Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31/08/2022, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
DimCo payload.bin.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
DimCo payload.bin.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
DimCo payload.bin.exe
-
Size
301KB
-
MD5
9d82063518aaf2fead87538da8c0a08c
-
SHA1
966e2b157845ba298752eebb0ce71ae05200bc6d
-
SHA256
23bdeb9ae6a8f414c33ed8baf2de46477d0bc7f469dd543d60332a04e0b7c039
-
SHA512
66cc6826f6d958c45cb830abeeb13faee8f31989785876d0e8071846336194dd1539afe99e51694e4f832b8f3896de372305fa86d2596ac4fdb911ca23079fe2
-
SSDEEP
6144:yFxvRZVLlfh7rZthO+JjkuHEEAt/wz/60baxHUh:mZdfrXg+JwuKt/S/605h
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ProtectEnable.png => C:\Users\Admin\Pictures\ProtectEnable.png.nigger DimCo payload.bin.exe File renamed C:\Users\Admin\Pictures\SetMove.png => C:\Users\Admin\Pictures\SetMove.png.nigger DimCo payload.bin.exe File renamed C:\Users\Admin\Pictures\SkipBackup.tif => C:\Users\Admin\Pictures\SkipBackup.tif.nigger DimCo payload.bin.exe File renamed C:\Users\Admin\Pictures\CopyCheckpoint.raw => C:\Users\Admin\Pictures\CopyCheckpoint.raw.nigger DimCo payload.bin.exe File renamed C:\Users\Admin\Pictures\DenyAssert.crw => C:\Users\Admin\Pictures\DenyAssert.crw.nigger DimCo payload.bin.exe File renamed C:\Users\Admin\Pictures\ExpandImport.crw => C:\Users\Admin\Pictures\ExpandImport.crw.nigger DimCo payload.bin.exe File renamed C:\Users\Admin\Pictures\ExportUnblock.png => C:\Users\Admin\Pictures\ExportUnblock.png.nigger DimCo payload.bin.exe File renamed C:\Users\Admin\Pictures\MergeReset.crw => C:\Users\Admin\Pictures\MergeReset.crw.nigger DimCo payload.bin.exe -
Drops desktop.ini file(s) 38 IoCs
description ioc Process File created C:\Users\Public\Desktop\desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Downloads\desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Libraries\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Pictures\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Saved Games\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Recorded TV\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Contacts\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini DimCo payload.bin.exe File created C:\Users\Public\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Music\desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Music\Sample Music\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Documents\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Favorites\Links\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Videos\desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Recorded TV\Sample Media\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Favorites\Links for United States\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Links\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Music\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Desktop\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Downloads\desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Videos\Sample Videos\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Videos\desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Pictures\desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Pictures\Sample Pictures\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Searches\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini DimCo payload.bin.exe File created C:\Users\Public\Documents\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini DimCo payload.bin.exe File created C:\Users\Admin\Favorites\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini DimCo payload.bin.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini DimCo payload.bin.exe