Overview

overview

10

Static

static

3

2026-04-03...er.exe

windows10-2004-x64

10

2026-04-03...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/04/2026, 08:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker.exe
  • Size 75KB
  • Sample260403-j128esfw4x
  • SHA256 2ca3db6ed97fe6759dc19a4faba5b94e72fb0e1b226293b775d546152311a7df
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionquantumransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\README_TO_DECRYPT.html

  • quantum

Ransom Note
  • <html> <head> <title>Quantum</title> </head> <body> <h1>Your ID:</h1> <b> <pre> e9853c6aaf36c4ece1ec550a7ddbbe332fd19b4c79eb966cb9df1248ebdf4433 </pre> </b> <hr/> This message contains an information how to fix the troubles you've got with your network.<br><br> Files on the workstations in your network were encrypted and any your attempt to change, decrypt or rename them could destroy the content.<br> The only way to get files back is a decryption with Key, provided by the Quantum Locker.<br><br> During the period your network was under our control, we downloaded a huge volume of information.<br> Now it is stored on our servers with high-secure access. This information contains a lot of sensitive, private and personal data.<br> Publishing of such data will cause serious consequences and even business disruption.<br><br> It's not a threat, on the contrary - it's a manual how to get a way out.<br> Quantum team doesn't aim to damage your company, our goals are only financial.<br><br> After a payment you'll get network decryption, full destruction of downloaded data, information about your network vulnerabilities and penetration points.<br> If you decide not to negotiate, in 48 hours the fact of the attack and all your information will be posted on our site and will be promoted among dozens of cyber forums, news agencies, websites etc.<br><br> To contact our support and start the negotiations, please visit our support chat.<br> It is simple, secure and you can set a password to avoid intervention of unauthorised persons.<br> <a href="http://22rnyep2aa2exx3fdm26p4onwjfmhciodb55v5l3w4iny7e5bxpg3yad.onion/?cid=e9853c6aaf36c4ece1ec550a7ddbbe332fd19b4c79eb966cb9df1248ebdf4433">http://22rnyep2aa2exx3fdm26p4onwjfmhciodb55v5l3w4iny7e5bxpg3yad.onion/?cid=e9853c6aaf36c4ece1ec550a7ddbbe332fd19b4c79eb966cb9df1248ebdf4433</a> <ul> <li>Password field should be blank for the first login. <li>Note that this server is available via Tor browser only. </ul> P.S. How to get TOR browser - see at https://www.torproject.org </body> </html>

Signatures

  • Quantum Ransomware

    A rebrand of the MountLocker ransomware first seen in August 2021.

    ransomwarequantum
  • Quantum family
    quantum
  • Drops desktop.ini file(s) 24 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E5847C2.bat" "C:\Users\Admin\AppData\Local\Temp\2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\system32\attrib.exe
        attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\2026-04-03_da9714db119c4c724678db136c3c5b39_cobalt-strike_mountlocker.exe"
        3⤵
        • Views/modifies file attributes
        PID:1784

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        0E5847C2.bat
        • Path C:\Users\Admin\AppData\Local\Temp\0E5847C2.bat
        • Size 65B
        • SHA256 c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        README_TO_DECRYPT.html
        • Path C:\Users\Admin\Desktop\README_TO_DECRYPT.html
        • Size 2KB
        • SHA256 1750dde2335cab05073bd6fc4a423d0db55adeda821e074f7e8eb2c61fa26b38
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4312-203-0x000001C5C4F20000-0x000001C5C4F2C000-memory.dmp
        Download

        memory/4312-207-0x000001C5C4F20000-0x000001C5C4F2C000-memory.dmp
        Download