mountlocker | 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99[.]bin

Resubmissions

17/05/2024, 14:06

240517-reh7esbc8310

17/05/2024, 14:05

17/05/2024, 14:04

17/05/2024, 14:00

09/01/2022, 14:18

Sharing

Copy URL Twitter E-mail

General

Target
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.bin
Size 66KB
Sample240517-rdxnesbb2x
SHA256 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99
MD5 2c26b319e378755596f0ac6d293798c8
SHA1 280a4cfcf5dd87898c3731b680efe061bdb7a9fe
SHA512 0c2b53a3fed1dbbae64e7f1e7c17a89b5dc607ba40caecd5496e18ffd84cdad844e926742d9fc82a715d6e8b01a1c483d97d54f5be1f2d6997107946f2a3fe4b
SSDEEP 768:BS5zkUtPX/y4Jp5LmcmItHnlIH9q9Q/048RgauHADO2A:DaXq4xTlIdYrhRcH2A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mountlocker

Malware Config

Signatures

Detected Mount Locker ransomware 1 IoCs

resource	yara_rule
sample	RANSOM_mountlocker

Mountlocker family
mountlocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.bin

File Explorer

00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.bin

.exe 66KB

00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.bin

IMPHASH 608bd80057d3a5e8811535ac9a9eb381
SHA256 00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99
MD5 2c26b319e378755596f0ac6d293798c8
SHA1 280a4cfcf5dd87898c3731b680efe061bdb7a9fe
SHA512 0c2b53a3fed1dbbae64e7f1e7c17a89b5dc607ba40caecd5496e18ffd84cdad844e926742d9fc82a715d6e8b01a1c483d97d54f5be1f2d6997107946f2a3fe4b
SSDEEP 768:BS5zkUtPX/y4Jp5LmcmItHnlIH9q9Q/048RgauHADO2A:DaXq4xTlIdYrhRcH2A
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detected Mount Locker ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReleaseSemaphore WaitForSingleObject GetTickCount64 SetEvent CreateThread CreateSemaphoreA CreateEventA DeviceIoControl SetFileAttributesW lstrcmpiW TerminateThread ResetEvent ReadFile GetFileSizeEx TlsSetValue SetEndOfFile SetFileInformationByHandle SetFilePointerEx TlsGetValue GetDriveTypeW GetCommandLineW ExitProcess GetCurrentProcess lstrlenA TlsAlloc GetComputerNameA TerminateProcess OpenProcess lstrcmpiA GetModuleFileNameW GetTempPathW CreateProcessW GetSystemInfo GetComputerNameW GlobalMemoryStatus DeleteFileW CopyFileW GetConsoleScreenBufferInfo EnterCriticalSection GetStdHandle LeaveCriticalSection InitializeCriticalSection WriteConsoleW DeleteCriticalSection SetConsoleCursorPosition AllocConsole QueryPerformanceCounter QueryPerformanceFrequency GetTickCount Sleep WideCharToMultiByte GetCurrentProcessId HeapReAlloc SetLastError CloseHandle CreateFileW WriteFile GetLastError FindClose FindNextFileW HeapFree FindFirstFileW GetVolumeInformationW lstrcpyW GetProcessHeap HeapAlloc lstrcatW lstrlenW SetErrorMode RtlVirtualUnwind

advapi32

LookupAccountSidW GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken EnumServicesStatusA CreateServiceW CloseServiceHandle OpenSCManagerW GetUserNameW DeleteService ControlService StartServiceW QueryServiceStatusEx OpenServiceA CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptImportKey CryptReleaseContext OpenSCManagerA

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoInitializeSecurity

msvcrt

_vsnwprintf memset feof fgetws _wfopen fclose memcpy _getch

mpr

WNetCancelConnection2W WNetOpenEnumW WNetCloseEnum WNetEnumResourceW WNetAddConnection2W

shell32

CommandLineToArgvW ord680

shlwapi

StrCmpNIW StrStrIW StrCmpIW StrChrW StrStrIA SHRegSetUSValueW

user32

wsprintfW

oleaut32

SysFreeString SysAllocString

activeds

ord9

netapi32

NetShareEnum NetGetJoinInformation NetApiBufferFree NetGetDCName

ntdll

RtlGetVersion RtlGetNativeSystemInformation ZwQuerySystemInformation

Name

.text

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

bss

Size

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

212B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

00ed4c347cd62526226363a0aceb851b2ef7e3a4da78433a28f2cd6cbd5f1b99.bin

kernel32

advapi32

ole32

msvcrt

mpr

shell32

shlwapi

user32

oleaut32

activeds

netapi32

ntdll

generic