Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10 -
submitted
03-10-2020 00:38
Static task
static1
Behavioral task
behavioral1
Sample
aJnevj8H.exe.dll
Resource
win7
Behavioral task
behavioral2
Sample
aJnevj8H.exe.dll
Resource
win10
General
-
Target
aJnevj8H.exe.dll
-
Size
116KB
-
MD5
b8fc295190e8c19d1f0737c3f4c61279
-
SHA1
dd612752d115ea406a2c474b39bbb5d7ada62002
-
SHA256
ce19e4ed0385850a51c60558b2f38fad20196cdeaae3767ffb92e8dd2508a88b
-
SHA512
abc60b2de8dce92bb988fa57cdcb78558a7769d9e094aafcb9969b61bc73f2afa9faddccbb82365dc54d70d9506f61fa96004cb05a20f3ec132e1c22ad054937
Malware Config
Extracted
C:\quxj5-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4B816A4667D1C872
http://decryptor.cc/4B816A4667D1C872
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Blacklisted process makes network request 157 IoCs
Processes:
rundll32.exeflow pid process 10 3800 rundll32.exe 12 3800 rundll32.exe 14 3800 rundll32.exe 16 3800 rundll32.exe 18 3800 rundll32.exe 20 3800 rundll32.exe 24 3800 rundll32.exe 26 3800 rundll32.exe 28 3800 rundll32.exe 30 3800 rundll32.exe 32 3800 rundll32.exe 34 3800 rundll32.exe 36 3800 rundll32.exe 38 3800 rundll32.exe 40 3800 rundll32.exe 42 3800 rundll32.exe 44 3800 rundll32.exe 46 3800 rundll32.exe 48 3800 rundll32.exe 50 3800 rundll32.exe 52 3800 rundll32.exe 54 3800 rundll32.exe 56 3800 rundll32.exe 58 3800 rundll32.exe 60 3800 rundll32.exe 62 3800 rundll32.exe 66 3800 rundll32.exe 68 3800 rundll32.exe 70 3800 rundll32.exe 72 3800 rundll32.exe 74 3800 rundll32.exe 76 3800 rundll32.exe 78 3800 rundll32.exe 80 3800 rundll32.exe 82 3800 rundll32.exe 84 3800 rundll32.exe 87 3800 rundll32.exe 89 3800 rundll32.exe 91 3800 rundll32.exe 93 3800 rundll32.exe 95 3800 rundll32.exe 98 3800 rundll32.exe 100 3800 rundll32.exe 102 3800 rundll32.exe 104 3800 rundll32.exe 106 3800 rundll32.exe 108 3800 rundll32.exe 111 3800 rundll32.exe 113 3800 rundll32.exe 115 3800 rundll32.exe 117 3800 rundll32.exe 119 3800 rundll32.exe 121 3800 rundll32.exe 123 3800 rundll32.exe 125 3800 rundll32.exe 127 3800 rundll32.exe 129 3800 rundll32.exe 131 3800 rundll32.exe 133 3800 rundll32.exe 135 3800 rundll32.exe 137 3800 rundll32.exe 139 3800 rundll32.exe 141 3800 rundll32.exe 143 3800 rundll32.exe -
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File renamed C:\Users\Admin\Pictures\GrantUnlock.raw => \??\c:\users\admin\pictures\GrantUnlock.raw.quxj5 rundll32.exe File renamed C:\Users\Admin\Pictures\ResolveSwitch.tiff => \??\c:\users\admin\pictures\ResolveSwitch.tiff.quxj5 rundll32.exe File renamed C:\Users\Admin\Pictures\StepConvertFrom.raw => \??\c:\users\admin\pictures\StepConvertFrom.raw.quxj5 rundll32.exe File opened for modification \??\c:\users\admin\pictures\ResolveSwitch.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\ApproveAssert.crw => \??\c:\users\admin\pictures\ApproveAssert.crw.quxj5 rundll32.exe File renamed C:\Users\Admin\Pictures\DisableUnregister.tif => \??\c:\users\admin\pictures\DisableUnregister.tif.quxj5 rundll32.exe File renamed C:\Users\Admin\Pictures\DismountSplit.tif => \??\c:\users\admin\pictures\DismountSplit.tif.quxj5 rundll32.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\D: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\Y: rundll32.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c6486wgi9k.bmp" rundll32.exe -
Drops file in Program Files directory 33 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification \??\c:\program files\PingTrace.gif rundll32.exe File opened for modification \??\c:\program files\ConvertRead.easmx rundll32.exe File opened for modification \??\c:\program files\ResizeApprove.ppsx rundll32.exe File opened for modification \??\c:\program files\RevokeApprove.xsl rundll32.exe File opened for modification \??\c:\program files\ShowRepair.xps rundll32.exe File opened for modification \??\c:\program files\StopLock.ADTS rundll32.exe File opened for modification \??\c:\program files\UpdateStep.mpeg3 rundll32.exe File opened for modification \??\c:\program files\GroupAdd.txt rundll32.exe File opened for modification \??\c:\program files\RestartClear.svgz rundll32.exe File opened for modification \??\c:\program files\SkipSubmit.ram rundll32.exe File opened for modification \??\c:\program files\SplitUnprotect.wax rundll32.exe File opened for modification \??\c:\program files\SyncEdit.zip rundll32.exe File opened for modification \??\c:\program files\UnpublishCopy.pptx rundll32.exe File opened for modification \??\c:\program files\InstallEnable.mp2 rundll32.exe File opened for modification \??\c:\program files\MergeUpdate.au rundll32.exe File opened for modification \??\c:\program files\ReadMerge.vdw rundll32.exe File opened for modification \??\c:\program files\SyncShow.potm rundll32.exe File created \??\c:\program files (x86)\quxj5-readme.txt rundll32.exe File opened for modification \??