mimic

General

Target

240110-pf835afbdr
Size

3.2MB
Sample

240316-ethg8ade22
MD5

6d44f8f3c1608e5958b40f9c6d7b6718
SHA1

9203ad3b6ffb7732591ef560965566555bce9d82
SHA256

a8759b39cecf17631e9d4952aecd32ce233e01d08841178e7ef81f3afdd8e455
SHA512

656eb44b563705e1045b6a881b4f8a462ecf3bb8b2421cb18dfa21421629f7af92fe4b72736edfe3fea2ea13bef84f5faab5a78b8ef2b4f656a9055d0c4a22bd
SSDEEP

98304:wgwRevguPPFpugyxQkvA51nFbk+kUwWlGroD+1f:wgtv7ov5vqbk++AGkD+1f

Score

10^/10

Malware Config

Targets

- Target
  
  240110-pf835afbdr
- Size
  
  3.2MB
- MD5
  
  6d44f8f3c1608e5958b40f9c6d7b6718
- SHA1
  
  9203ad3b6ffb7732591ef560965566555bce9d82
- SHA256
  
  a8759b39cecf17631e9d4952aecd32ce233e01d08841178e7ef81f3afdd8e455
- SHA512
  
  656eb44b563705e1045b6a881b4f8a462ecf3bb8b2421cb18dfa21421629f7af92fe4b72736edfe3fea2ea13bef84f5faab5a78b8ef2b4f656a9055d0c4a22bd
- SSDEEP
  
  98304:wgwRevguPPFpugyxQkvA51nFbk+kUwWlGroD+1f:wgtv7ov5vqbk++AGkD+1f
Score

10^/10

mimic evasion persistence ransomware spyware stealer trojan
- Detects Mimic ransomware
- Mimic
  Ransomware family was first exploited in the wild in 2022.
  ransomware mimic
- Modifies security service
  evasion
- UAC bypass
  evasion trojan
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Detects command variations typically used by ransomware
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware
- Detects executables containing commands for clearing Windows Event Logs
- Renames multiple (3968) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2