Overview

overview

10

Static

static

10

2af156b23d...3b.exe

windows7_x64

1

2af156b23d...3b.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    20-10-2020 09:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2af156b23d936ece676fa3ad220672970547f5e3218d2359d2596e47a5bf5d3b.exe

  • Size

    115KB

  • MD5

    69c242ee355cf2103f327fabc8a08fb8

  • SHA1

    ae0379b27d3810a589a316f1ab82ba97a76e2fbf

  • SHA256

    2af156b23d936ece676fa3ad220672970547f5e3218d2359d2596e47a5bf5d3b

  • SHA512

    02604a8d4b894a5d1bc8a8ff0399f8196a006a425eee7daed0b08b0e115ff590800d1990065cf0a59af9c47a60c2ba709af45851f7d69a4f681ae7d995890c1e

Score
10/10
ransomwarepersistencesodinokibi

Malware Config

Extracted

Path

C:\8ofbn5t-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 8ofbn5t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4B816A4667D1C872 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/4B816A4667D1C872 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: GuAAsivLAlJG0ZhbojmTh9PBpP9gDFZI4thKJkK4zSc5W3hH8ml4+pGXJ2uVRXGR +HOApz686j9aGF/jb0NtxRLmGwU0f28RfmAo7+DfSXD01zc7SueazxnN1cfokpiz kfSBj1N1EgzHggwhdcgxtVmEVnpwk/u+FTOfcIJ/2liBZAlKmmNxE1jI9JqXzapD gM6IKbAU9Ty9Mp1ov+ff0FNdSrfoW/xFpi8XNAskIX9yuVO7Qxf50+6hXezTMuBf k3jjQXupHFVcDM2TsDfPS6JQNm2yecyVtbf1LFrpvE3sLk472nUI1x74V/Xvw/ug R2Yxwcf9jKEDkhyqmZdP8cCZDIWsctfDCCu7jyUxevNeN0JNkV+50HD2L6zZnsEz u8DGCZqhKJXucDBAIp+LomzXK044hx+LkmCZU6sJuQA35jic9iAB5W+ms1bs26q5 CkEJY+eYHaJfOJo+rCKl77VNyHQcne+3TteCODyHA4aN4c+8Y5Wu5Ez8WdIKbXQ9 AbumAcwoK4WI0/zmFcg5oPlcjret6JV8eA6oMeAMsM2pLl96fC/mnUaueaRrE/TL D3euTysRIrjjEGHZARnlz1r0KbfQk8b/kcxLZyO/dLmWpB/0Qyq+412+VL8O9sZn 2rMiIlPxsdj33CAfUup5VhLDI5qWBWmje1IEBktbqF8LUsBhnxuudxDY1xEx14C3 fO3hiKYhfqqHNHquUN4AqZHceywVbD9/QEUekQmwEjAlWF+C3NaD9PngIQBYe5s6 8xDdGciqA2A0x/85qS6vRhX1145xff79L+d4j1RtRxu1MYV2yO/imx6IjypjU3Ky ZGbb8uCjdqQFRiDjydVkDZfJrQ5DF62fkKS87uKZnn6NZbm/bZhL/8Dh1LGwwGhP GCzLhbUWjn4JOAFHqtBdYqWQnSDfNi+lcxKuFcNZ/7b7oWjGtJiZh2sXVPH6B8RN YoW3cIjNYR0TI7ZurN2bu+2vy9kWWZ1c0h9YTKJ0WWUHCBQ9dRIX9AV/9yTAL5rU LMTFi3BHkTnntRvTx4gdiifsg5yKfFEI0Zs1n6wfpnZrJMD6Vsj+KEXWl5pHnqMb ofjqa8u2rJ1XF4Kglux0ztsUVUfZgQ76EjuyxFoi8jZcgCcM/wBxbta+eFFVkFuj /ZlfjhV01MTD71sa6S+2LCc0uvmEGP4TBCNgKRNp1QDIJRsvCP876nVAw8XWHGhX sYWjWKq3DmgpMlVQjQwZgISxTM24gF4vl3JMaDzEhWBZcSEF7QTSBALrYBfQFibU jUFwVG7mcHiVXAf1IxuvnAur Extension name: 8ofbn5t ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4B816A4667D1C872

http://decryptor.cc/4B816A4667D1C872

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 77 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2af156b23d936ece676fa3ad220672970547f5e3218d2359d2596e47a5bf5d3b.exe
    "C:\Users\Admin\AppData\Local\Temp\2af156b23d936ece676fa3ad220672970547f5e3218d2359d2596e47a5bf5d3b.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1120
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1240
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      PID:2704

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1120-0-0x0000000000000000-mapping.dmp
      Download
    • memory/1120-1-0x00007FFF8C8A0000-0x00007FFF8D28C000-memory.dmp
      Filesize

      9.9MB

      Download
    • memory/1120-2-0x0000024873640000-0x0000024873641000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1120-3-0x00000248758E0000-0x00000248758E1000-memory.dmp
      Filesize

      4KB

      Download