Overview

overview

10

Static

static

939f58c102...9d.exe

windows7_x64

1

939f58c102...9d.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    65s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-03-2021 22:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.exe

  • Size

    120KB

  • MD5

    9a24b3de7af3b2a2f1917e72e64da268

  • SHA1

    783bebb04eda5a88851aa741133ae49c29f44415

  • SHA256

    939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d

  • SHA512

    631b8165326463749e8bb01e74304343158b4cd4c6c4e4a8e60922a298b90dab9c83c60fd69c4eda8ddf2dcf97c4040dc723f7e9beeb9a94aee568c30867044d

Score
10/10
sodinokibipersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\2125m8z-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2125m8z. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/31E5A6BF7F0038B1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/31E5A6BF7F0038B1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DyD1wpJoEl0i0S87gJ5N8PKyvvhegmaz5tu5HpSCt2kmXckoCy92YGqAlayk8UWr xwNgMfode4w86sbB25PzMzx0MdUmrsl0Tw+MAyuOTJb2krdwtjPeioSw0R7YD0AD vFgKvQKMNV8ZT1aICp/EYlq2dQEnFWzyVpkIU5Xdcgd7fcjkiNwDk9ARsGqsjhiC 5FEYhE8PFZ/Wu+Gobz5xzvotFrMxWS4yIdot9NfXP4QmBQ0qoEA0HUGz6qLDLpol tB7iaBOfy1AmzdRA4NUCx5EZUZ1jSQfqC56VZsolJhf3vsEwvCvWUjXG9Nh345vX 043s0GFgNklE/YNXpzv7yHKUX9846AbkDwHG59PAHn4wq+iXgO3vaoBFfijMma6l dZUVrNRc8i9kskFGylYvw9K2M3Im8Z4NCezq7qhm7HrI0UHhG1Yane3/KZBDLz5H +A+QAoB3GsYxbObmfDO1bUOeLa7dNVLFqJFvNbg7NTIiE5iZgOZ+jXV8EoG6bgbb BubNYdl3/rsiYliOrtpb5JUbSCC1nm2ju75UlW2QVrJIAvn7XKkMfZcnVT8Z9s2o MLjf+hleQw05TTlqoQwzZvrbOAGhZ+X89UkwfPYcC1iD6AjSQ1/5J/6Mdsk8t8v1 bl63ZtaVJoeubKQDdjCpG9QL8ukQ0FM/HuYhCmjLARPW+fL/T/ausat0SXdJUMOG 3eE3y4SR1t/8+PfNMKuyMPh+dSE/KGroCP9mvsmHEWskaiwF+ft1enWO8j3dIJDL bu1z/X9pmVXwVUE85u8yU39b7k6bblUort9l1NVOMnT3uYE05OLKK2rmWIhNd3ck PbahTWO67QRf5iBn/fVhtwOXqVxBmBqTKmlvHPrBPjxA2d4q9r6ruekfoif2YHwq a6I1QQiU4uCjDiRnF3jveBXMvtAKGUoDFdRWp9NQjiqTBjTmlZwc1l6zLh9C+Rjx SKJ/ZstuTxgdr+NVDAU0gOK0b6IG6TgtR8Liflv/r4jyZyg4CWnjSG/+z8Jdo0Gh dEhDPljhbOUhkGdOHeVGxz4gssxRwzj/eu7Wlds9jSzJHSoHK6SkI8jXTUX6OPUr 9KPs/0tgCqwER/1At1zZqiCP2oI8tvuENEM0lgOQmRbRQQLgDla6CCyaCsU7A0c3 LvyoMRZPOd1gL0hcKc0JHs0YFzSYX3ysSJkrbr5k/KIKlCMeBxHOiShLkKIN218y 7T0ddwKGQzC7ynzQ+ArZGeqAZT4R5CNvNGz1Ef/MODBRT6RZhSUu4niForPRPzuc q4utqTtSx2I= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/31E5A6BF7F0038B1

http://decoder.re/31E5A6BF7F0038B1

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.exe
    "C:\Users\Admin\AppData\Local\Temp\939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:640
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:416
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:204

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads