Overview

overview

10

Static

static

test.bin.dll

windows7_x64

1

test.bin.dll

windows10_x64

10

Resubmissions

12-04-2021 15:31

210412-mjs3k29b1a 10

22-02-2021 08:21

210222-k1twhj5v3a 10

Analysis

  • max time kernel
    40s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-02-2021 08:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test.bin.dll

  • Size

    218KB

  • MD5

    12998ead3767b8e2a7d3172432c2347a

  • SHA1

    21c8fb727afbb4d7078a2ce25eaf569c28afb308

  • SHA256

    e275c0b13ef51066e1a5a8d9a3e9f2859d091560dd3c5eac8cd7920bdf3dcbd6

  • SHA512

    252f3159a90dddd528b23d0f6f09ea56eb3470b1c674faa87f20e453f6db2c5939b462dd6a7a77bad2903476aa84efc9ff9c79ef1484e89c2c257820b190c3cb

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\56gg4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 56gg4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A3937D9EA5842B85 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A3937D9EA5842B85 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WRh6bwWBFrnf5CFSnoc5KoL1XBu3T6cbjgsmqkm+tv4JFWDonSiKJqM7sQjfnpRK 1gUSXf7s3mVvaXYFJU5uDw72A9wGIYuaE61u4AXVkHbNXlg+Y6YJKVXxwjmRNPw9 e6EzczDqVwWmsTrWiaORc4a50q517FDhX4IiQF9oPYNu/8NV1D9f3qB4uTAAzVoF 27KVTnM6LlG4Vv/h1Q8dgyaQDM/Jd4CLsYgCn8C98aK0Qg2lO0p5O6ByML25/nPS Pd8erDOsjZGNmFCWtDwb2xNdbwpVTnBXyllawL+KZapvog8jiCt+b3VZJuAjDPKX eMjIB0ttMyZm5JAOy0sIxWA3QVdFms18QRBjXAv1XZz2Cn2UDP9WHLtEZIHfrIjT Mz8vbuRCrO5PvNhfQDYCfXKkwF0jQhJTrgmjrDSHesQxtKCogrYWCnlrgkEsOo7M zVTv3gMausqBozJe9b54MLBsOSBLhx3MklOkw2sVbuBovlIypUoenK/rYTVGdSw3 Mj4AeluEjXqu+eg3pUApTQLFYFd2XMF9tVR+PfTNJBsumzGSkJ+u1B46VHfbsKHt 4lBpsBXov16YL2Pa1DeRwc67MG3gaPv0DV3ZQRO8okNFqsXw37sfnFsY5ZDZK/Fs Ss6tXENL0lZKrpEkHDudkYSPtzIxI1kG2L3UGuYI4wO9PXhYr8FaJ6llPbBQslYo BOmuIgVeMLkwVNPC7eaGGXGkYXrYX8ZEiI/wZZDV3Rt0G02XcJIudTev754GL4yD uTs6Fx27NsKlGFm+Tariuh8mpzW1nxYPXG/GUoqlXqrGTesoF/Ha1EkOrvtMD5Af NTD4dJqay9uW2pzVxQrhQoe4ZfT8KQBJR+85/5Uut5NQpb3Tv/MK+KwsbAK7WBh/ OUve5IRAOqbrWrSIZAojtl5CxmKX3IgeIYwRxxZju6QLVoVVlvSeQmVQDGYYiWv6 Upwu+SNGJ877/hGoWjQ7Qm35EjycWOkA63UKRZwGH3ApTmwffAdTYAn6UcKxzdRD pp1v54W6cMEifK8kKT234R0ESUJzazBTzPIV9vycWx8YAM9O9lmDELU1N3K+/4Ml djDDD4vJwyv1xXMgOFJs2qzVpePE5Z43lBbT+Se1edM0SbDbbaPvXGJBD53svbDd Dhh9m2qPDs/S95kWFrteV7079kdacWovMyQuVN6J6ACcpaQay/EV6P0RmlpHZ432 TF9X3/dkQbBEqwaihWokbFlw0U6Kada0W2Wa8OZbUhoYzSw3YAnvITViZFcX3RJp fTy49ujNbw6TtYy4rBo= =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A3937D9EA5842B85

http://decoder.re/A3937D9EA5842B85

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\test.bin.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:416
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\test.bin.dll
      2⤵
      • Modifies extensions of user files
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1256
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2380
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4052
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\56gg4-readme.txt
      1⤵
        PID:4056

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Desktop\56gg4-readme.txt
        MD5

        127895542fbab32cbee743d6d6e36224

        SHA1

        595e809213f3fb36b6dc07f0ab1c1a87053b9acb

        SHA256

        3b918df3d6eb2c9795677a44982e441d690ec05113d330937ec2beeee55f59dc

        SHA512

        d43bd6a04b3326d79f37176c02b8631b7163aaa5e5c1e28bcc6859a9d26a2c7548edfe3b4c225689b2b5240d2c0dbd8148a5e7c4c8cb490d3dec72ab70d0aabd

        Download Submit
      • memory/1256-2-0x0000000000000000-mapping.dmp
        Download
      • memory/1256-3-0x0000000000681000-0x000000000068A000-memory.dmp
        Filesize

        36KB

        Download
      • memory/1256-4-0x0000000000390000-0x0000000000391000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1256-5-0x0000000000680000-0x00000000006C5000-memory.dmp
        Filesize

        276KB

        Download