Overview

overview

10

Static

static

10

12d8bfa1ae...in.exe

windows7_x64

10

12d8bfa1ae...in.exe

windows10_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    23/03/2021, 21:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
  • Size 120KB
  • Sample210323-wfpb8whegx
  • SHA256 12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39
  • MD5 SHA1 SHA512
Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

  • C:\fzu9b6439-readme.txt

  • sodinokibi

Ransom Note
  • ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension fzu9b6439. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3D417ED45AA7BC2A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/3D417ED45AA7BC2A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +4UyqKqnbYLkT2j9keAnI37Uy9h6yHhJRszTHxoRvKGv3QHgppigAUsXyh5woCgl Nln4eoui+7mo0VergxuNfQfC3MJBBim9x4Y+zCQ3ti7RBuXX01CF120A1Mgldf3S Gvk25f6fApqb7/FFJn1MYwmsMd+i33Dqo6XRC7uFOGk/HHcBzSwl/we1hzbnM1wy G91MGgY8UtIxDFGAHKPTi/3kv6YS9iog3pcuFVj/PiGL4HriLrnavvnZdBH6GsaX NLbEzFoYbvMj1GbCV7Q1e/7Kym6DzAR5MVc4PxbK4pJdWtcXWxCPD8uHcne94x2S PigQDY0TC2ESJtfU1e64g8mbTWtjNUSOJ6+mzcblGzBrAvuT9Ddp/J9Ctsymdw0e 1BWHGfWVA/EGUMnaTsXJdygJEE3ZbZxu2+PfX/wgIBmTb/LwZAQJdHEZdvsPs2Vd f4alLQybMKvXEKy4S6EQJXH0qbaJLFvNYdGvjFbBKV2gTqAn39yw4hwz0pDnYZgc dtvm1eATp7jya8ClrRmvKmiMkt6L4obqJbCkgMOpU4XT2/ulGiMNfNLheHij3Nia CkRjCuWirsaGGEB/OrG+2D4OOVaYxQBCrWs9wWc7GpBRhdmaJpWUH1qYNjPqYdNG yo3t+PVzJsn6vRFucdanG9QQDCdGvMI5FubLjKvXKFnijUR5D+PEED8eY9NhoGXZ Prt85EOXANmunJn0jgg7xtF+5CB0Ughn/kXH41MAQGLVOlOaWusz5AxuJm1fBk6r Zg7lD5NpKEaFEcJbFEuQixYYlPXIscyjb+B6sJ2wgJFNpF71px+VvHJ83lICv4fw LsPCwCwvjLQ6HaAdtC+0fZb8IU/J6sJ8DGk854VyOLPq4GZCyQpgmW5XevCEMLkl j2VJ44MrlZoyS2c4Kf/+95fmSsIotJPAPUYGsHfxTZFKSxV3mcMHeMR4DRgHb3QA +9UL66O6Hhg2w49Mi4s6bfllaeMVCPJdajT3lOtxgykZ7iFs4uBOVzdcl+cxRtW5 L0gjLlxELQu1HgHvNHFkJb0yiEpOuvtTOhe3lScrH9GST+Q9aqXE59VC5nx+oVVg QZb0QzjRfPRkJBaTnfOqCjtQgiUAvse9a3zLqOh5s96jCXP9HZkG/OcWO2ssUpkA Kl/txpish90K2/OGNGCLnIBplL9Mf5PNviKFhkfZXKkdCUkdOEYA+YHLtFWKv98N JCnoPVsxSIRVRnQz8F+I5s7Hs0gSQS8CpToBomC42cMQydOjCKpig0LO7sGMNuUn DytJAKVc7yBj7uAX0XcZkMdnY5HeStQ3Ga8pdQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3D417ED45AA7BC2A

  • http://decoder.re/3D417ED45AA7BC2A

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1856
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1624
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:864

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1856-2-0x00000000767E1000-0x00000000767E3000-memory.dmp
          Download