Overview

overview

10

Static

static

3

2026-03-08...er.exe

windows10-2004-x64

10

2026-03-08...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/03/2026, 04:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker.exe
  • Size 64KB
  • Sample260308-e3be9say2v
  • SHA256 78932bb8fe66d6dc5b421e94e2723705fd2a38a8b0c06456a603ab20536e884e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryquantumransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\README_TO_DECRYPT.html

  • quantum

Ransom Note
  • <html> <head> <title>Quantum</title> </head> <body> <h1>Your ID:</h1> <b> <pre> 5dbde59c615c8fb9346c52ea827b67c567dca21d8bae64c7ebdc11b4ec12b460 </pre> </b> <hr/> This message contains an information how to fix the troubles you've got with your network.<br><br> Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content.<br> The only way to get files back is a decryption with Key, provided by the Quantum Locker.<br><br> During the period your network was under our control, we downloaded a huge volume of information.<br> Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data.<br> Publishing of such data will cause serious consequences and even business disruption.<br><br> It's not a threat, on the contrary - it's a manual how to get a way out.<br> Quantum team doesn't aim to damage your company, our goals are only financial.<br><br> After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points.<br> If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc.<br><br> To contact our support and start the negotiations, please visit our support chat.<br> It is simple, secure and you can set a password to avoid intervention of unauthorised persons.<br> <a href="http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c567dca21d8bae64c7ebdc11b4ec12b460">http://tijykgureh7kqq5cczzeutaoxvmf6yinpar72o3bxome7b44vwqxadyd.onion/?cid=5dbde59c615c8fb9346c52ea827b67c567dca21d8bae64c7ebdc11b4ec12b460</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> P.S. How to get TOR browser - see at https://www.torproject.org </body> </html>

Signatures

  • Quantum Ransomware

    A rebrand of the MountLocker ransomware first seen in August 2021.

    ransomwarequantum
  • Quantum family
    quantum
  • Drops desktop.ini file(s) 24 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E580589.bat" "C:\Users\Admin\AppData\Local\Temp\2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker.exe""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Windows\SysWOW64\attrib.exe
        attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\2026-03-08_073af0796bda93eeb342f794d7da4517_elex_icedid_mountlocker.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:5312

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        0E580589.bat
        • Path C:\Users\Admin\AppData\Local\Temp\0E580589.bat
        • Size 65B
        • SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        README_TO_DECRYPT.html
        • Path C:\Users\Admin\Desktop\README_TO_DECRYPT.html
        • Size 2KB
        • SHA256 457cdcaee49340d9e9f269d4eb94ee3f38d7763e5c5c868ccc18236a51f6f846
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4196-201-0x0000000002B90000-0x0000000002C51000-memory.dmp
        Download

        memory/4196-205-0x0000000002B90000-0x0000000002C51000-memory.dmp
        Download