Overview

overview

10

Static

static

711ea342f3...87.exe

windows7_x64

10

711ea342f3...87.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-03-2021 21:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    711ea342f393ba9f505e5d72ff1299d12fd3bb420106ae96221b5121ac64eb87.exe

  • Size

    118KB

  • MD5

    e332da214c04a1eb20214777c63989c3

  • SHA1

    6f1b7cb70feb12b3d76f349f13b7ee18283c089b

  • SHA256

    711ea342f393ba9f505e5d72ff1299d12fd3bb420106ae96221b5121ac64eb87

  • SHA512

    8244d8314c634371d3dca8b2f30b5a61dcafe4a3f9e9faba0e233a5373307836fec77337d4c1d943cf567bd6a1ac2efa5156b5ac7dd06eadaa56f0d436b7ceaf

Score
10/10
sodinokibipersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\f590d0t212-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension f590d0t212. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1BCD9ED43B973EB5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/1BCD9ED43B973EB5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: PnwrA4ghA/w0ieoV11T8LHEAfWGH4MRtJhpKOOItHAaoWzDb+HecudJog36zO+gG EiX46r1iKXSBFqQw2sZRg7jajiMyU/TkGg0ver1VCPYMnPutYGd7jkBy3H/9LDNR o2Omwbr0Vh1EnFAlPdCxHP7yZJ4MlK1eiS0ZK0aSdrWWG6MMGAl/FwWUllhOTTbV cSG9o7I3loJk0mis1udbG2I09I4+DUclpByaWnnAryqKMm18rRjYUYEVGDdasHqv bUROe0mN3Pa+CzVtKWzVawG0njdw7/tMatvgyB6Nd0bWYNgLfs3BIBDBW+LyIoQY 6UFo517ZdPjhpovUZvVcB/SX5qW2jTDRbghRWLVbLQuFBL6r5MdU2f807WSyu2FM ajeG2Ckm66BTF9Tz9NkCEbQxcCyNv5wVKvOvbeJSHeNIjDPSIj/r0yUTvd9XwkLg L3eumGOpkRbfTNuCCLVzJj8T/MSjOGUkIMTt/xk8kzSc/HU+qzhzuW9x2axrxN4e SxUW4ZxQLOQqLG6J0rzlSkH09UVBZHyXtzXAU/GFP/iuiNU4v9oW+eutmvmQ0c+Q 7daSDFzPTlWkms8DWmqaQhg3IodLaeb0BYN3p/KKZ9LJt+cbq5TIaWKrMxvh+kea HAgqJ/pG9hZkOOL18Czyjz6Y/TsE7c+IqLXrS5OsfcyTxcF4bi+dssBia/Sw1+26 IZZ7zs+fjSIXoWELk5+EyLs4DkwhdkHOp0sgxuU2N9svYjC6/Gtlos0ZDgLZsWDQ RRNMifyoUzdYUcWeKxER1kZn0dgzsEJSVCyY2X47F6DA176Hn/dej+GX0t/QFRoM XcCRz3hM4aJvBG5un+Ahk6jgDL5J8lV/xlHGcuvI/XhD4gy4MSzxStoOjPJRf/kz xxIPtK+gahB/FCXs3SQekugiR9Gu+3IWTLfl5PvyddmTeVVHOtHac0edsxhon/ua 2cSz5SB8K6S6an49hhYd6rixasBWRRlLt8UQN24iaMQUZcoV6lrV9g8s19tLJYL6 SlNHqB4t6cJqmuGRjFnbzWcRHs/zVO6VhMAedzj+twiLLKCVN8qyboFS9OJ39nxT mEgN6CAsdHpZwvsSyxmHQsDQIyaddGbSdWJwwptKttUMmRoOJZMJiR/sDR0ulHZm a262gUS0UlCKfXmq4kt+wzfaP/i9tFaooWa/y3GeiiX7GxmkxE0RKdmUPbeBL8yA TVbhLLKRwJb9Q3Fgmy2s7vaS7MFX0sfEN4qg0EIN67dE/GwpADeVGmgZKVv4kiml /3rSEXbq7DGVX99rbRhYvGG1B9rSXCin ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1BCD9ED43B973EB5

http://decoder.re/1BCD9ED43B973EB5

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\711ea342f393ba9f505e5d72ff1299d12fd3bb420106ae96221b5121ac64eb87.exe
    "C:\Users\Admin\AppData\Local\Temp\711ea342f393ba9f505e5d72ff1299d12fd3bb420106ae96221b5121ac64eb87.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1112
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2236
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3444

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads