxd5szYNA73KmGMd option 2 =(PAYSAFECARD) 1| Buy a paysafecard of 50EURO in a tobacco shop or on the internet> https://www.recharge.fr/paysafecard 2| Send the card code to the following email address : [email protected] After payement, sent the YOUR_ID.txt file on your Desktop who contains necessary data for your file decryption to [email protected] The decryption software will be automatically sent to you in response to your email

Emails

[email protected]

Wallets

1JJrohHmuCLXd95STzrxd5szYNA73KmGMd

URLs

https://www.recharge.fr/paysafecard

Signatures

DemonWare
Ransomware first seen in mid-2020.
ransomware demonware

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\NewUninstall.png => C:\Users\Admin\Pictures\NewUninstall.png.DEMON	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe

Loads dropped DLL 18 IoCs

pid	Process
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
5080	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 5080	4904	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe	89
PID 4904 wrote to memory of 5080	4904	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe	89
PID 4904 wrote to memory of 5080	4904	3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe	89

C:\Users\Admin\AppData\Local\Temp\3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
"C:\Users\Admin\AppData\Local\Temp\3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe
  "C:\Users\Admin\AppData\Local\Temp\3f95f5df74ed79327374523e166fc803b22714f939d333885c68636ca422e935.exe"
  2⤵
  - Modifies extensions of user files
  - Loads dropped DLL
  PID:5080

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads