60e55a6f8d9008996bc311ea1036341d7d95e5f307679cb132a4f4c19f398f82

Analysis

Target

__RMAMO.exe
Size

15KB
MD5

175dec4cc4ce5297e80b698c19b4aed5
SHA1

95ea5750b5f870465fc87c5c20402935a74d5e67
SHA256

772c3349ad353bf2b4a4b1229d36b2d42346e3981d8438deac870fdb918ab536
SHA512

b5cc59d1708e39ee109b3530775628d765b9474cc2d8ca6914240fcf855711d679014843c5f35c72b011e0fcd0ba929f4c55de04f5937b51df04692e87659ac7

Score

8^/10

ransomware

Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

__RMAMO.exe

description ioc process

File renamed C:\Users\Admin\Pictures\SwitchReset.png => C:\Users\Admin\Pictures\SwitchReset.png.Encrypted __RMAMO.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2784 NOTEPAD.EXE

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SwitchReset.png => C:\Users\Admin\Pictures\SwitchReset.png.Encrypted	__RMAMO.exe

pid	process
2784	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\__RMAMO.exe
"C:\Users\Admin\AppData\Local\Temp\__RMAMO.exe"
1⤵
- Modifies extensions of user files
PID:3888

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Passz.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2784

C:\Users\Admin\Desktop\Passz.txt
MD5
b03110b649168326d2c7d9c754d4a0bb

SHA1
ffb68aa83cc2dc2913fa38a4153afe73d8e1c96e

SHA256
dee125e0df2eef8c9cd76fdb76afb947bf0ecba5c9369621bca161b70bf6b745

SHA512
c342c76dd7970008f3079cd98124437f84e25383043168d34a0954e04263d1a18d759cb575e266818031b295b05a050db6739fccbccc0a3378c9ee45a891f32c

Download Submit
memory/3888-0-0x00007FF88C690000-0x00007FF88D07C000-memory.dmp

Filesize
9.9MB

Download
memory/3888-1-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download