60e55a6f8d9008996bc311ea1036341d7d95e5f307679cb132a4f4c19f398f82

Analysis

Target

__RMAMO.exe
Size

15KB
MD5

175dec4cc4ce5297e80b698c19b4aed5
SHA1

95ea5750b5f870465fc87c5c20402935a74d5e67
SHA256

772c3349ad353bf2b4a4b1229d36b2d42346e3981d8438deac870fdb918ab536
SHA512

b5cc59d1708e39ee109b3530775628d765b9474cc2d8ca6914240fcf855711d679014843c5f35c72b011e0fcd0ba929f4c55de04f5937b51df04692e87659ac7

Score

8^/10

ransomware

Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

__RMAMO.exe

description ioc process

File renamed C:\Users\Admin\Pictures\ImportPush.png => C:\Users\Admin\Pictures\ImportPush.png.Encrypted __RMAMO.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1992 NOTEPAD.EXE

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ImportPush.png => C:\Users\Admin\Pictures\ImportPush.png.Encrypted	__RMAMO.exe

pid	process
1992	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\__RMAMO.exe
"C:\Users\Admin\AppData\Local\Temp\__RMAMO.exe"
1⤵
- Modifies extensions of user files
PID:1292

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Passz.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1992

C:\Users\Admin\Desktop\Passz.txt
MD5
61296d8925e02d3d6798742a3c724167

SHA1
2c8fe95e2be2d212a37d8e23a3a14c7508161990

SHA256
59611bea81f08dc5a31342c17f0ae429194f85314df838ab2b5a25fb28326924

SHA512
1ff0b524d3f60d4153a0c3ee2318114ea01da24093ee91a5478fc0a9a237550edb5eec2effd40f04f49640edb0f1766316c6a5b71cf60c2097fcc5e12d85f7ae

Download Submit
memory/1292-0-0x000007FEF6500000-0x000007FEF6EEC000-memory.dmp

Filesize
9.9MB

Download
memory/1292-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1960-4-0x000007FEF6280000-0x000007FEF64FA000-memory.dmp

Filesize
2.5MB

Download