mimic | sub_b600e06f14e2[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
sub_b600e06f14e2.bin
Size 2.4MB
Sample260524-b54caaet7k
SHA256 b600e06f14e29b03f0b1456723a430b5024816518d704a831dde2dc9597ce9c9
MD5 0bf7c0d8e3e02a6b879efab5deab013c
SHA1 4f93d2cda84e669eeddcfeb2e2fa2319901059a1
SHA512 313f9a8ae5a0096488996f51ce0d2049f7040b5cba1f6efd6e7190517accffad9af4d72eb551755978e624f4089b9e5983eae792496b2e8e6da5a6cd7939ae5f
SSDEEP 49152:Va/RPnb1b+uL5KTu8l6VP/DOdmGtPY4ldPLuGHnKESY:Va/RTd56M9/DmmGmMiG
TLSH
T13EB5D012FBC2C172E1A301749576A73F893ABA249B34C5D7D7D01E798D312C26A3B3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware mimic

Malware Config

Signatures

Family: Mimic
Ransomware family was first exploited in the wild in 2022.
ransomware mimic

Detects Mimic ransomware 1 IoCs

resource	yara_rule
sample	family_mimic

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sub_b600e06f14e2.bin

File Explorer

sub_b600e06f14e2.bin

.exe 2.4MB

sub_b600e06f14e2.bin

IMPHASH 1037d132e98a7b058f2e599876e508d6
SHA256 b600e06f14e29b03f0b1456723a430b5024816518d704a831dde2dc9597ce9c9
MD5 0bf7c0d8e3e02a6b879efab5deab013c
SHA1 4f93d2cda84e669eeddcfeb2e2fa2319901059a1
SHA512 313f9a8ae5a0096488996f51ce0d2049f7040b5cba1f6efd6e7190517accffad9af4d72eb551755978e624f4089b9e5983eae792496b2e8e6da5a6cd7939ae5f
SSDEEP 49152:Va/RPnb1b+uL5KTu8l6VP/DOdmGtPY4ldPLuGHnKESY:Va/RTd56M9/DmmGmMiG
TLSH
T13EB5D012FBC2C172E1A301749576A73F893ABA249B34C5D7D7D01E798D312C26A3B3A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Mimic ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1274487

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess Wow64RevertWow64FsRedirection SetCurrentDirectoryW ExitProcess SetUnhandledExceptionFilter HeapFree HeapAlloc GetProcessHeap CancelIo CreateTimerQueueTimer DeleteTimerQueue GetQueuedCompletionStatus PostQueuedCompletionStatus lstrcatW lstrcpyW CreateIoCompletionPort CreateTimerQueue GetCurrentProcess SetProcessShutdownParameters LocalAlloc GetCurrentThread LocalFree GetSystemWindowsDirectoryW QueryDosDeviceW SetPriorityClass RemoveDirectoryW GetVersionExW K32GetProcessImageFileNameW DuplicateHandle CreateToolhelp32Snapshot GetExitCodeThread ProcessIdToSessionId Process32NextW K32GetProcessMemoryInfo Process32FirstW GetNativeSystemInfo LoadLibraryW Module32FirstW GetWindowsDirectoryW GetProcAddress WTSGetActiveConsoleSessionId CreateProcessW GetModuleHandleW CreateRemoteThread Module32NextW QueryFullProcessImageNameW K32GetMappedFileNameW CreateFileMappingW GetTickCount IsWow64Process VirtualQueryEx GetExitCodeProcess InitializeCriticalSectionEx RaiseException DecodePointer GetComputerNameExW GlobalMemoryStatusEx ReadProcessMemory GetStdHandle GetEnvironmentVariableW GetFileType SetLastError InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW DeleteFiber ConvertFiberToThread FreeLibrary WideCharToMultiByte GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocalTime DeleteCriticalSection GetFileInformationByHandle SetFileAttributesW GetFileAttributesW InitializeCriticalSection LeaveCriticalSection SetErrorMode CreateThread MapViewOfFile CreateEventA CreateFileMappingA ResetEvent SetEvent UnmapViewOfFile ReleaseMutex CreateMutexA CreateMutexW WaitForMultipleObjects lstrcmpW GetCurrentProcessId Sleep CreateEventW WaitForSingleObject FindClose lstrlenW FindNextFileW ReadFile FindFirstFileW AllocConsole GetConsoleWindow SetConsoleCP GetFileTime GetDriveTypeW FindNextVolumeW GetSystemTime GetVolumePathNamesForVolumeNameW CopyFileW SystemTimeToFileTime FindVolumeClose GetDiskFreeSpaceExW ExitThread SetFileTime FindFirstVolumeW GetLogicalDrives GetVolumeInformationW CreateDirectoryW lstrcmpiW GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler ResumeThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect MultiByteToWideChar lstrcpynW GetFileSizeEx GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource LockResource VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer SwitchToThread TryEnterCriticalSection AreFileApisANSI GetFullPathNameW FindFirstFileExW GetCurrentDirectoryW QueryPerformanceFrequency GetStringTypeW TerminateProcess Wow64DisableWow64FsRedirection EnterCriticalSection GetCommandLineW CreateFileW SizeofResource FlushFileBuffers MoveFileW SetFilePointerEx CloseHandle DeleteFileW GetLastError SetEndOfFile DeviceIoControl WriteFile LoadLibraryA

