Overview

overview

10

Static

static

10

681836cd81...in.exe

windows7_x64

10

681836cd81...in.exe

windows10_x64

10

Analysis

  • max time kernel
    134s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    29-07-2020 14:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191.bin.exe

  • Size

    135KB

  • MD5

    c77bd2ccabf797907546b37f1fc710b8

  • SHA1

    2185a4adb041f3207320fdf80f4125d00cd135ee

  • SHA256

    681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191

  • SHA512

    e4585de808ac7313b7751ea91b0407628d508329cc646215e5df2af967d7c0036d3c0c9c082ad590e716b0a8fe9e64a8050364db401a3453980b9fab1eb15a21

Score
10/10
ransomwaresodinokibipersistence

Malware Config

Extracted

Path

C:\2t86oxx0h-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2t86oxx0h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B367BFA2B2281DA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8B367BFA2B2281DA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zlAlGcc34hFef+vnsbQ0UekbT3E3EU8Eh4sGMWyvyR4FQFO3NeatZ+SdlWP2ZQgn 2G4MhPFiU7OT/3XeGz/qBbNMxacf4cVbDdI87wBndFAPbv/yFpLGXIYh5vIrg47y g/FMFELeb37phSmUHU5KL2LbfTXymOOvUR2yF1aNjMSCy1LToWqfK+/0C4gfj9bi rXSZ3FK/P8N2cb8HvEJ4/1sS+pBlYRV+siwsiGYJOHe28wNNzuzkPyQ6l23lUAte 08KmCe8hWlBrX52FwSb2JctQAVlsmZQQMKJiJfjfLTAzMsSK5Nxmf3NVJwfyf2Mv LE0CiSQqg6GxN3CoJBCiSmzQmnUgrFRFLvPQ3u8wclGfeKdFFxfzl2W8sLxaI58Y NTkvv5nDHX5zxIls1dfXzexuLNWampqPASDL6Gtbi2dgirC4gHB0r2onAjKlJqJ+ /m3x9iI7pzeQHtKuqWPHRPVjywuTtqyZbfLhgpdILvdsI+hEhpGEs5z7qsgbEZGZ BMyrdG+NsPjRk1VuRZs7k4EFkgqb5N6Zi0HP5qsUCo9bh1hHqxaRPfttecLw0Un7 vZTOm84hAhntQlsqd8r3QAfYagkAH4vdAiARhQSV+8IOWGNZm7PSb9D9AMzc0ESg 2ZV1DWsRSNiqy6g15ClD6CzWWYnHUgXj04qfDqTRAE6i7ZvSoo7lyXlGRQv9yRyd 04PdoIo3YSJ3nXa3s4ApEeg5cciCkz2s2QcPBc+V+jX/FGglhKWrcc2crvOc+W4i GtoUtgMet3OOlh4OLF65u1ygLkG6w3zIp3bxRlDMknwOGPBksP1bgieF2qmoDA8z abKB7KcssQP6PmRqS1FhN/gbhx2mILkscQ3pXQZeYuNCVbs+BnYkZAlBN/tKm2uu gUULQRmWY1vWZqjJ6VGYLx7lDd2LbdeZALCys9heK14xhkOQiDwfdpTR+XibSCvC knCCU4rNmZv9vS1CmG8XjzjYy07r3NEIjiBRDd2cAJJpcBWCz6rEIBCtfNjXQl4g 02tkXuy53Ya5ot7pOCv9gxniJ5iVuuTEydHGqkIsqAlcxAxyLmpuqaLAnmIK0NgB wQqJELFnE15PBrtFzD2Xi3eAGav0s3CRtR80ibMKJ8XBay9xwEnR/0taRh+ycdU8 /N39svwaCNKZLx0WlUfwzY4CUb14b1vVItbpSGff4xqEjKV2Oh/oZcd+tMzI/bL5 u/1tyE/JlR1gZ3virtJwBAj+3t+wSfZJKQ/yQgK+0UPL+qNYgOLKcRyAwwmTx501 sM+pR0qOw4UnFJAlDvxT1IMP+6fGYw9s2zqMRVzC+NVeAO3K82g= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B367BFA2B2281DA

http://decryptor.cc/8B367BFA2B2281DA

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 75 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Program Files directory 28 IoCs
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs

Processes

  • C:\Users\Admin\AppData\Local\Temp\681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191.bin.exe"
    1⤵
    • Modifies system certificate store
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies extensions of user files
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • Adds Run key to start application
    PID:1412
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:272
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:300
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      PID:1384

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/272-0-0x0000000000000000-mapping.dmp

      Download