Overview

overview

10

Static

static

10

dc732c1ebf...in.exe

windows7_x64

10

dc732c1ebf...in.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    20-07-2020 18:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01.bin.exe

  • Size

    134KB

  • MD5

    b5d3505a5533c63d9e12b4ee1487febb

  • SHA1

    546c127f4957aa32bf7c5f00086cea4fc3da7cf1

  • SHA256

    dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01

  • SHA512

    2a49a7fa24300b090bc7bb44485e3072dbd7e773e9bcf7ed0f622e113856de70c4f30faf135f0bf490e6e2e3598c75162bd1b5dfd17fbd2e41e548967ff2f53a

Score
10/10
ransomwarepersistencesodinokibi

Malware Config

Extracted

Path

C:\418ns433q-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 418ns433q. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BEB8AB4C5AE06882 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BEB8AB4C5AE06882 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IT0Ug59g5muWi2ugI6OtiWzIs48yQELvGB0G49FHABvnhnr/VkVUTMcXQFjW/mAC 9ShL/R3m6TBZexNSVHviOwb1E1hz0hZk4YPw5foJClLE7mReX5JBP9OdfKDH9JBn jLr8Y3XvPu3rd2VLEYtTyxFnhqfI1d6QGDKoHzZXaHHCXW4b5s7CzoEXI+yvgoq9 diT0qg992So1yFZc+msptScO4H4yaYK1buTWqF8k6LsDWsHhzc193KKOcSCs3UDM p9+lV4i/sAli1319wdh4vhzww9kvD5CI48/XWYdMif+ertlpWr37+4o2bbyx0c1U U+4TMDRYjLsZAf+dEm3A/3BLeNu6LcKt7AQARLBpetXDSvBzz33f15EWIkEKDw2p T9hGYMnplxbDt3GBjOoTAAIGKmcwyL6JzM2M2Y0zs/iKbgkZyCuknyd/CjvnQ3SP FnnGB5rVo3slwNRFeIWpauYvzL9ArDKVdTWZDwWyLpYTaulzYrW2H2hJol8XEgag DpEVyULk04H8xwO1ffKtBpuaHjUHawOtRgOBANtvcmMQ0hhOWJXaQ51AZzVrok8O /hcQ3H4BNTXT0P93lQAonuCnSpsJsdUf5nsVQ5U6lOgmhomlx8C8Zx7VX1eKOu1m Aq5s8M41TfQl2X2bri1wGiytresHR45Lfb1z+nM1Tc3pbT6PldGvngoW10ipNwVr aXmJ8D/OlWSEhX7MzrN7yWjaUQhDZgKcM3CTzK9HQHe6z6WOTRlzUdYlJhjAdhcr GhkcVoCnzyobXqgG+AOyrF+50hSmO40Xr8yChCHjYp5Ni7mXiuCjVS/djry5y0gt vaNlmpvnWQ0op9ABPcA4RUL/SF+MhUFNNin3E2xsbF5K7X6n2ogQGHZVxpjaN13n 1nNBvYUSkcfooQ8vMIM4ffN+TKUlphTs2aYxgJhpeQ8ROf/QdzprAuHwrXDedm0F 94XxlwLyZzOYSOg3v853MT1z+ericqjWQA6VTZJIAKGhk4+hXd2C2LjdFC5SlpTN bztQOWoGWE2/vgRIbLrcvXUNB5PqpiuhVEZTZ00kBT41s24f5nwZmvo0aLbxI0vO gNgG3nx5VkCuXCpsdLRCC/mVeBPsGwMGuoRvC/yn2v1/DBLse/ZM2jbzrYvzEH8T nffOgfRwpg0oI+j8oRViZw3C5aTNCAmOEEPOcByCBqRDXD1bqDpr439s6vSdfUs4 UPbIG7Kf67JK5eX5y2jZ4wjGr8iC+BSdoXp4yeKCmxenZKBtyyvUnNex/nWrbsYY diyAd1s2iS7XXkudt4BW6zKWVJUtAA== Extension name: 418ns433q ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BEB8AB4C5AE06882

http://decryptor.cc/BEB8AB4C5AE06882

Signatures

  • Suspicious use of WriteProcessMemory 2 IoCs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 77 IoCs
  • Drops file in Program Files directory 32 IoCs
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01.bin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Sets desktop wallpaper using registry
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in Program Files directory
    PID:3988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:648
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:588
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      PID:1912

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/648-0-0x0000000000000000-mapping.dmp

      Download