Analysis
-
max time kernel
147s -
max time network
18s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
03-05-2021 18:04
Static task
static1
Behavioral task
behavioral1
Sample
c647b2da_by_Libranalysis.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
c647b2da_by_Libranalysis.exe
Resource
win10v20210410
General
-
Target
c647b2da_by_Libranalysis.exe
-
Size
116KB
-
MD5
c647b2da83ef8e1a790d1e0e25898780
-
SHA1
02871c02e581ad345f1c438b6c8c730cf2d2f534
-
SHA256
6c5ddbe058da35b2731fe10234520a6bb78604f860ed4188a1bd07e62fe4ec11
-
SHA512
f169ebc4ffbb3d0cf8f526e0cde89706b4521086ccb0f7653cd881b595aae2727891e8ea3eb6bace263d704b0ef9a0151094c03b7c1800cb5d4e54eaaf3453e7
Malware Config
Extracted
C:\0r4kmx5-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BC7769C5A04589B4
http://decoder.re/BC7769C5A04589B4
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c647b2da_by_Libranalysis.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run c647b2da_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\i1neMACrFU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c647b2da_by_Libranalysis.exe" c647b2da_by_Libranalysis.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c647b2da_by_Libranalysis.exedescription ioc process File opened (read-only) \??\A: c647b2da_by_Libranalysis.exe File opened (read-only) \??\I: c647b2da_by_Libranalysis.exe File opened (read-only) \??\J: c647b2da_by_Libranalysis.exe File opened (read-only) \??\N: c647b2da_by_Libranalysis.exe File opened (read-only) \??\Y: c647b2da_by_Libranalysis.exe File opened (read-only) \??\E: c647b2da_by_Libranalysis.exe File opened (read-only) \??\F: c647b2da_by_Libranalysis.exe File opened (read-only) \??\H: c647b2da_by_Libranalysis.exe File opened (read-only) \??\L: c647b2da_by_Libranalysis.exe File opened (read-only) \??\M: c647b2da_by_Libranalysis.exe File opened (read-only) \??\Q: c647b2da_by_Libranalysis.exe File opened (read-only) \??\R: c647b2da_by_Libranalysis.exe File opened (read-only) \??\S: c647b2da_by_Libranalysis.exe File opened (read-only) \??\T: c647b2da_by_Libranalysis.exe File opened (read-only) \??\U: c647b2da_by_Libranalysis.exe File opened (read-only) \??\X: c647b2da_by_Libranalysis.exe File opened (read-only) \??\Z: c647b2da_by_Libranalysis.exe File opened (read-only) \??\B: c647b2da_by_Libranalysis.exe File opened (read-only) \??\G: c647b2da_by_Libranalysis.exe File opened (read-only) \??\K: c647b2da_by_Libranalysis.exe File opened (read-only) \??\O: c647b2da_by_Libranalysis.exe File opened (read-only) \??\P: c647b2da_by_Libranalysis.exe File opened (read-only) \??\V: c647b2da_by_Libranalysis.exe File opened (read-only) \??\W: c647b2da_by_Libranalysis.exe -
Drops file in Program Files directory 2 IoCs
Processes:
c647b2da_by_Libranalysis.exedescription ioc process File created \??\c:\program files\0r4kmx5-readme.txt c647b2da_by_Libranalysis.exe File created \??\c:\program files (x86)\0r4kmx5-readme.txt c647b2da_by_Libranalysis.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c647b2da_by_Libranalysis.exepid process 280 c647b2da_by_Libranalysis.exe 280 c647b2da_by_Libranalysis.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c647b2da_by_Libranalysis.exedescription pid process Token: SeDebugPrivilege 280 c647b2da_by_Libranalysis.exe Token: SeTakeOwnershipPrivilege 280 c647b2da_by_Libranalysis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c647b2da_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\c647b2da_by_Libranalysis.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/280-60-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB