mountlocker | 0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47

General

Target

0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Size

94KB
MD5

b63a8bfdf7df9f9dd8c3bedb99b6f8ff
SHA1

9e61b0960ac40452067720e8839b71ef10c05949
SHA256

0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47
SHA512

8a1ae8c6fde917e6a53f33a13cef8065a90a6b31a84f4b8effbd1527ad1769d4712e37e31e65594aaea35d4bad80a0c0499404e8267c305500f8ed4ce5fa304b

Score

10^/10

mountlocker ransomware spyware stealer

Malware Config

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 18 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\SaveUpdate.raw => \??\c:\Users\Admin\Pictures\SaveUpdate.raw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\UseConvertTo.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromReceive.crw => \??\c:\Users\Admin\Pictures\ConvertFromReceive.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\EnableEnter.crw => \??\c:\Users\Admin\Pictures\EnableEnter.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\HideAdd.tif.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\PingMeasure.raw => \??\c:\Users\Admin\Pictures\PingMeasure.raw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ConvertFromReceive.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\RestartSave.raw => \??\c:\Users\Admin\Pictures\RestartSave.raw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\SuspendShow.png.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\UseConvertTo.crw => \??\c:\Users\Admin\Pictures\UseConvertTo.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\MountSync.raw => \??\c:\Users\Admin\Pictures\MountSync.raw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\MountSync.raw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\PingMeasure.raw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\RestartSave.raw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\EnableEnter.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\HideAdd.tif => \??\c:\Users\Admin\Pictures\HideAdd.tif.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\SaveUpdate.raw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\SuspendShow.png => \??\c:\Users\Admin\Pictures\SuspendShow.png.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe

Deletes itself 1 IoCs

pid	Process
1524	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1536	vssadmin.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.DF45E32C\shell\Open	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.DF45E32C\shell\Open\command\ = "explorer.exe RecoveryManual.html"	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.DF45E32C\shell\Open\command	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.DF45E32C\shell	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
1088	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Token: SeBackupPrivilege	472	vssvc.exe
Token: SeRestorePrivilege	472	vssvc.exe
Token: SeAuditPrivilege	472	vssvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1536	1088	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	30
PID 1088 wrote to memory of 1536	1088	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	30
PID 1088 wrote to memory of 1536	1088	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	30
PID 1088 wrote to memory of 1524	1088	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	32
PID 1088 wrote to memory of 1524	1088	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	32
PID 1088 wrote to memory of 1524	1088	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	32
PID 1524 wrote to memory of 524	1524	cmd.exe	34
PID 1524 wrote to memory of 524	1524	cmd.exe	34
PID 1524 wrote to memory of 524	1524	cmd.exe	34

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
524	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
"C:\Users\Admin\AppData\Local\Temp\0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\system32\vssadmin.exe
  C:\Windows\system32\vssadmin.exe delete shadows /all /Quiet
  2⤵
  - Interacts with shadow copies
  PID:1536
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F745D2D.bat" "C:\Users\Admin\AppData\Local\Temp\0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe"
    3⤵
    - Views/modifies file attributes
    PID:524