mountlocker | 0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47

General

Target

0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Size

94KB
MD5

b63a8bfdf7df9f9dd8c3bedb99b6f8ff
SHA1

9e61b0960ac40452067720e8839b71ef10c05949
SHA256

0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47
SHA512

8a1ae8c6fde917e6a53f33a13cef8065a90a6b31a84f4b8effbd1527ad1769d4712e37e31e65594aaea35d4bad80a0c0499404e8267c305500f8ed4ce5fa304b

Score

10^/10

mountlocker ransomware spyware stealer

Malware Config

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\DisableMerge.png => \??\c:\Users\Admin\Pictures\DisableMerge.png.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\DisableMerge.png.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\ImportDismount.crw => \??\c:\Users\Admin\Pictures\ImportDismount.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ImportDismount.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File renamed	C:\Users\Admin\Pictures\ReceiveUnregister.crw => \??\c:\Users\Admin\Pictures\ReceiveUnregister.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ReceiveUnregister.crw.ReadManual.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2724 vssadmin.exe

pid	process
2724	vssadmin.exe

Modifies registry class 5 IoCs

Processes:

0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\.DF45E32C\shell\Open\command	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\.DF45E32C	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\.DF45E32C\shell	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\.DF45E32C\shell\Open	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\.DF45E32C\shell\Open\command\ = "explorer.exe RecoveryManual.html"	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe

pid	process
4048	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
4048	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4048	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Token: SeTakeOwnershipPrivilege	4048	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Token: SeRestorePrivilege	4048	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
Token: SeBackupPrivilege	2320	vssvc.exe
Token: SeRestorePrivilege	2320	vssvc.exe
Token: SeAuditPrivilege	2320	vssvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.execmd.exe

description	pid	process	target process
PID 4048 wrote to memory of 2724	4048	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	vssadmin.exe
PID 4048 wrote to memory of 2724	4048	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	vssadmin.exe
PID 4048 wrote to memory of 2732	4048	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	cmd.exe
PID 4048 wrote to memory of 2732	4048	0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe	cmd.exe
PID 2732 wrote to memory of 1972	2732	cmd.exe	attrib.exe
PID 2732 wrote to memory of 1972	2732	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1972 attrib.exe

pid	process
1972	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe
"C:\Users\Admin\AppData\Local\Temp\0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\system32\vssadmin.exe
  C:\Windows\system32\vssadmin.exe delete shadows /all /Quiet
  2⤵
  - Interacts with shadow copies
  PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0F742C46.bat" "C:\Users\Admin\AppData\Local\Temp\0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\attrib.exe
    attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47.bin.exe"
    3⤵
    - Views/modifies file attributes
    PID:1972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Hidden Files and Directories

1

T1158

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0F742C46.bat

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
memory/1972-117-0x0000000000000000-mapping.dmp

Download
memory/2724-114-0x0000000000000000-mapping.dmp

Download
memory/2732-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads