Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    114s
  • resource
    win7v191014
  • submitted
    22-01-2020 14:49

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d

  • Sample

    200122-dcjzw4d3w6

  • SHA256

    0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d

Score
10/10
ransomwaresodinokibipersistence

Malware Config

Extracted

Path

C:\Recovery\q5f10-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got q5f10 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D10ECAC096968E16 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/D10ECAC096968E16 Page will ask you for the key, here it is: Nf0eiuvX0OYlxB6+3APvS7NabvRHCjVJ+Dgku9bWeEo8rJia5JMGq9rFbJRahXuL Rf+eEDTvtPItMdtY0Zie5183mD29JQJkxYZSIhbDWb+ByfBor4f2yZqQe1xr5Ofc oQ47nmPUjiYYjHtQyRegzJd0rrder78H0jO0XW9zkbz0LQpxxl5sWuQ7+XvpHVy3 2iVKI1nLbvcb06FKYQ2ugWjd90/5nSbHuuwE8jgvEgvIyjR0CZdS96tRhqKDA/Gg 3m/QHHBOT2s03ghNMnUVVVXeVC6Srb2G6jCVQrOP9zNYEt+pI5+ipXzqz6Cdz3cm N1J1KACF/h/sRdIdZfTrxQXhyvbix9/oiyRCpC+XbWr8nak5wZEunz1QVw+SLFbn +3sGXk4oaenLDGHOHNEMvkrSWtfcpRzvEBqWZvQpekHRU1oCHP12pPzKaOhGbMeN +fAquE0YRS/GBkFpPqq0GCirLOLTtAlQs1t3Ixq7JmYTQVGQP3hhqHHMpFx8aqMh LEAH99QYsFI1xZPEBnUKZRNAGKi3nH9oXqevBCazHPLsvcHd7lR6APAsCKH3KrBf RMJTu3/QRSwlHyAvXQnibGLBjidsC/cd54q1p2QO84ZI1KpBfLbFmqsELkQhj2hS ESUZI+fFn1Zyg4z5SRDXhQ+jB+r3/3U6Ivnjd5VOxzZBqac0PAW/pH/YK13zGAIb 6kDGgnx1ih0UFEsXdA/QFiamFPGBDBIdVV5tYC90LhsRvT5J4ogMp5P1FWWEnctB f/3nZhpYRwFEkkZAWs6GNhDk3EAdTtb2fQopvqZwYPYGGEY7177x27bsjzDNkkjh VqbuHUUBGLPs+mYeSw1LM0VCA3ogjrZBGaD1PYDX7dIVBADpW2oJIDz5bwhk9+Et tCnJdnapOZBMbw1zNfD5J5nFHo1FR0Ze7gBD/LoOU7XRXI1/xB4DSjlDjJ/Thdv/ ZCkPoNALHyMzTAtH24OQbyFs1KoSH0tJsq6YL4caJFPXZKqm+hvLxsjcaAoU1Q4e dnX+l+2mQsTWolmB7CUbkzrs7P+2AHg627e0nnCaf1C5HfrMa0TLRPTh//BJ2Rq8 UgCEmA5UCyJOukbbbJWKKNdhkDup1w==
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D10ECAC096968E16

http://decryptor.top/D10ECAC096968E16

Signatures

  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Windows directory 3276 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality

    ransomwaresodinokibi
  • Discovering connected drives 3 TTPs 5 IoCs
    ransomware
  • Deletes shadow copies 2 TTPs 1 IoCs
    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe
    "C:\Users\Admin\AppData\Local\Temp\0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Drops file in Windows directory
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Discovering connected drives
    PID:2016
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Deletes shadow copies
        PID:1476
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Modifies service
    PID:1564

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2016-0-0x000000000063D000-0x000000000065B000-memory.dmp

    Filesize

    120KB

    Download