Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-05-2021 16:00
Static task
static1
Behavioral task
behavioral1
Sample
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe
Resource
win10v20210408
General
-
Target
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe
-
Size
164KB
-
MD5
6e139f3da41b57d2a7b90b6a8d52a396
-
SHA1
47f4b6b0b655f6659ec0f4e84d479b5c35d8a9b0
-
SHA256
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1
-
SHA512
70c53a619f5f4ccb550530f980cf79fec2c252fa173640d61a2d10d986b90b334dc74f6fe227f3b77fe5de9abbc03962444de055e32b355b9f3358e450f3f50c
Malware Config
Extracted
C:\189qz1d589-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CC63D271CF22A3AE
http://decryptor.top/CC63D271CF22A3AE
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\SaveUnblock.tif => \??\c:\users\admin\pictures\SaveUnblock.tif.189qz1d589 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File renamed C:\Users\Admin\Pictures\ShowLimit.png => \??\c:\users\admin\pictures\ShowLimit.png.189qz1d589 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File renamed C:\Users\Admin\Pictures\SkipGet.crw => \??\c:\users\admin\pictures\SkipGet.crw.189qz1d589 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File renamed C:\Users\Admin\Pictures\ClearMeasure.tiff => \??\c:\users\admin\pictures\ClearMeasure.tiff.189qz1d589 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\users\admin\pictures\CompressCheckpoint.tiff 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompressCheckpoint.tiff => \??\c:\users\admin\pictures\CompressCheckpoint.tiff.189qz1d589 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File renamed C:\Users\Admin\Pictures\EnterRead.png => \??\c:\users\admin\pictures\EnterRead.png.189qz1d589 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File renamed C:\Users\Admin\Pictures\PublishPush.png => \??\c:\users\admin\pictures\PublishPush.png.189qz1d589 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File renamed C:\Users\Admin\Pictures\ReceiveConvert.png => \??\c:\users\admin\pictures\ReceiveConvert.png.189qz1d589 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\users\admin\pictures\ClearMeasure.tiff 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exedescription ioc process File opened (read-only) \??\V: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\D: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\B: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\E: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\K: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\O: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\T: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\I: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\L: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\P: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\U: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\W: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\Z: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\J: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\N: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\R: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\X: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\Y: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\Q: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\S: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\A: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\F: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\G: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\H: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened (read-only) \??\M: 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt powershell.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gl0a.bmp" 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe -
Drops file in Program Files directory 21 IoCs
Processes:
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exedescription ioc process File opened for modification \??\c:\program files\UsePush.mpeg 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File created \??\c:\program files\189qz1d589-readme.txt 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\LimitBackup.WTV 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\OpenDisconnect.bmp 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\SyncDisable.rmi 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\InvokeLimit.vsd 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\ResizeConnect.iso 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\RestartConvertFrom.mp2v 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\TraceCopy.wmf 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\WatchBackup.bmp 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\BackupShow.jpe 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\DismountWait.clr 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\FormatStep.3g2 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\MergeCompress.TS 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\UnregisterGroup.xml 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\UseGrant.wma 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\WaitGrant.aifc 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File created \??\c:\program files (x86)\189qz1d589-readme.txt 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\ConvertToRevoke.m1v 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\PushDeny.i64 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe File opened for modification \??\c:\program files\ResizeOptimize.3gpp 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exepowershell.exepid process 4804 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe 4804 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe 2088 powershell.exe 2088 powershell.exe 2088 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 2088 powershell.exe Token: SeBackupPrivilege 1160 vssvc.exe Token: SeRestorePrivilege 1160 vssvc.exe Token: SeAuditPrivilege 1160 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exedescription pid process target process PID 4804 wrote to memory of 2088 4804 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe powershell.exe PID 4804 wrote to memory of 2088 4804 5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\5d9b68455031f1c5b78d6fc0af037cb7ea72b465fd32fdce368420b8b816e3e1.bin.sample.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3196
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2088-114-0x0000000000000000-mapping.dmp
-
memory/2088-120-0x000001CC93DD0000-0x000001CC93DD1000-memory.dmpFilesize
4KB
-
memory/2088-125-0x000001CCAE5B0000-0x000001CCAE5B1000-memory.dmpFilesize
4KB
-
memory/2088-126-0x000001CC93DC0000-0x000001CC93DC2000-memory.dmpFilesize
8KB
-
memory/2088-127-0x000001CC93DC3000-0x000001CC93DC5000-memory.dmpFilesize
8KB
-
memory/2088-137-0x000001CC93DC6000-0x000001CC93DC8000-memory.dmpFilesize
8KB