Overview

overview

10

Static

static

10

ecb315b1fa...7d.exe

windows7_x64

10

ecb315b1fa...7d.exe

windows10_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    12-04-2021 19:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecb315b1fabea9de977b44e0399d87ecca6e962776bb63bbac0fff01e312e27d.exe

  • Size

    120KB

  • MD5

    a9d0f7e5c8f73806660711e59026e433

  • SHA1

    e435b0fb78497445aa8b677aa170cf2c3c66d509

  • SHA256

    ecb315b1fabea9de977b44e0399d87ecca6e962776bb63bbac0fff01e312e27d

  • SHA512

    8ab3f03a83d8e785e9989de01073c3f3e3d6659b6086822284bb276da03b8b434295902508ecb1be21b04dbf17f4ac7677658837bd21af911a44a0b784b947b4

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\346geh1b-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 346geh1b. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C49220B27BA53756 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C49220B27BA53756 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Blg7E2MiHEAT0ocbbbZ8wT36FEeihnxZe28K7K3UQ0ewEQkF73bhs7r0wwueb74E fqDnx+9gjB5WWdGlzMjAmsoRWxxaPu2XVJoRA5oahJy0OAh/x2aVz8UGYZtgMQR1 pZJUvA8vOfZEGXg6541OiI5q7JHnlAAwtiDhMSDZ/Vt1vdkifvj9osSNKEAQiKav FSjSjxRw7WOw+40Lj26NGagHQuqAT1Bj0cYw6vB3cGcauUwk6EMcApaZpbwYxmox AUpaVkVTWdvTw/WeZf1Dd9V0CMjpjMcSHW/8xAjR/I4jMUbU8kaZa5HuA/QswA5x dUAWA1Vws4ZbLPsiyhQiGl/gzkOf8bUweJiArspTpcvA3l0iJVC4OTZQVSen9TyY S0AOhIHlmIFsNaki7wuZKIGWD3KNl8hjXC/5/jXeQsq5DDZHA+p+Zj3fCw2Xvw2H rfHskyDRoVLw1np9s5e/S7nuOqtDdoAKbhRxuJzrCUTKR9GpGlM4+8PyfuL3kSrd JiBjPhax4FSNdkC4YKIXehhwUsXeSdsww7ksT6DHD+q+xTvrFrXjL+M8RFb/1lIB +yUfJcVUQgISHrtXyPR371lCFruwVXEo1XY2ud5847jlOmHxCzlAOV+lukQ5Uepe YJ1NL2xQXbo00VozZRSNSTgq8LPj8FzhTeCl8BOpoPe9ewsTTsjOafA2PDbHSQrR u5WaqIQtufxODGL5+OlWtGZeXPLBYRiTLKY+8BOLQetI7Y9+qxhHGP5Yopt8SfQW 3D2Y1lUWJY5dzJhiivSFt9omGwZiwWSDLGQWNHt2RSiOHtamA0200fgbe0/HGT5J ruB6h8nAFhxRIj0wvR0etPfJj42k0Jb81+BeGz4hKd6J2uBMRhXMk0mAgM1YzIIU 9aNwONhmQFXKzYeiukrTSn/noVYxxmIdlPM26G4iaMFaMT/2JOAX5GKpQn9b4Ccw 9c0xvV6eFBr+XrbQ4Sa6mIFYzByw/1Z7Omdm7kz4ZgNkrmxHQXreZk3t8Abf9Qxy AbL2lkbL0LRdOfxH8oq8uFTXG5mz2bhMcWpIgalQeB3nRFZL9mvYc2he+8CekJ59 UE+0BYRTyLtzdy1/6zN7VErGJyN/RM+2qF/x1m1WGDa6AzDt6NyLFLyf6SKZlVgl djfy5lfQJQi0RM1rT0U2wUUR9VsEmBDECAiD33X5a00QsRnIkJUmRW9lhCaE9PqL vmBHAUPd95R39ZYV8e5hIMBES0c3zW6MEkHt04aXusjLe+GXRVie991XYp3f4kKO XUDVEMM/WBk2HFRBDr0pWYYUfNMJG7zpabw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C49220B27BA53756

http://decoder.re/C49220B27BA53756

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecb315b1fabea9de977b44e0399d87ecca6e962776bb63bbac0fff01e312e27d.exe
    "C:\Users\Admin\AppData\Local\Temp\ecb315b1fabea9de977b44e0399d87ecca6e962776bb63bbac0fff01e312e27d.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1820
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:856
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:300

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1820-60-0x0000000076641000-0x0000000076643000-memory.dmp
      Filesize

      8KB

      Download