Analysis
-
max time kernel
19s -
max time network
76s -
platform
windows10_x64 -
resource
win10 -
submitted
22-09-2020 10:55
Static task
static1
Behavioral task
behavioral1
Sample
p5BKNUKE.exe.dll
Resource
win7
Behavioral task
behavioral2
Sample
p5BKNUKE.exe.dll
Resource
win10
General
-
Target
p5BKNUKE.exe.dll
-
Size
116KB
-
MD5
3ec350b912bf27249dfb93221a4b7a9b
-
SHA1
2142fe0caa3f08b98ffe6b3f9ae82f4bfb5f3abf
-
SHA256
93bd21cb6331ce96cc28dc7a1f0b6b2b2ed8ec064d2ac6e1f428af59c924cb57
-
SHA512
1e54a3204d8ca0665617093e725f3e32d46ffeef3b25f019cd5039dc1a24022d52d595bc2bf1a630985b8f1899ed01fbe22f9a943f9037743946b2cea3379d02
Malware Config
Extracted
C:\d13w2651o-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/19B34FA2DEBA67B1
http://decryptor.cc/19B34FA2DEBA67B1
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File opened for modification \??\c:\users\admin\pictures\EnterUnblock.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\EnterUnblock.tiff => \??\c:\users\admin\pictures\EnterUnblock.tiff.d13w2651o rundll32.exe File renamed C:\Users\Admin\Pictures\OutExport.tif => \??\c:\users\admin\pictures\OutExport.tif.d13w2651o rundll32.exe File renamed C:\Users\Admin\Pictures\SwitchProtect.tif => \??\c:\users\admin\pictures\SwitchProtect.tif.d13w2651o rundll32.exe File renamed C:\Users\Admin\Pictures\UnprotectCompress.tif => \??\c:\users\admin\pictures\UnprotectCompress.tif.d13w2651o rundll32.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\Z: rundll32.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvngr7n2.bmp" rundll32.exe -
Drops file in Program Files directory 22 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification \??\c:\program files\ConfirmStep.odt rundll32.exe File opened for modification \??\c:\program files\FormatHide.doc rundll32.exe File opened for modification \??\c:\program files\InitializeSync.xsl rundll32.exe File opened for modification \??\c:\program files\MoveCopy.xlsm rundll32.exe File opened for modification \??\c:\program files\RepairConnect.aifc rundll32.exe File created \??\c:\program files (x86)\d13w2651o-readme.txt rundll32.exe File opened for modification \??\c:\program files\CheckpointAdd.ogg rundll32.exe File opened for modification \??\c:\program files\CompressResume.M2TS rundll32.exe File opened for modification \??\c:\program files\RegisterUninstall.js rundll32.exe File opened for modification \??\c:\program files\RemoveUndo.wmx rundll32.exe File opened for modification \??\c:\program files\SwitchRequest.aiff rundll32.exe File created \??\c:\program files\d13w2651o-readme.txt rundll32.exe File opened for modification \??\c:\program files\ConvertToUndo.jtx rundll32.exe File opened for modification \??\c:\program files\PushExpand.dot rundll32.exe File opened for modification \??\c:\program files\SwitchNew.htm rundll32.exe File opened for modification \??\c:\program files\CompareRegister.vsdm rundll32.exe File opened for modification \??\c:\program files\DisconnectFormat.wax rundll32.exe File opened for modification \??\c:\program files\SaveExit.vdx rundll32.exe File opened for modification \??\c:\program files\UnlockPop.dotx rundll32.exe File opened for modification \??\c:\program files\FormatSearch.dwg rundll32.exe File opened for modification \??\c:\program files\ProtectStep.mov rundll32.exe File opened for modification \??\c:\program files\RegisterProtect.wma rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3888 rundll32.exe 3888 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
rundll32.exevssvc.exedescription pid process Token: SeDebugPrivilege 3888 rundll32.exe Token: SeTakeOwnershipPrivilege 3888 rundll32.exe Token: SeBackupPrivilege 2840 vssvc.exe Token: SeRestorePrivilege 2840 vssvc.exe Token: SeAuditPrivilege 2840 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3892 wrote to memory of 3888 3892 rundll32.exe rundll32.exe PID 3892 wrote to memory of 3888 3892 rundll32.exe rundll32.exe PID 3892 wrote to memory of 3888 3892 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\p5BKNUKE.exe.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\p5BKNUKE.exe.dll,#12⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2128
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2840