Overview

overview

10

Static

static

1

7d3a5cd80e...64.exe

windows7_x64

10

7d3a5cd80e...64.exe

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    60s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    06/07/2020, 07:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
  • Size 175KB
  • Sample200706-nc5ayyph22
  • SHA256 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464
  • MD5 SHA1 SHA512
Score
10/10
ransomwarepersistencesodinokibi

Malware Config

Extracted

Path

  • C:\e851243h-readme.txt

  • sodinokibi

Ransom Note
  • ---=== Welcome Riedel Company ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension e851243h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/07E59509D684597E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/07E59509D684597E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +OR5sxhqvtlbCQOMAF4dqX3p3L5ulyX17P/W2Tc4izUiOF9k+eoDxTHtoGWvw47r crIaFigN74cui4/xaaqHxeAQDANZ30+Cwi4fCl7D/uwRXMuyGF1msS+KtmxEX9l3 mvmn1Ydmyh7GiQue+kbqCu1OLnIKYzrA/aQPYlGzQjos/E21DFm2l7ci2AGuqhbx gYULQZRFIkSML+B0rEqCovL1VccWAXknnzi2PnuWTW2eMOtWhARuUIwE3RYX2GKx vwSXJ47ymnQNJJljgOvp8YdwQTMx06A8G15q7SkdA6duOAsXPLBa3BYp0wfgqVn0 JiJd1HyZ5awKWUnkgI9eY22OUJS8jL8q0vy3NKg9x+rM+F9HMI5rGR8Vx2LDflm0 dmXHxDHRGDR+Kksx69BcF1kccqDDtdcmpW/+nlkjyjDQtKRPu81pc0nbnZEJMLcp RcJ8m3hn698dmzpBbaOP7o9xW2oelf7vdLDnBB/JsdDSoGkz92D/RcN5CfRFXxdw otvUol7+dpfe19LqTytc8sNffWGXi+FIJmPjXyjVYH4okrYx3SS1NsndFOLaj443 erePtpVsSlDdjnriRUS5bfG4E3TQgvEx57ln7OOGqxEavpzh1aC5cTKWXr+PfuB8 pUbyUSBrCY8d4A68rYFvgBmi0leQkDdgu+waKSv97xsBxRuMTMQyEkfHMMDGHP1S VlU1e8/TkK76ZOxmguWPVDrRIUsjMJJMahBFEw8+suIwpC07m4Qt4eLP27JbsEHw aTZGaXvAYKWsfRt5x4Bowbtq7i/qRlF+g9AsTlNQulzMHyQgbRMQV4Nj7GUjMujs JWJOOBTY28XISxEuqwqFjvVrY9nndoLJftW3lXauO1oBa3Kiu+5RsbtFz4xtQF8u IbkEDkT7gef6pr12WXSPTtMzyoJJGjkrXNUAop4gGnd88OudXyh5sxYKet8W81vn Bh3ZYnRKzZf4X2R3HGhdmaXXPC0BM0j8w//h9HScd7a3QHpuj/I6SPyQyuu7IA8N XZjA7iiii5NmoMiQHj4d5tnEmJZmDDrdxvcTO84dhmyH99Aw2PQMKp5Wbr56d/dR lDMidJMMS2HAXTzqcBwjjNEsSq7QTV7IjPxWMc0kviHFm+sNUy84rM2FpuWrJ0lA cV/Oq0dykAFcgN1HLqn4e4Hr+3xomjgYCrIlLUOqTvFFUPhYljMXt+3dTz2YlsCQ mYiji8C8PGIOA4eG23fy9wkez0GbOdSR+U21100YK0RIYXW1axzHKJTaaA/l9co+ SRZlwE98OufF2geKMMrnZYB6qBs= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/07E59509D684597E

  • http://decryptor.cc/07E59509D684597E

Extracted

Family

  • sodinokibi

C2

  • patrickfoundation.net

  • stopilhan.com

  • johnsonfamilyfarmblog.wordpress.com

  • bafuncs.org

  • forskolorna.org

  • wraithco.com

  • bodyfulls.com

  • epwritescom.wordpress.com

  • gadgetedges.com

  • commonground-stories.com

  • brawnmediany.com

  • webmaster-peloton.com

  • blogdecachorros.com

  • zieglerbrothers.de

  • erstatningsadvokaterne.dk

  • winrace.no

  • lubetkinmediacompanies.com

  • berlin-bamboo-bikes.org

  • delchacay.com.ar

  • cimanchesterescorts.co.uk

Attributes
  • pid

    $2a$10$.f7IpgYtYZGmT5sKVxP4DeexwfYEU6ILqgG3IL3orW0F9eevOA7L6

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome Riedel Company ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4769

Signatures

  • Enumerates connected drives 3 TTPs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Program Files directory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
    "C:\Users\Admin\AppData\Local\Temp\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
      "C:\Users\Admin\AppData\Local\Temp\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe"
      2⤵
      • Sets desktop wallpaper using registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • Drops file in Program Files directory
      PID:4004
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        PID:564
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3760
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Modifies service
      PID:1668

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/4004-1-0x0000000000400000-0x0000000000420000-memory.dmp
          Download

          memory/4004-3-0x0000000000400000-0x0000000000420000-memory.dmp
          Download