Overview

overview

10

Static

static

azure-agent.exe

windows7_x64

1

azure-agent.exe

windows10_x64

10

Analysis

  • max time kernel
    60s
  • max time network
    56s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 08:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    azure-agent.exe

  • Size

    146KB

  • MD5

    b30ff382e069c56f5e53bb9bb6403965

  • SHA1

    2710508a5a01281e509ed9201bda734d22798509

  • SHA256

    75555df5e8b1644f321ca4fdd0122902aa664257105c5b0e698f402cbc0537d3

  • SHA512

    2b810d64c72fc3485b2ac61451ae4be237ca5079e42f4124d97aa80d07e59ca90cdb0626bedbb7877fd6c877881f72a3384543c0f2ff4f571dd35a31f6bb58d5

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\4nwe6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4nwe6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] ESXI (Virtual machines) [+] Your ESXI servers, are encrypted. Virtual machines and the data that are processed on them were not deleted but encrypted. You can check this by viewing the contents of disk storages in VMWare VCENTER or via ESXI. We recommend that you do not perform any action with VMWare VCENTER and ESXI until you receive the decryptor. Otherwise, we do not guarantee the recovery of your virtual machines. [+] Data Leak [+] More than 500 gigabytes of data were copied. It was not blind copying - most of the data was analyzed. Public disclosure of data will cost the company reputation and financial losses. At our disposal: Projects of your clients, including problems. Your current developments Files related to R&D Source codes of programs Financial documents and reporting And many other The data will be published in the blog if we won't come to an agreement - many media outlets follow the blog and after the data publication, many large media will write about the incident. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7D031C38933EE26 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A7D031C38933EE26 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: FGCsUGr2yvLCtHYdU7JtkYj1NlFs3vQ96IUzvqWw50iItIQIuZ3N6DzCbOs55ek8 vtwkrdx0lhuvQDkb/tmUQrBesjZp33gIOLZZXxHGmn2Uk3UHbJdtq+uIyfPI6zcW KqKA9IFKocfT33AGcNU/nhV5xTv9RjR0x56uVziJ43amwiRJez44iNYviSP2rBy3 xp1i0SNh9cX5ckAv+k2iiRTjk+nBoqtgDP2fqwruTJGjcuE5qOB+YxgFPh8Mzrp7 6qGlVq1wSZtB3cbiYjwZHtWGmiAs2QqIDLN2jK6nBgxuj7X47pDbuKsC95J4JFE/ ngIZtIFLv1T21JbzFik5R3XzFbuDEh1Bn/878z3ce7+V5+z2UWLqioZNrk89XwWo xE5EbMplRIeoVasiU32/vzPlg29Xt5V1sTq8sGDsotlaqoIuQ9vs2DLyuHFPN8yg D+SfZNt+wz0V1+73YYYV6MyhDQkc1L7ySNh4Gip0AUFMd/QqzS6GqZRfO4PPxlAb e5voHlxyFvZi9KIwpvavtgpIaQky3HdDqBv7brSldV0tR4l66Gke6G9km4407Huu SlC4MKs0814VIQTjHuar50RT+Gv7q0c/Ew9R2X5QQCjOq6IgvTrpdvJyWpwhyOej 3IhU+F/h3Vi+SBLtx8eG6MFUF9zmqRDPyqgIERX+OiG6O523b4K/JBnLm53HJPIH 8Yr82O8x6YqXA56r9kiR7GK1fX+fKA2UidgTdzSyPppeTCV0xwiNUK8cny+vyG3I Lp0Ke5AgillBRA+E/FwxXZIWBMSVwiWhMkAOI3CtXGXBEJhGTleJj1zZ2ToW+kqN nLeqlC1BrsE5fgHAL925tt2mKHJFsNmdEkmCh5xH0iNkmUC7gggOc9iSOe/p7ZvB 5YnTQZ8TjZSqbSAocbFJyzvlBWprUCqv7wVAk21oT0k9fMvnvzRuWUpJM0XSgFK6 itXsUSWF27lwyXR6Wu3iC6n5uHPnuhXogpwiXpIvBcxWV23MiP9DFTledAfO1cqc JgvlTs5XOIk5aYfe9BctN2lX+yavj4a5x8UEOIxOfvXkBLOUx20D3feSckRbte9u IRbbGgybrzFBzC1NLxR9p9H8+OdBWF6l7GlROJRFNHLnfHlmbIXVKbvC59FedqqP 5qAlHifZT6zM1x1wXLV3OVw2+jpXBmN4Efxfm2ymqXqz2CwRSdyytqbx/x511ZHL 7/Myc4dOvMjZC8eydWAuemVh8TN/m/DKry9I4ubrFa+VomeBc5kUDJ4lf0ng3+Zl aC0VAvGL+9KFoR5Y3QI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! We are ready to provide a discount if your company contacts us as soon as possible and is ready to quickly conduct a transaction. Otherwise, we will not be able to provide you with a discount.
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7D031C38933EE26

http://decryptor.cc/A7D031C38933EE26

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\azure-agent.exe
    "C:\Users\Admin\AppData\Local\Temp\azure-agent.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1316
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2520
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      PID:372
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\4nwe6-readme.txt
      1⤵
        PID:3792

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Modify Existing Service

      1
      T1031

      Privilege Escalation

      Defense Evasion

      Modify Registry

      2
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Defacement

      1
      T1491

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Desktop\4nwe6-readme.txt
        MD5

        094220c3bd010caa763ff4627e302f29

        SHA1

        8cd64b01c444e4302bcb09e44e7a0c26bf9f5996

        SHA256

        a9b0a99f0f61a1b41a906e0a9425aa724879ac08eea7c9c0d9a5211b94cee1ba

        SHA512

        d1c8f88984a0a9f6572506c668d3d27f0340a9c46ad2766da4a9ca9ba8091f69262b4a8e485009bea3655dbcd0ebfe0dbd8e72b370a18d501c9ab7a252ac431e

        Download Submit
      • memory/1316-0-0x00000000030F7000-0x00000000030F8000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1316-1-0x0000000004D60000-0x0000000004D61000-memory.dmp
        Filesize

        4KB

        Download