mamona | c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe
Size 181KB
Sample260712-p5a8dsas8k
SHA256 c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7
MD5 0f6d6ef9b82ece9dbbdc711ac00b5e6a
SHA1 15ca8d66aa1404edaa176ccd815c57effea7ed2f
SHA512 f5404e742f997fc821f27f544884ce6d82ffef05defabdfdc0f265b4322f6b6e45a15389658c866e00704a20c36ba71f984f121521df81244cb04c49c80e61f1
SSDEEP 3072:GsrPf+odptGM3Nu6L6C4/nFBCkAhyhtsijLrlH5AeJl2a/18OS:GsrPWodR6CIikAhyDhvBSc18
TLSH
T16B047D10FED2C431E4B70A701AF9E7F5953E79140B3099DFA7900B69AE30AD286357B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery mamona ransomware

Malware Config

Extracted

Path

C:\Recovery\README.HAes.txt

mamona

Ransom Note

~~Mamona, R.I.P!~~ Welcome! Visit our blog --> http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion Chat ---> bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u Password ---> As you may have noticed by now, all of your files were encrypted & stolen. --------------------------------------------------------------------------------- [What happened?] -> We have stolen a significant amount of your important files from your network and stored them on our servers. -> Additionally, all files are encrypted, making them inaccessible without our decryption tool. [What can you do?] --> You have two options: --> 1. Pay us for the decryption tool, and: --> - You can decrypt all your files. --> - Stolen data will be deleted from our servers. --> - You will receive a report detailing how we accessed your network and security recommendations. --> - We will stop targeting your company. --> 2. Refuse to pay and: --> - Your stolen data will be published publicly. --> - Your files will remain locked. --> - Your reputation will be damaged, and you may face legal and financial consequences. --> - We may continue targeting your company. [Warnings] --> Do not alter your files in any way. If you do, the decryption tool will not work, and you will lose access permanently. --> Do not contact law enforcement. If you do, your data will be exposed immediately. --> Do not hire a recovery company. Decrypting these files without our tool is impossible. Each file is encrypted with a unique key, and you need our tool to decrypt them.

URLs

http://owt3kwkxod2pvxlv3uljzskfhebhrhoedrh5gqrxyyd6rrco4frzj5ad.onion
http://bdhjur3agrogoxvwobbzpptkxhyewnjrhzqj4ug2dyfhf3dopyvvurid.onion/victim-chat/s630fx3eow8u

Signatures

Family: Mamona
Mamona is a ransomware that has been active since 2025.
ransomware mamona
Renames multiple (125) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\wallpaper.bmp"	c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2416	cmd.exe
5572	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5572	PING.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2416	4564	c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe	89
PID 2416 wrote to memory of 5572	2416	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Red-Flaged\c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.7 -n 3
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

README.HAes.txt

Path C:\Recovery\README.HAes.txt
Size 1KB
SHA256 c192767affe9bd9c625773ef08017a988057b996c6335a91860a9fd283adb8e8
MD5 ab868e0b4c2c526d3957fc5cd9c85a3e
SHA1 2380ce2dc62b66674291d64a7b0c861b246da7a8
SHA512 eadf1037852d9c9c3591ffa16c6d36ac79543b3c09103fd3a4b9f62bf41ecba828210401d541a6715300a06cc6d3e7612050df71b231f05c81c2672b40a2af92
TLSH
T1E731500FDE3816491F52E1E7BF2DE562FF06A11822A652514C5353881359336A0FE5A9
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis