Overview

overview

10

Static

static

10

2df2fab33c...8c.exe

windows7_x64

1

2df2fab33c...8c.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    31-03-2021 14:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

  • Size

    120KB

  • MD5

    56b9c44b62a03b837df7ad35e8ef3dd4

  • SHA1

    75a8ee1cba41ff1e0bc042d54657b3b76b7275ea

  • SHA256

    2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c

  • SHA512

    5f34d8615ba06c704ea83ab201b6b3f7a7fc42b20caec40426918ed987507a53be0656447b34ed2fa33bb607ddfa74f533c4d8d6f5c844812c741d63ab7202a6

Score
10/10
sodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

C:\820iq-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 820iq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/27152F2BE094E04F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/27152F2BE094E04F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: BBiyDVlvKIb8UKoE5XgLJNBb97LGsf+dKKypLTiZuWx95oz/7g7mm+ANuZ4Lxwys mfQBoGQdgOl+jGJQND2z6WeBPUVTeCJzCKzOnILoqqeC7GIeQhG3FzF6bDgVz+Uj Tf8K5veRblXqi6tR97TVO/3Phems3K7K7VD1kazIOZF9BE+Y57A9oOfm/9y1EBQV CuVI+oUmLncJjJJItnw2AJjKFLs0mSUBE/Swy3Qk8w5om9JUxT+XhEUOa4jxLq6p 6unpHUKOdhCTOuJ4UuKbKF8KDaWqmy+xU8hoPracsS2Ook1dzeEvW+rgVB4f45d3 FGcAdJiSREUEfpKMfzNM+gwfMOp1EUBrIVSG/U7lnKHgnRTHUmEtTJLbpFy+X6WB 3+YM9/+uAZuOLqN7IX7QbuPRLLu30Xuh6w7Jx8oF1LK6re7npyVyGLq/JtsPG2vN OQAsBC6Xy8EDM1msu1jrDbdk0OPnXVyg6ZOCZdFaYmBwVr/Pj84Hkp88e7rfLqUQ Tw6DOhrm1lSvLxN20g+bum3a46ythIckRaGXwbf1LwMc8jCe53+gB+DH0p96xtDc 3xoV5j8DZxVicxINgM8ORviDF7MAZD3S8OV+VsBDp992tQf97a4cftCv1Ixe0D2M k3z/gZRmAh37rrTLWhgv3v+xDgwxamLXwHaJqMX1fBolNubMsPpUfG0maxrGiKso 4f3M+Mmn1e/hbkvCsd8ELXvVqTmQkCcbvJdh/LJRDVqqXHKsM3Xt1nnS+rFuMihy Sr4zXXuYhkBPUscUCKo0U0sXH3VNtHK6Cb6Tdxo0YqMMTNMT9ZnHMwaj+t7lN+Tc SF8iMBRYvS+ueWpjj4xqEi+pARumziRzolOWWkTOqdRjCjPrLXy5axN6KnHrIoLs 1JH/EOfsTUqaPfY/fKYfJjmlKptSu27C9f0amgJBKpTWiZhZOT2pyMHMjcU8YFMu WGAIxIOOwmcPYAWonQmY34HIJ3pgqxXynKxQhUh8JYrnfKQTApqo+SzXE5xk5dIy IgmqriewbwgfUs2ATHU6TeRHNy6MTib1v1mgHpIYnlG+bda61QNHNV56NqsF48A+ kxSOOW3BGgncWWdHe+933x4gCGpsdLvq1nlbMShQdwgtb0XlWatn5gb+DdEX77qg rgvArn+BZE2QnIN3BK2QCLTY+jE4GiY3aQ85gXAkYGHOnedtRGFqJzLMNYZzf8ie XMkvc8Y3TgfPnEWG8AuU1OLItcTrSGRnaGYub/7fO3SRsi70Z+NC88d8/Bam9yKT X1meyg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/27152F2BE094E04F

http://decoder.re/27152F2BE094E04F

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
    "C:\Users\Admin\AppData\Local\Temp\2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:648
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4084
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2956
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\820iq-readme.txt
      1⤵
        PID:3556

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Desktop\820iq-readme.txt
        MD5

        c46c262002173444e6a555d569fcdbeb

        SHA1

        7b18542b9aa5b732d25704a8658c2be3dd1e0dcf

        SHA256

        0118f5a8386fc109df579b004420e84fbea5a190f1f92266f399bcb144a096fb

        SHA512

        86acee5d0cfa07949d65931bda68db4e625cc8919c44c2ebc540ea0647fc29641acc69ec9b83bb7284be2ae8d7ed01b1ede5feeca10789e77784592eef0ff5a0

        Download Submit