Behavioral task
behavioral1
Sample
db11ac77a0294ec9adb9815faae30bdbf3e9ad77118a1efcc4499da95f68a854.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
db11ac77a0294ec9adb9815faae30bdbf3e9ad77118a1efcc4499da95f68a854.exe
Resource
win10v2004-20231222-en
General
-
Target
db11ac77a0294ec9adb9815faae30bdbf3e9ad77118a1efcc4499da95f68a854
-
Size
37KB
-
MD5
8a236955ff205471452f918caf42914e
-
SHA1
64f5c1a660e9539ce6482baa9fd81fffab8020bb
-
SHA256
db11ac77a0294ec9adb9815faae30bdbf3e9ad77118a1efcc4499da95f68a854
-
SHA512
a8f1d4d57b984c2c1815a37d4d0ad0de9fb47878800b727cabfcd92451d684d433a13369968c9ba426fb5d7ea7eb5f6a12a9bec27d7438f31ed6359f73ecaba4
-
SSDEEP
768:89CTW2SNMX9J61TTNtiGX5DaXJfIaIiYvI0ihi/QM3DDiLecTY355Fms:BWbMX9J617pDl3fiyDCeF337
Malware Config
Signatures
-
MAKOP ransomware payload 1 IoCs
resource yara_rule sample family_makop -
Makop family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db11ac77a0294ec9adb9815faae30bdbf3e9ad77118a1efcc4499da95f68a854
Files
-
db11ac77a0294ec9adb9815faae30bdbf3e9ad77118a1efcc4499da95f68a854.exe windows:4 windows x86 arch:x86
7c4c07671b63e7c2bdbb09c4a98e21d4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
kernel32
CreateFileW
GetLastError
FindClose
DeviceIoControl
WaitForMultipleObjects
FindNextFileW
GetVolumeInformationW
CreateThread
TryEnterCriticalSection
Sleep
WriteFile
GetStdHandle
SetEndOfFile
SetFilePointerEx
ReadFile
GetFileSizeEx
MoveFileW
SetFileAttributesW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
GlobalAlloc
GetLogicalDrives
PeekNamedPipe
SetEvent
TerminateThread
CreateEventW
OpenProcess
GetProcAddress
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
GetModuleHandleW
GetCommandLineW
CreatePipe
GetEnvironmentVariableW
CreateProcessW
WaitForSingleObject
SetHandleInformation
GetLocaleInfoW
GetModuleFileNameW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetVersion
CreateDirectoryW
GetFileAttributesW
SetErrorMode
GetDriveTypeW
FindFirstFileW
CloseHandle
DeleteCriticalSection
EnterCriticalSection
TerminateProcess
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
GlobalFree
GetSystemWindowsDirectoryW
user32
GetWindowThreadProcessId
DialogBoxParamW
wsprintfA
ShowWindow
MessageBoxW
SetWindowTextA
SendMessageW
EnableWindow
GetShellWindow
SetWindowTextW
RegisterHotKey
GetWindowTextLengthW
CloseClipboard
GetWindowTextA
EmptyClipboard
GetDlgItem
OpenClipboard
SetClipboardData
wsprintfW
SetTimer
PostMessageW
KillTimer
UnregisterHotKey
EndDialog
advapi32
CryptAcquireContextW
CryptSetKeyParam
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptDecrypt
OpenProcessToken
GetTokenInformation
SetTokenInformation
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CryptImportKey
CryptEncrypt
shell32
ord680
CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