5f53feb2ae27f293796a949894f2359042badf70a5f86b7f1b8f4e668cb9212a

General

Target

Mamona-fxb.exe
Size

181KB
MD5

0f6d6ef9b82ece9dbbdc711ac00b5e6a
SHA1

15ca8d66aa1404edaa176ccd815c57effea7ed2f
SHA256

c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7
SHA512

f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1
SSDEEP

3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18

Score

10^/10

discovery ransomware

Malware Config

Extracted

Path

C:\PerfLogs\README.HAes.txt

Ransom Note

~~Mamona, R.I.P!~~ Welcome! Visit our blog --> http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion Chat ---> bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u Password ---> As you may have noticed by now, all of your files were encrypted & stolen. --------------------------------------------------------------------------------- [What happened?] -> We have stolen a significant amount of your important files from your network and stored them on our servers. -> Additionally, all files are encrypted, making them inaccessible without our decryption tool. [What can you do?] --> You have two options: --> 1. Pay us for the decryption tool, and: --> - You can decrypt all your files. --> - Stolen data will be deleted from our servers. --> - You will receive a report detailing how we accessed your network and security recommendations. --> - We will stop targeting your company. --> 2. Refuse to pay and: --> - Your stolen data will be published publicly. --> - Your files will remain locked. --> - Your reputation will be damaged, and you may face legal and financial consequences. --> - We may continue targeting your company. [Warnings] --> Do not alter your files in any way. If you do, the decryption tool will not work, and you will lose access permanently. --> Do not contact law enforcement. If you do, your data will be exposed immediately. --> Do not hire a recovery company. Decrypting these files without our tool is impossible. Each file is encrypted with a unique key, and you need our tool to decrypt them.

URLs

http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion

http://bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u

Signatures

Renames multiple (173) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Mamona-fxb.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\wallpaper.bmp"	Mamona-fxb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mamona-fxb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2356	cmd.exe
4056	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4056	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 2356	940	Mamona-fxb.exe	95
PID 940 wrote to memory of 2356	940	Mamona-fxb.exe	95
PID 940 wrote to memory of 2356	940	Mamona-fxb.exe	95
PID 2356 wrote to memory of 4056	2356	cmd.exe	97
PID 2356 wrote to memory of 4056	2356	cmd.exe	97
PID 2356 wrote to memory of 4056	2356	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\Mamona-fxb.exe
"C:\Users\Admin\AppData\Local\Temp\Mamona-fxb.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Mamona-fxb.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\README.HAes.txt

Filesize
1KB

MD5
ab868e0b4c2c526d3957fc5cd9c85a3e

SHA1
2380ce2dc62b66674291d64a7b0c861b246da7a8

SHA256
c192767affe9bd9c625773ef08017a988057b996c6335a91860a9fd283adb8e8

SHA512
eadf1037852d9c9c3591ffa16c6d36ac79543b3c09103fd3a4b9f62bf41ecba828210401d541a6715300a06cc6d3e7612050df71b231f05c81c2672b40a2af92

Download Submit

Analysis

Sharing