23bdeb9ae6a8f414c33ed8baf2de46477d0bc7f469dd543d60332a04e0b7c039

General

Target

DimCo payload.bin.exe
Size

301KB
MD5

9d82063518aaf2fead87538da8c0a08c
SHA1

966e2b157845ba298752eebb0ce71ae05200bc6d
SHA256

23bdeb9ae6a8f414c33ed8baf2de46477d0bc7f469dd543d60332a04e0b7c039
SHA512

66cc6826f6d958c45cb830abeeb13faee8f31989785876d0e8071846336194dd1539afe99e51694e4f832b8f3896de372305fa86d2596ac4fdb911ca23079fe2
SSDEEP

6144:yFxvRZVLlfh7rZthO+JjkuHEEAt/wz/60baxHUh:mZdfrXg+JwuKt/S/605h

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

DimCo payload.bin.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ProtectEnable.png => C:\Users\Admin\Pictures\ProtectEnable.png.nigger	DimCo payload.bin.exe
File renamed	C:\Users\Admin\Pictures\SetMove.png => C:\Users\Admin\Pictures\SetMove.png.nigger	DimCo payload.bin.exe
File renamed	C:\Users\Admin\Pictures\SkipBackup.tif => C:\Users\Admin\Pictures\SkipBackup.tif.nigger	DimCo payload.bin.exe
File renamed	C:\Users\Admin\Pictures\CopyCheckpoint.raw => C:\Users\Admin\Pictures\CopyCheckpoint.raw.nigger	DimCo payload.bin.exe
File renamed	C:\Users\Admin\Pictures\DenyAssert.crw => C:\Users\Admin\Pictures\DenyAssert.crw.nigger	DimCo payload.bin.exe
File renamed	C:\Users\Admin\Pictures\ExpandImport.crw => C:\Users\Admin\Pictures\ExpandImport.crw.nigger	DimCo payload.bin.exe
File renamed	C:\Users\Admin\Pictures\ExportUnblock.png => C:\Users\Admin\Pictures\ExportUnblock.png.nigger	DimCo payload.bin.exe
File renamed	C:\Users\Admin\Pictures\MergeReset.crw => C:\Users\Admin\Pictures\MergeReset.crw.nigger	DimCo payload.bin.exe

Drops desktop.ini file(s) 38 IoCs

Processes:

DimCo payload.bin.exe

description	ioc	process
File created	C:\Users\Public\Desktop\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Downloads\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Libraries\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Pictures\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Recorded TV\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Contacts\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Music\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Music\Sample Music\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Documents\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Videos\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Favorites\Links for United States\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Links\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Music\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Desktop\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Downloads\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Videos\Sample Videos\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Videos\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Pictures\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Searches\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Public\Documents\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\Admin\Favorites\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini	DimCo payload.bin.exe
File created	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	DimCo payload.bin.exe

C:\Users\Admin\AppData\Local\Temp\DimCo payload.bin.exe
"C:\Users\Admin\AppData\Local\Temp\DimCo payload.bin.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
PID:1756

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-54-0x0000000000CC0000-0x0000000000D12000-memory.dmp

Filesize
328KB

Download
memory/1756-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1756-56-0x0000000004B90000-0x0000000004C40000-memory.dmp

Filesize
704KB

Download

Analysis

Sharing