\c:\program files\SubmitExport.mpv2 rundll32.exe File opened for modification \??\c:\program files\WriteUpdate.vb rundll32.exe File opened for modification \??\c:\program files\CompressResume.kix rundll32.exe File opened for modification \??\c:\program files\InstallSwitch.ogg rundll32.exe File opened for modification \??\c:\program files\OptimizeMove.AAC rundll32.exe File opened for modification \??\c:\program files\RestoreInitialize.wav rundll32.exe File opened for modification \??\c:\program files\SplitLock.vdw rundll32.exe File opened for modification \??\c:\program files\StepSwitch.pot rundll32.exe File opened for modification \??\c:\program files\PingRead.wvx rundll32.exe File created \??\c:\program files\quxj5-readme.txt rundll32.exe File opened for modification \??\c:\program files\CloseSplit.ods rundll32.exe File opened for modification \??\c:\program files\DismountInvoke.TTS rundll32.exe File opened for modification \??\c:\program files\OptimizeConfirm.xla rundll32.exe File opened for modification \??\c:\program files\SubmitEnable.aiff rundll32.exe File opened for modification \??\c:\program files\UnpublishRemove.docx rundll32.exe -
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A416002331A4E0C8C53D94AC1E0234723D8BDE97 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A416002331A4E0C8C53D94AC1E0234723D8BDE97\Blob = 030000000100000014000000a416002331a4e0c8c53d94ac1e0234723d8bde971400000001000000140000008180d62879354a5b793589398f12176e117b2c1104000000010000001000000058bec6c6284db2ea1a8aca560691ff0f0f0000000100000020000000eed0b2ecc538897b88bde1b187557738b9d695936927b6d8c88ce131e34f675e190000000100000010000000603338adfa4a38f9199fb173f33983115c000000010000000400000000080000180000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f20000000010000007b040000308204773082035fa003020102020d01ee5f222de71b43a5d4669f9e300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3138313132313030303030305a170d3238313132313030303030305a3050310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361312630240603550403131d476c6f62616c5369676e205253412044562053534c204341203230313830820122300d06092a864886f70d01010105000382010f003082010a0282010100a8fb55f5fff090abffe7ef41bd683052e7fd32edc9f515f7c0b9af31709852521698d1e12d698067c56c5b7a2cf973b9ab9a85bd84336bd983af80f99dfa5290338fc0940a0a43aa3ada27a375cbd02d6a3a20dd779ffc476054356e33f4b3ba85a9f3467e6c5616e8a61e5300c6b4f28629f35b7a4030d8a8b72962ab7821c518c4dc61f9cc18963637ea4b9bcf6ecac467ab0345d75834bdbae36838fc5dc4a19082d51d3868c5d5a0a9732c9c8ab7dd70e049d70bf034c9ec3e3f754b821048691aff8bce9b1cc294ecb7dd4bd5b4e4590e188215f11bf3d8c77adac9963b57935538beb0ff20dbaf952c08bdaae3543945a31cf1f782d2cb4d61c20686250203010001a38201523082014e300e0603551d0f0101ff04040302018630270603551d250420301e06082b0601050507030106082b0601050507030206082b0601050507030930120603551d130101ff040830060101ff020100301d0603551d0e041604148180d62879354a5b793589398f12176e117b2c11301f0603551d230418301680148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc303e06082b0601050507010104323030302e06082b060105050730018622687474703a2f2f6f637370322e676c6f62616c7369676e2e636f6d2f726f6f74723330360603551d1f042f302d302ba029a0278625687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f726f6f742d72332e63726c30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f300d06092a864886f70d01010b050003820101004205854cdd9608e64fe853a78b382d86d4373c3ae4f10e2e794058a7d1fdd467f4847b9c9d8ef6707b6c846d6224aa8eb0bb90f9ec1516d5d511a2b519e275e42b7d444bd8b24c57c0f8112dfffee3f9ac96a909866e2308659da6e4837f43a7d2b992abe37bfdd68ec9a4d7a9c92177aafe631f64aecd1e239b60737a7e29ca57866af0b65e472a85c290502d60f22eb55b8b3919448930f89a357891279095a40bfd9403180f6e5eab038f827fa2447bfebb81c9e12e87c68a5a0052985ee815ab0a5cf29d4db212f43f4504f29b62fbb5aaebc8fc042c1a9419b2f8d125b16ed60536d2584b6180b63c62bca302b6dd36633968253a7ba28ba3141b092233 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3800 rundll32.exe 3800 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
rundll32.exevssvc.exedescription pid process Token: SeDebugPrivilege 3800 rundll32.exe Token: SeTakeOwnershipPrivilege 3800 rundll32.exe Token: SeBackupPrivilege 1460 vssvc.exe Token: SeRestorePrivilege 1460 vssvc.exe Token: SeAuditPrivilege 1460 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3588 wrote to memory of 3800 3588 rundll32.exe rundll32.exe PID 3588 wrote to memory of 3800 3588 rundll32.exe rundll32.exe PID 3588 wrote to memory of 3800 3588 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aJnevj8H.exe.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aJnevj8H.exe.dll,#12⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:364
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1460
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3800-0-0x0000000000000000-mapping.dmp