Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-02-2021 13:22
Static task
static1
Behavioral task
behavioral1
Sample
B40CA0BFB7AEC1C1B4218B98529B580B.file.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
B40CA0BFB7AEC1C1B4218B98529B580B.file.dll
Resource
win10v20201028
General
-
Target
B40CA0BFB7AEC1C1B4218B98529B580B.file.dll
-
Size
745KB
-
MD5
b40ca0bfb7aec1c1b4218b98529b580b
-
SHA1
5615f11ca85cdf2d5cd186028c60a21fdb6d7f72
-
SHA256
188b6a98ef67f6d79300062641e73e9ee5ec1c4172fe1cd91c7e7de7434c24dc
-
SHA512
69c4e6f306bb4e254c49b687ff227f93aa649444be29b7de2ed8f0b09637970b2d4e7bc10d6cfbec1ab753db23b41d56bb4e947159319790a9f1bf31ebf24611
Malware Config
Extracted
C:\ewotat18n-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78C111539B54919F
http://decoder.re/78C111539B54919F
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
regsvr32.exedescription ioc process File opened (read-only) \??\T: regsvr32.exe File opened (read-only) \??\U: regsvr32.exe File opened (read-only) \??\V: regsvr32.exe File opened (read-only) \??\Z: regsvr32.exe File opened (read-only) \??\P: regsvr32.exe File opened (read-only) \??\S: regsvr32.exe File opened (read-only) \??\A: regsvr32.exe File opened (read-only) \??\N: regsvr32.exe File opened (read-only) \??\M: regsvr32.exe File opened (read-only) \??\O: regsvr32.exe File opened (read-only) \??\W: regsvr32.exe File opened (read-only) \??\J: regsvr32.exe File opened (read-only) \??\K: regsvr32.exe File opened (read-only) \??\F: regsvr32.exe File opened (read-only) \??\G: regsvr32.exe File opened (read-only) \??\H: regsvr32.exe File opened (read-only) \??\I: regsvr32.exe File opened (read-only) \??\L: regsvr32.exe File opened (read-only) \??\Q: regsvr32.exe File opened (read-only) \??\B: regsvr32.exe File opened (read-only) \??\E: regsvr32.exe File opened (read-only) \??\Y: regsvr32.exe File opened (read-only) \??\R: regsvr32.exe File opened (read-only) \??\X: regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 1184 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
regsvr32.exevssvc.exedescription pid process Token: SeDebugPrivilege 1184 regsvr32.exe Token: SeTakeOwnershipPrivilege 1184 regsvr32.exe Token: SeBackupPrivilege 2020 vssvc.exe Token: SeRestorePrivilege 2020 vssvc.exe Token: SeAuditPrivilege 2020 vssvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1728 wrote to memory of 1184 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1184 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1184 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1184 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1184 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1184 1728 regsvr32.exe regsvr32.exe PID 1728 wrote to memory of 1184 1728 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\B40CA0BFB7AEC1C1B4218B98529B580B.file.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\B40CA0BFB7AEC1C1B4218B98529B580B.file.dll2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:592
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-3-0x0000000000000000-mapping.dmp
-
memory/1184-4-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1184-5-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1184-6-0x0000000001EE0000-0x000000000202D000-memory.dmpFilesize
1.3MB
-
memory/1728-2-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmpFilesize
8KB