user32

GetMessageW wvsprintfW GetProcessWindowStation GetUserObjectInformationW MessageBoxW ShowWindow PeekMessageW RegisterHotKey SendMessageTimeoutW FindWindowW wsprintfW PostMessageW UnregisterHotKey

advapi32

LookupAccountSidW RevertToSelf GetTokenInformation OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteValueW ConvertSidToStringSidW SetSecurityInfo InitializeAcl OpenProcessToken RegSetValueExW RegCreateKeyExW LookupPrivilegeNameW RegCloseKey GetSecurityDescriptorDacl AdjustTokenPrivileges GetSecurityDescriptorSacl LookupPrivilegeValueW QueryServiceStatusEx DuplicateTokenEx EnumServicesStatusW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource EqualSid CreateWellKnownSid RegGetValueW GetUserNameW CloseServiceHandle OpenSCManagerW ControlService EnumDependentServicesW ChangeServiceConfigW OpenServiceW SetThreadToken

shell32

SHEmptyRecycleBinW SHCreateItemFromParsingName CommandLineToArgvW

ole32

CoInitializeEx CoTaskMemFree CoGetObject CoCreateInstance CoInitialize CoInitializeSecurity CoUninitialize CoSetProxyBlanket

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

ws2_32

setsockopt WSAGetLastError inet_ntop getsockopt gethostname inet_ntoa WSAAddressToStringW socket WSAStartup WSASocketW send WSASetLastError htons shutdown gethostbyname closesocket WSAIoctl bind WSACleanup recv

shlwapi

PathStripPathW StrStrW PathFileExistsW PathRemoveExtensionW PathGetArgsW PathFindExtensionW StrStrIA PathRemoveFileSpecW StrStrIW

iphlpapi

GetIpNetTable GetAdaptersInfo

netapi32

NetShareEnum NetApiBufferFree

mpr

WNetOpenEnumW WNetCloseEnum WNetGetConnectionW WNetEnumResourceW

rstrtmgr

RmShutdown RmStartSession RmGetList RmRegisterResources RmEndSession

everything32

Everything_GetNumResults Everything_SetRequestFlags Everything_Exit Everything_CleanUp Everything_GetLastError Everything_QueryW Everything_GetResultFullPathNameW Everything_SetSearchW Everything_SetSort Everything_DeleteRunHistory Everything_IsDBLoaded Everything_GetResultSize

bcrypt

BCryptGenRandom