60e55a6f8d9008996bc311ea1036341d7d95e5f307679cb132a4f4c19f398f82 | Triage

Analysis

max time kernel
42s
max time network
21s
platform
windows7_x64
resource
win7v200722
submitted
17/10/2020, 17:10

Sharing

Report Analysis Logs

General

Target

__RMAMO.exe
Size

15KB
MD5

175dec4cc4ce5297e80b698c19b4aed5
SHA1

95ea5750b5f870465fc87c5c20402935a74d5e67
SHA256

772c3349ad353bf2b4a4b1229d36b2d42346e3981d8438deac870fdb918ab536
SHA512

b5cc59d1708e39ee109b3530775628d765b9474cc2d8ca6914240fcf855711d679014843c5f35c72b011e0fcd0ba929f4c55de04f5937b51df04692e87659ac7

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ImportPush.png => C:\Users\Admin\Pictures\ImportPush.png.Encrypted	__RMAMO.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1992	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\__RMAMO.exe
"C:\Users\Admin\AppData\Local\Temp\__RMAMO.exe"
1⤵
- Modifies extensions of user files
PID:1292

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Passz.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-0-0x000007FEF6500000-0x000007FEF6EEC000-memory.dmp

Filesize
9.9MB

Download
memory/1292-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1960-4-0x000007FEF6280000-0x000007FEF64FA000-memory.dmp

Filesize
2.5MB

Download