mountlocker | 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99[.]bin

Resubmissions

17-05-2024 14:06

240517-reh7esbc83 10

17-05-2024 14:05

17-05-2024 14:04

17-05-2024 14:00

09-01-2022 14:18

Sharing

Copy URL

Twitter E-mail

General

Target

00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.bin
Size

66KB
MD5

2c26b319e378755596f0ac6d293798c8
SHA1

280a4cfcf5dd87898c3731b680efe061bdb7a9fe
SHA256

00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99
SHA512

0c2b53a3fed1dbbae64e7f1e7c17a89b5dc607ba40caecd5496e18ffd84cdad844e926742d9fc82a715d6e8b01a1c483d97d54f5be1f2d6997107946f2a3fe4b
SSDEEP

768:BS5zkUtPX/y4Jp5LmcmItHnlIH9q9Q/048RgauHADO2A:DaXq4xTlIdYrhRcH2A

Score

10^/10

mountlocker

Malware Config

Signatures

Detected Mount Locker ransomware 1 IoCs

resource	yara_rule
sample	RANSOM_mountlocker

Mountlocker family
mountlocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.bin

Files

00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.bin
.exe windows:6 windows x64 arch:x64

608bd80057d3a5e8811535ac9a9eb381

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ReleaseSemaphore
WaitForSingleObject
GetTickCount64
SetEvent
CreateThread
CreateSemaphoreA
CreateEventA
DeviceIoControl
SetFileAttributesW
lstrcmpiW
TerminateThread
ResetEvent
ReadFile
GetFileSizeEx
TlsSetValue
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
TlsGetValue
GetDriveTypeW
GetCommandLineW
ExitProcess
GetCurrentProcess
lstrlenA
TlsAlloc
GetComputerNameA
TerminateProcess
OpenProcess
lstrcmpiA
GetModuleFileNameW
GetTempPathW
CreateProcessW
GetSystemInfo
GetComputerNameW
GlobalMemoryStatus
DeleteFileW
CopyFileW
GetConsoleScreenBufferInfo
EnterCriticalSection
GetStdHandle
LeaveCriticalSection
InitializeCriticalSection
WriteConsoleW
DeleteCriticalSection
SetConsoleCursorPosition
AllocConsole
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
Sleep
WideCharToMultiByte
GetCurrentProcessId
HeapReAlloc
SetLastError
CloseHandle
CreateFileW
WriteFile
GetLastError
FindClose
FindNextFileW
HeapFree
FindFirstFileW
GetVolumeInformationW
lstrcpyW
GetProcessHeap
HeapAlloc
lstrcatW
lstrlenW
SetErrorMode
RtlVirtualUnwind

advapi32

LookupAccountSidW
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
EnumServicesStatusA
CreateServiceW
CloseServiceHandle
OpenSCManagerW
GetUserNameW
DeleteService
ControlService
StartServiceW
QueryServiceStatusEx
OpenServiceA
CryptDestroyKey
CryptAcquireContextW
CryptEncrypt
CryptImportKey
CryptReleaseContext
OpenSCManagerA

ole32

CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity

msvcrt

_vsnwprintf
memset
feof
fgetws
_wfopen
fclose
memcpy
_getch

mpr

WNetCancelConnection2W
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
WNetAddConnection2W

shell32

CommandLineToArgvW
ord680

shlwapi

StrCmpNIW
StrStrIW
StrCmpIW
StrChrW
StrStrIA
SHRegSetUSValueW

user32

wsprintfW

oleaut32

SysFreeString
SysAllocString

activeds

ord9

netapi32

NetShareEnum
NetGetJoinInformation
NetApiBufferFree
NetGetDCName

ntdll

RtlGetVersion
RtlGetNativeSystemInformation
ZwQuerySystemInformation

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

bss
Size: - Virtual size: 136B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

608bd80057d3a5e8811535ac9a9eb381

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

msvcrt

mpr

shell32

shlwapi

user32

oleaut32

activeds

netapi32

ntdll

Sections

.text Size: 26KB - Virtual size: 26KB

bss Size: - Virtual size: 136B

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 16KB - Virtual size: 17KB

.pdata Size: 1024B - Virtual size: 888B

.reloc Size: 512B - Virtual size: 212B

.text
Size: 26KB - Virtual size: 26KB

bss
Size: - Virtual size: 136B

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 16KB - Virtual size: 17KB

.pdata
Size: 1024B - Virtual size: 888B

.reloc
Size: 512B - Virtual size: 212B