Overview

overview

10

Static

static

7D5E6782E9...CA.exe

windows7_x64

10

7D5E6782E9...CA.exe

windows10_x64

10

Analysis

  • max time kernel
    39s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    29-03-2021 22:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe

  • Size

    282KB

  • MD5

    1e7cc3701e8b0266529709e24cd2f6fa

  • SHA1

    5efac9cd4bd5bc67d3898280046967a2cdc5e547

  • SHA256

    7d5e6782e91871fd6fd5adbd61901443f5b5a18a7bffdf56426924a1c117c0ca

  • SHA512

    4ffcce0f25d7b3fdde59c0e73a4416fc538af9b3ef96f43c15267a7bafad0df372cbcd21aa4f36f0632465fe61e28b9d65c4a2e7bf180affb5b0e4799ca72841

Score
10/10
sodinokibi$2a$10$3opr4kvasuih0gwmilms4ed6m8q/l1qslbtkxvh0cr.7b0wqz23tm7231ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$3Opr4kvAsuIH0gwMiLMs4ed6M8Q/L1qSLbtKxVh0cr.7B0wqz23tm

Campaign

7231

C2

desert-trails.com

tastewilliamsburg.com

jyzdesign.com

kikedeoliveira.com

oslomf.no

steampluscarpetandfloors.com

kevinjodea.com

ora-it.de

deko4you.at

samnewbyjax.com

slimidealherbal.com

braffinjurylawfirm.com

rollingrockcolumbia.com

klimt2012.info

ecopro-kanto.com

mrsplans.net

stemenstilte.nl

team-montage.dk

henricekupper.com

garage-lecompte-rouen.fr
Attributes
  • net

    false

  • pid

    $2a$10$3Opr4kvAsuIH0gwMiLMs4ed6M8Q/L1qSLbtKxVh0cr.7B0wqz23tm

  • prc

    ShadowProtectSvc

    BackupExtender

    sqbcoreservice

    avgadmsv

    visio

    tbirdconfig

    DLOAdminSvcu

    dbeng50

    NSCTOP

    lmibackupvssservice

    infopath

    winword

    BackupMaint

    CarboniteUI

    wordpad

    sql

    kavfsscs

    dbsnmp

    BackupUpdater

    msaccess

    firefox

    powerpnt

    kavfs

    ccSvcHst

    ocomm

    onenote

    ocssd

    dlomaintsvcu

    Rtvscan

    thebat

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Hi there! We wish you to have a good day during these difficult times! We have to notify you that we have completed the downloading all sensitive data, including personal data about your clients, projects, databases, reports etc. Ask us - we will provide you with proofs. We will public all the data in case you refuse to pay. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In your interests to contact with us ASAP. Otherwise all your valuable information will be published and sold. Believe us, it's gonna cause way more expenses, than the price we ask. [+] What guarantees? [+] It's just a business. We absolutely do not care about you and your deals, besides receiving advantages. If we do not make our work and obligations - no one will cooperate with us. This is not in our interests. To check the ability to return files, you must go to our website. There you can decrypt one file for free. This is our warranty. If you do not cooperate with our service - for us, it does not matter. But you lose your time and data, because we have a private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap.

  • sub

    7231

  • svc

    tmlisten

    mfemms

    Altaro.HyperV.WAN.RemoteService.exe

    BackupExecAgentAccelerator

    AltiCTProxy

    AltiFTPUploader

    VeeamNFSSvc

    TeamViewer

    memtas

    ntrtscan

    SBAMSvc

    Altaro.SubAgent.N2.exe

    MSSQLFDLauncher$SQLEXPRESS

    ds_notifier

    psqlWGE

    veeam

    SAVAdminService

    masvc

    sophos

    McAfeeFramework

    sqlservr

    mcafee

    VeeamEndpointBackupSvc

    KAVFS

    klnagent

    Sage.NA.AT_AU.Service

    ofcservice

    SQLAgent$MSGPMR

    MSSQLTESTBACKUP02DEV

    Code42Service

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe
    "C:\Users\Admin\AppData\Local\Temp\7D5E6782E91871FD6FD5ADBD61901443F5B5A18A7BFFDF56426924A1C117C0CA.exe"
    1⤵
      PID:1752
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1144
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x2f4
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:564

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1144-5-0x000007FEFB811000-0x000007FEFB813000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1752-2-0x0000000075EB1000-0x0000000075EB3000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1752-3-0x0000000006010000-0x000000000A34B000-memory.dmp
        Filesize

        67.2MB

        Download
      • memory/1752-4-0x0000000000400000-0x000000000473B000-memory.dmp
        Filesize

        67.2MB

        Download