Threat video1:00
MountLocker v5.0 Worm Ransomware: Detection & IOCs
MountLocker v5.0 spreads as a worm through Active Directory and WMI. Its 9 detection rules, 30 IOCs and a free Splunk SPL rule cover 20 techniques.
Read the full threat intel for MountLocker v5.0 Worm Ransomware: Detection & IOCs →
Chapters
- 0:00The hookMountLocker: 20 techniques, RSA-2048 encryption.
- 0:05The storyDeployed after IcedID and Cobalt Strike.
- 0:11Attack pathReportedly IcedID, then Cobalt Strike.
- 0:27AttributionAttributed to MountLocker.
- 0:31Indicators of compromise30 indicators to hunt: 6 IPs, 7 domains and 11 SHA-256 hashes, and more.
- 0:40MITRE ATT&CK techniques20 ATT&CK techniques, from initial access to impact.
- 0:44Remediation4 steps now: Block the listed C2 IPs and domains at the perimeter.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00MountLocker: 20 techniques, RSA-2048 encryption.
0:06Deployed after IcedID and Cobalt Strike.
0:11Reportedly IcedID, then Cobalt Strike.
0:14Mimikatz steals credentials, pass-the-hash spreads.
0:17Defender disabled, locker copies via WMI.
0:21Stops databases, encrypts with ChaCha-20 keys.
0:27Attributed to MountLocker. Confidence: medium.
0:3130 indicators to hunt: 6 IPs, 7 domains and 11 SHA-256 hashes, and more.
0:4020 ATT&CK techniques, from initial access to impact.
0:444 steps now: Block the listed C2 IPs and domains at the perimeter.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.