mimic | c9cd460a810919e5ed056ef9f01e19c24fd3a2174b2cfca17d2a40d89f5992bc[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
c9cd460a810919e5ed056ef9f01e19c24fd3a2174b2cfca17d2a40d89f5992bc.exe
Size 2.3MB
Sample251229-sjaxaaxner
SHA256 c9cd460a810919e5ed056ef9f01e19c24fd3a2174b2cfca17d2a40d89f5992bc
MD5 46971943dac7dbcfefa85c137df733dd
SHA1 f42a39f5a5fe1405bc446131d20bbd6b6ec70825
SHA512 f9b4a202ea4ebaacc6890b872ebf3cfa8bb379a9756342643bcce329573ed398017fe0f34405cab2c4024a80e29fce3b901ed047282c130093d25085e13f37e4
SSDEEP 49152:YlhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCrD+qDqjmx9k484:YlhRuiVhG/o80ny2CnZGaHCN+jm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimic

Malware Config

Signatures

Detects Mimic ransomware 1 IoCs

resource	yara_rule
sample	family_mimic

Mimic family
mimic

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9cd460a810919e5ed056ef9f01e19c24fd3a2174b2cfca17d2a40d89f5992bc.exe

File Explorer

c9cd460a810919e5ed056ef9f01e19c24fd3a2174b2cfca17d2a40d89f5992bc.exe

.exe 2.3MB

c9cd460a810919e5ed056ef9f01e19c24fd3a2174b2cfca17d2a40d89f5992bc.exe

IMPHASH 5db996f530c574ab3c34e6ed3f1396a6
SHA256 c9cd460a810919e5ed056ef9f01e19c24fd3a2174b2cfca17d2a40d89f5992bc
MD5 46971943dac7dbcfefa85c137df733dd
SHA1 f42a39f5a5fe1405bc446131d20bbd6b6ec70825
SHA512 f9b4a202ea4ebaacc6890b872ebf3cfa8bb379a9756342643bcce329573ed398017fe0f34405cab2c4024a80e29fce3b901ed047282c130093d25085e13f37e4
SSDEEP 49152:YlhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCrD+qDqjmx9k484:YlhRuiVhG/o80ny2CnZGaHCN+jm
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects Mimic ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1276327

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess Wow64RevertWow64FsRedirection SetCurrentDirectoryW ExitProcess SetUnhandledExceptionFilter HeapFree HeapAlloc GetProcessHeap CancelIo CreateTimerQueueTimer DeleteTimerQueue GetQueuedCompletionStatus PostQueuedCompletionStatus lstrcatW lstrcpyW CreateIoCompletionPort CreateTimerQueue GetCurrentProcess SetProcessShutdownParameters LocalAlloc GetCurrentThread LocalFree GetSystemWindowsDirectoryW QueryDosDeviceW SetPriorityClass RemoveDirectoryW GetVersionExW K32GetProcessImageFileNameW DuplicateHandle CreateToolhelp32Snapshot GetExitCodeThread ProcessIdToSessionId Process32NextW K32GetProcessMemoryInfo Process32FirstW GetNativeSystemInfo LoadLibraryW Module32FirstW GetWindowsDirectoryW GetProcAddress WTSGetActiveConsoleSessionId CreateProcessW GetModuleHandleW CreateRemoteThread Module32NextW QueryFullProcessImageNameW K32GetMappedFileNameW CreateFileMappingW GetTickCount IsWow64Process VirtualQueryEx GetExitCodeProcess InitializeCriticalSectionEx RaiseException DecodePointer GetComputerNameExW GlobalMemoryStatusEx ReadProcessMemory GetStdHandle GetEnvironmentVariableW GetFileType SetLastError InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW DeleteFiber ConvertFiberToThread FreeLibrary WideCharToMultiByte GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocalTime DeleteCriticalSection GetFileInformationByHandle SetFileAttributesW GetFileAttributesW InitializeCriticalSection LeaveCriticalSection SetErrorMode CreateThread MapViewOfFile CreateEventA CreateFileMappingA ResetEvent SetEvent UnmapViewOfFile ReleaseMutex CreateMutexA CreateMutexW WaitForMultipleObjects lstrcmpW GetCurrentProcessId Sleep CreateEventW WaitForSingleObject FindClose lstrlenW FindNextFileW ReadFile FindFirstFileW AllocConsole GetConsoleWindow SetConsoleCP GetFileTime GetDriveTypeW FindNextVolumeW GetSystemTime GetVolumePathNamesForVolumeNameW CopyFileW SystemTimeToFileTime FindVolumeClose DeleteFileW GetDiskFreeSpaceExW ExitThread SetFileTime FindFirstVolumeW GetLogicalDrives GetVolumeInformationW CreateDirectoryW GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler ResumeThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect lstrcmpiW MultiByteToWideChar lstrcpynW GetFileSizeEx GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer SwitchToThread TryEnterCriticalSection AreFileApisANSI GetFullPathNameW FindFirstFileExW GetCurrentDirectoryW QueryPerformanceFrequency GetStringTypeW TerminateProcess Wow64DisableWow64FsRedirection EnterCriticalSection GetCommandLineW LockResource CreateFileW SizeofResource FlushFileBuffers MoveFileW SetFilePointerEx CloseHandle GetLastError SetEndOfFile DeviceIoControl WriteFile LoadLibraryA

