Behavioral task
behavioral1
Sample
bc0ed3e73b8d1fdc839f2e8ed3578ca3221dba4eb984e581cb00dfb4cdfb7d49.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bc0ed3e73b8d1fdc839f2e8ed3578ca3221dba4eb984e581cb00dfb4cdfb7d49.exe
Resource
win10v2004-20231215-en
General
-
Target
bc0ed3e73b8d1fdc839f2e8ed3578ca3221dba4eb984e581cb00dfb4cdfb7d49
-
Size
34KB
-
MD5
67d32736c5e1300c21329f956da836ab
-
SHA1
15c705cc01650bbf0db7bd0229edadb5f4ee9cf7
-
SHA256
bc0ed3e73b8d1fdc839f2e8ed3578ca3221dba4eb984e581cb00dfb4cdfb7d49
-
SHA512
33ec980170d703e43d67dbad2c1fef5855020291e139aa7e7bb1c96d446d27b7f187910df10bf183de86b882ffdd9dbc30715eafe74ae24edba4341fbcfa7eb8
-
SSDEEP
768:e4HLd8Vdh9qV1Esg8kdJCzSIZHkKRV6kNDGA6slD9tc:eQ8VIV1U8ZGURVFGhsN9e
Malware Config
Signatures
-
MAKOP ransomware payload 1 IoCs
resource yara_rule sample family_makop -
Makop family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc0ed3e73b8d1fdc839f2e8ed3578ca3221dba4eb984e581cb00dfb4cdfb7d49
Files
-
bc0ed3e73b8d1fdc839f2e8ed3578ca3221dba4eb984e581cb00dfb4cdfb7d49.exe windows:4 windows x86 arch:x86
b2a2e59916055b004c7a8f339a45d95f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
kernel32
FindFirstFileW
DeviceIoControl
GetDriveTypeW
WaitForMultipleObjects
SetErrorMode
FindNextFileW
Sleep
WriteFile
ReadFile
FlushFileBuffers
GetFileSizeEx
MoveFileW
SetFileAttributesW
SetEndOfFile
SetFilePointerEx
GetProcessHeap
GetVersion
FindClose
GetCurrentProcess
HeapFree
GetProcAddress
LoadLibraryA
OpenProcess
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
GetLastError
GetCommandLineW
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
GetLocaleInfoW
GetEnvironmentVariableW
GetModuleFileNameW
PeekNamedPipe
CreateProcessW
Process32FirstW
GetSystemWindowsDirectoryW
SetHandleInformation
CreateDirectoryW
CreateFileW
GetFileAttributesW
GetLogicalDrives
CreateThread
WaitForSingleObject
GetVolumeInformationW
TerminateProcess
DeleteCriticalSection
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
HeapAlloc
CreatePipe
user32
wsprintfW
wsprintfA
GetShellWindow
GetWindowThreadProcessId
advapi32
CryptSetKeyParam
CryptAcquireContextW
CryptDecrypt
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
GetTokenInformation
SetTokenInformation
OpenProcessToken
RegCloseKey
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
CryptEncrypt
CryptImportKey
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
ord680
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE