Overview

overview

10

Static

static

591d971b94...in.exe

windows7_x64

10

591d971b94...in.exe

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    20-08-2020 13:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a.bin.exe

  • Size

    115KB

  • MD5

    35766bd0b389c682306437d45ba5c4e6

  • SHA1

    b837df01d31c1bfff0e54f07076323d075a4bf27

  • SHA256

    591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a

  • SHA512

    e20472ae28857e4dd7b021e23366623cf6b3f9a4818b09c36997b1428220d244da760ff61aaa11de690278152fb551e2a002f7ff19e1cf60ad625845772930c6

Score
10/10
ransomwaresodinokibipersistence

Malware Config

Extracted

Path

C:\e9zkgun-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion e9zkgun. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1E0C9B09978739C8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/1E0C9B09978739C8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8c6L6GSxppa8Y9fOoQmATl/qC+PVr8xhFOnXY4lMN1HwTN41t9RvT/DdQxy1wJQx Y2ZOLkQMQwfZ7MJMIiq5Plzy3pnqIWYI/2nG2aaMve35Rc4vlILONAZFV0Z+l79t EkssYz6RAoC5gzPa2tcWQ7mRJ8EVyn/9J4oFPfdxZ6kZRQ3N2gHuC6qHhIYKqpZr 3kG2CqRT2ABxL8zTE4Y8y9tlK/50Ai+W5rhz903nxiFUitLEECHe12K9QW9Tsg6V mdF6c+6xuebpSHbJecCqFaFBsuy5Y8iy3LTvBBhhBWL7pviHDRQ0IEPcBcEtaCaZ t1u9kAJ/awWlknsWr1yG5vLxYzbtBfR8c6lYJ/jLqxP/i2LPzmDo0lrcPorf6s2T O5SgbsdIdisL1EN4vswLF23bgNKF8gHV8I1WgF4CpMnrCyumXIdmn7D1EpcJKC2E BYl+ksW72xDbAQM7HpuFG0O0nwUUg/haxtABZ2s9SCkZQBXc+0uoLV4Qc/lKTdTT owIDMOGOiGWfn/Q6J6Gs93zEd0usarYPvbF8bZ/IHa3eI3iouMpv3dcXugL4Bs4F N2PKmIIU7Pk6w6okSO+LR7HVBKrsbROCX6HqyNKR8MSIEpo4Aj6qm9gieorsXtm/ YjSNTAvglPx3ITOR9f0KZTw9BAeJvuYVfuGCVaqrn33qv2A5o/10d0a/cyNwQi+9 mpenUAzBD5+hVT+lHvGPFDNJ6r4m25TVeXJxr6Zub+d/3R0L3HmN2cNN8Wk2ezSY eukTYqLDY4Er5Gqy28GgbTnrf1qdaPHHimOpqz0K3b2O6xhnIXRmr83+CIaksAH+ v7tr54lHy94PzIZopm3iW/LE8l2qWwMGeKKCGtp+3a2np5/XRijMbs0o2tZqq7E2 2HSgaskmjq8g387cGDheUIg1oBDi5iMu6agprfCOY5+k1zLYeIcDzAalOq45WVwt Hb8f6K/9wbXZ1BwXeLjmq02Zm7lDuiLa+KfUE06gOdGP1gm1wefK8dNoqizvIsnW /tNNvNMubV/om/iOjfgytLQCLSIKXpxrxv0hZ2zNUDf7Sxgl7mq+AZSClUeG+zYM XTzgu6Mv/D9OOrI5/QC+x32+3KF4k70m9856k1LRsMW5vxzoCv7i5azzBMd7+xH2 J8lgtomnAEjSs2Wn1y9F2MFfEfBfnd4C5bAgY0RSY4ZNLHDXty8XpkXSoi6a2F9D fZsMd2yqMEfKZG/fqa2HmO8P5I8n2PqhTMsa5wPK48weR6PLgRo68AT2ubM/vjkt 2X9RB5O0GILqRhjmVySCn0DCcemU7lFsBYfsAjmg Extension name: e9zkgun ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1E0C9B09978739C8

http://decryptor.cc/1E0C9B09978739C8

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 11 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs
  • Drops file in System32 directory 1 IoCs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 28 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1288
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:284
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      PID:1852

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1288-0-0x0000000000000000-mapping.dmp

      Download

    • memory/1288-1-0x000007FEF64D0000-0x000007FEF6EBC000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1288-2-0x0000000002370000-0x0000000002371000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1288-3-0x000000001ABA0000-0x000000001ABA1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1288-4-0x0000000002770000-0x0000000002771000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1288-5-0x0000000002530000-0x0000000002531000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1288-6-0x0000000002840000-0x0000000002841000-memory.dmp

      Filesize

      4KB

      Download