user32

GetMessageW wvsprintfW GetProcessWindowStation GetUserObjectInformationW MessageBoxW ShowWindow PeekMessageW RegisterHotKey SendMessageTimeoutW FindWindowW wsprintfW PostMessageW UnregisterHotKey

advapi32

CloseServiceHandle RevertToSelf GetTokenInformation OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteValueW ConvertSidToStringSidW SetSecurityInfo RegGetValueW InitializeAcl OpenProcessToken RegSetValueExW RegCreateKeyExW LookupPrivilegeNameW RegCloseKey GetSecurityDescriptorDacl AdjustTokenPrivileges GetSecurityDescriptorSacl LookupPrivilegeValueW QueryServiceStatusEx DuplicateTokenEx CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource EqualSid CreateWellKnownSid GetUserNameW LookupAccountSidW OpenSCManagerW ControlService EnumDependentServicesW ChangeServiceConfigW OpenServiceW EnumServicesStatusW SetThreadToken

shell32

SHEmptyRecycleBinW SHCreateItemFromParsingName CommandLineToArgvW

ole32

CoInitializeEx CoTaskMemFree CoGetObject CoCreateInstance CoInitialize CoInitializeSecurity CoUninitialize CoSetProxyBlanket

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

ws2_32

setsockopt WSAGetLastError inet_ntop getsockopt gethostname inet_ntoa WSAAddressToStringW socket WSAStartup WSASocketW send WSASetLastError htons shutdown gethostbyname closesocket WSAIoctl bind WSACleanup recv

shlwapi

PathStripPathW StrStrW PathFileExistsW PathRemoveExtensionW PathGetArgsW PathFindExtensionW StrStrIA PathRemoveFileSpecW StrStrIW

iphlpapi

GetIpNetTable GetAdaptersInfo

netapi32

NetShareEnum NetApiBufferFree

mpr

WNetOpenEnumW WNetCloseEnum WNetGetConnectionW WNetEnumResourceW

rstrtmgr

RmShutdown RmStartSession RmGetList RmRegisterResources RmEndSession

everything32

Everything_GetNumResults Everything_SetRequestFlags Everything_Exit Everything_CleanUp Everything_GetLastError Everything_QueryW Everything_GetResultFullPathNameW Everything_SetSearchW Everything_SetSort Everything_DeleteRunHistory Everything_IsDBLoaded Everything_GetResultSize

bcrypt

BCryptGenRandom