Overview

overview

10

Static

static

145ba21333...bd.exe

windows7_x64

10

145ba21333...bd.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    22-06-2020 14:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    145ba213336bbb05c09d2bcf198aa3bd.exe

  • Size

    416KB

  • MD5

    145ba213336bbb05c09d2bcf198aa3bd

  • SHA1

    517dc0d3d853c09fd7cb69aa85fc8f37b9bf3a87

  • SHA256

    6329693e5c61a2f0fa1a53bd177f5a332ef729050b3f109630b759c792f0b986

  • SHA512

    1868d5e625f2fb48f1ca59a34d6b0ebee612d5c657adc349ddc9b5984409e0e9844f5a31f81a1f1e1234e44064f695de07843f1fad3aad54e051e6620127a4b1

Score
10/10
ransomwarepersistencespywaresodinokibi

Malware Config

Extracted

Path

C:\odt\d31985o9-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got d31985o9 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/79BD66702E965ACE Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/79BD66702E965ACE Page will ask you for the key, here it is: JRDayGbe4RBJmccs8epn4K8BzP6EUBtRiYrfiJ04hmreG756doEHVZ1pwrVbJ+2V yIP2FN/RA3m8okChclenjwk0NFfdyI+Lqf3YiaeiT/IeT5fZlHnszCBaQU7FGOlP /1b0I4ll5Y99qJP5TbQaWZ9W5K9KhNFyzbFzR6M4i77EKvo6kQoEpV170qbVDmVv TxB0MHED5dsJCT/Ub69nrQVwowalkP1xiDCArLiyvqdrsc3MVHDuNkOx9xDDRPj1 mD5fIgdS6vwhxSWdulvmv7qBCkMmOWyH3IWYjmVknRsZEr2/xSbYNXbHsQrvGGRB 8c0IqyIWJZhvXKPyI9UpGRO9lSkdhPgNTWcgm9JZ0OCyH8B/kBChRZsb7RYQ0bZt lBlu8d7T3yDAZroTje19qDn/F9fnUy2tiLKkUwsvRhJbwPm3eG/U3qgnURySHv01 bNYV3Wsa2hHY9cLyMX4jxSwhmr8wB3h6R+eqfbmUM02J84z1PvzrFv6z+YthN0jR s0uAramER2tyAvMEtxrmyuzOILpmmbsMMNNtMuRHNTiB6HARm3Sl6jWjFIvdn47R EZFt/oe4KRxS/U33cy+dxTtOh4wnlDDQ7BMjDcFj1rTWHHCB7mALd/yHOSyXDnFD pewfYyYLb+Wd5HTUB6unCCrFdPyEedlOWQTLnO/sig7MNLRIg1MsQkXtOemQIxLJ zsSjYFP93GnSHgdeRcsf++fL9RzbUglSM3c3xUTE2nx0Iy4EDfbnEefF+ow42JyO Za1ePDAxdGDIq7wgh8BKQX2Y/JZw1O5+t14IA1wTPwSe3KbkNhtbcUQNHYywXDXH zXEk83XaIscaf9xPqDkHbZ9JqmfI0F4VrVuHnz8qf8N9/wMK1G+Hwykq9wuBhHb5 Voi025RK5m8MLCY7bxYSmsevkGxx4qrROjW1CXBSIqYaF7f4KhqtLNr4gRqJdqS0 hux3NjWQrJwbYpQIqWxt1hlBMwmO+iTrMxr2UTOSmK+POXdmou7BEEeTW9INVM3v ZB+AebK5HILzzvc7QLY5quz04+QHvPSUz2gjkNBwLiICfK08DB/ioOD2Z6aPmnFX pcoyPXuDYuWTqg==
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/79BD66702E965ACE

http://decryptor.top/79BD66702E965ACE

Signatures

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Windows directory 2108 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs

Processes

  • C:\Users\Admin\AppData\Local\Temp\145ba213336bbb05c09d2bcf198aa3bd.exe
    "C:\Users\Admin\AppData\Local\Temp\145ba213336bbb05c09d2bcf198aa3bd.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetWindowsHookEx
    • Drops file in Windows directory
    • Sets desktop wallpaper using registry
    PID:2896
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3836
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:996
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Modifies service
    PID:3832

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/996-1-0x0000000000000000-mapping.dmp

    Download

  • memory/3836-0-0x0000000000000000-mapping.dmp

    Download