Overview

overview

10

Static

static

10

dc732c1ebf...in.exe

windows7_x64

10

dc732c1ebf...in.exe

windows10_x64

10

Analysis

  • max time kernel
    128s
  • max time network
    103s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    20-07-2020 18:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01.bin.exe

  • Size

    134KB

  • MD5

    b5d3505a5533c63d9e12b4ee1487febb

  • SHA1

    546c127f4957aa32bf7c5f00086cea4fc3da7cf1

  • SHA256

    dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01

  • SHA512

    2a49a7fa24300b090bc7bb44485e3072dbd7e773e9bcf7ed0f622e113856de70c4f30faf135f0bf490e6e2e3598c75162bd1b5dfd17fbd2e41e548967ff2f53a

Score
10/10
ransomwaresodinokibipersistence

Malware Config

Extracted

Path

C:\50139b-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 50139b. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F5C41EAFA6F69A67 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F5C41EAFA6F69A67 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: J6UX/vbeyp/H/AHkXQ4LR4l+mLC1hKEdqo5sr4ifG83RkURxssIUrLHOwDzIU1u4 08353GwbjtvNtS/ZxZNj6RIsqZ7b4Qz/wsb43vWuwEELhZZfx9zFvXDryFOJHrBL /G6EGl/ZiuP37vQWbVIcfs0ZMUHCWDYFXhc7CWtu6tFs8q5Zj957dJXmtaNwH6Ho /9BjNibCx3kc0u5ZykXkJuy0BKHT5sToBVafi+w9HdFbEpshabGdTh3XCUhc42ns +iDzLjfEiJp9EzJnm7b17BCVMpXtxI7ATc+8aLr1DvwQ496MAEoTeBw5N0OEhv9m doby9r+OD//merEr0xma1Nkgg2BJ3ZUI9HhRlSPcANG/WTjETmmI+m3QpMaPR25/ 6FsK+dJv1lFhgKb0yrwe3eNw51tBTrTQy5lvnWCso0bLKAUyR1NmjsPS0YYMnQBk MLjo/ZudsdfWYIOJDhQO0xb74DXP2Atg7r5/mUCJIcqwtFwX2SYeeK5TOuQbOWRa B2UPFDz7wH7RGAsjnFKsGSQB84VfAuP6re2eOa+YgVDE+Teev+ZXtpDsIwavzS1Z eGIokpYI26dGImZuKZMYRAMO88EU5hLxCaBiy5+jvtnak3pzhvk7v7JOI3nSymcA YebsKTluHzvR80HL5fCYWFpIEG3ARZn3EiDo8KML5/VuoVovN1wY3sK91oZQAvi5 tIgTN1VZQDAdMZWvvvDxYzWf7EHH2v5KHpYCT/kiomX5i459p6tWRUmSF3HAo2JY vyZHP3YATND97GYFylRQ/w2elMmV9n1vANgWmtWTh4Mr/knqWqzlKc4DTJHUATju JWyRvvyQlsQVTPNxXv8LzrBqoQuJfsEY7vgiozfFxDnl4vWyZzwFTnMfOe1gVf3w EzCmcwnXvC951gb2Jb+rAcl17J6/nsC7ZTM/EZVLSeHjo0nn67xDkw4TvKEjrhS7 zgn+o/mTmVFUKFjxcch6ASvQBDFnABj+9MpDrkVl/xi2HUrgtRBA+StivJX5zWrI sxMK0rhK/RiR/+LtGz7CdY6za6pPF/nSAxMWDWPH+r3SBgdtVj453kPJn9qUmsQH m1LggvtQf5iKsvj7IGyFlCgwOFxYDjuE6bXfPy2CrpXUlKmIawV+nbyaJDygcbKw HJ25gDQfBIBwc1TbkDEnxfNIvIaKneLIot7e/Wghy+TQdyHMa652smkQLXKy09cu siUp1olxw1x+CkH02wZqEoJF4zvYhjHEHgHdzkreYDmli/MHAXQNMaJTSelVF5L/ LW7iOTc5oMKQfrMHpr7mTHvs+rDlprHgdPO0e6jF3ow= Extension name: 50139b ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F5C41EAFA6F69A67

http://decryptor.cc/F5C41EAFA6F69A67

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 75 IoCs
  • Drops file in System32 directory 1 IoCs
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Program Files directory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01.bin.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in System32 directory
    • Drops file in Program Files directory
    PID:1088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:1284
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:644
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Modifies service
      PID:1784

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1284-0-0x0000000000000000-mapping.dmp

      Download