Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    04-05-2021 14:31

General

  • Target

    3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad.exe

  • Size

    722KB

  • MD5

    21e25d30d4258366c12f76cc1b534fd8

  • SHA1

    0c77e2d7c180a7923e7c1236e1f758cc9956e939

  • SHA256

    3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad

  • SHA512

    e5a71460c262b378993eca9d2c0be6af3aeb8a83e78a0bee64e3f90013820fb6ee809a270c34675e8abb79de45b228a8572d88a4a71c013e04e5607e2b48b53b

Malware Config

Extracted

Path

C:\p5651fo4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension p5651fo4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We downloaded more then 60GB sensitive data from you PDC file server, include your clients documentation. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D47985DD4C1063D2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D47985DD4C1063D2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: f5zXfq3PhtS0TidAHJKrE7y1Mkd7+tHWwVF2BGA7mGi5XJ/ywO4EhUoLsrkwkMbS RQOmpZDYElXCclZjE0J2kcheaVUmblPMDRh98zEcO87bIQ155Xr5bRheO6oWBrax INSfCFb+7tvHY3fc+Sjv/sBUPnwf4TAOBp7dOk69JcaA7fw6/VMmjedFEJoF+HgY xNss21SWAlNdYdulPfWBV9PvWrwGZBMkON8gDoihGJ7iDk8o9giIMfMAzPLyfNwV IY8N38rzSZgRi5EqfTthpbVbeGKRLE0Hzm35Ms8/26CubhYetTaO0mWNZIGVIkpF YJFjq86K7bCyAEM3ffizHpIp0NXVzhynHJouGNRL7CljLVw2HgmETjD995se6PuI prn8h0Ho6w5tdNE/Gm/MgyKG+w/yHuSjkgFsYZ3jqyIJB0MNW2wTi40U6ki5jmZl a1d4F7wIj2OsAZGbZpUo6hgQnTlBvxihT6HUqiEQjBrNn2PY2Fr8JwC3JgMdXSqA QdlpS4WQfyJxIwjmc1xmHfkw3bJnlhQLhEO7+JTpqqyxg1kjXFvHJjOKWeSrsclt K/FYgBqIt0nyBT/ZVwQrraaSpwK0JIi7og57Qg3yFB0S01KiP3Eb+K+RSFk3QXRH ak1GWNFt4P+sjcGgW34JgPydZBxl7GKclZAphK3/T6V7e4Iemk6Y/py5C/nhSSHD X2UTx62AK/7f5tbVp9Tc2kAVCaI/DWOeDhKkAFCmnEfevMElhCPaUEqxLbCeBNlY 4VKiqNcmq6GnhrILofBVrjwLaw5t4XoPEuiM1vChn/5CxeNpKGrX9vxFUfo89loa semHh1fpe3WoD9TA+tHiw/n9aMFcq/3K8cwIXGsQy8x95+S9DBEPbo7SK9VsN1HK uF0a3pwmBy6vZuUruLwztBKG74gCMafbrYia0DFxTNdXK1eE3Ce9Im4J4ZT0plbS eSU0JD3xa4ypVqGM0m3VeR2wVyyN9jk0MyayJYwzFiDa0P/L9zJ9kXk5UIJfh2w/ 3fbMQNhCHDR5vnjSxdYmU61205QzhD8gejzbGLoXaBdqzVzY9aV6YmTw80XyCI3V PgpEnp8/I2a6n9wbTaIx6tu2ZjewPgRgXv/lm+RfG21+A9rQW4WBtRKqL9upuf23 NjGlSOvLdXoPegrtvCKvccwZXNaaI6XSY2UmCSSHRIa0VZLskbPdlgDQpbGVUfDJ sSyZC7ILTikTvdSic+et5Oq9oaGevhTfhMqYG9c5AoruT6PAvY3gqDg8DcVfceEY JJe0dwjx/luCEVomUx1wN7aoLW8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D47985DD4C1063D2

http://decryptor.cc/D47985DD4C1063D2

Extracted

Family

sodinokibi

Botnet

$2a$10$sfGomAv/vdodU1RKLqi.CuDzf5dyENYjxjvACVad1Ng/Xv8SwQgti

Campaign

6420

C2

tulsawaterheaterinstallation.com

dnepr-beskid.com.ua

wien-mitte.co.at

irinaverwer.com

webcodingstudio.com

waynela.com

yousay.site

vyhino-zhulebino-24.ru

chavesdoareeiro.com

brigitte-erler.com

huissier-creteil.com

gasbarre.com

twohourswithlena.wordpress.com

streamerzradio1.site

lusak.at

centromarysalud.com

xn--logopdie-leverkusen-kwb.de

troegs.com

boosthybrid.com.au

employeesurveys.com

Attributes
  • net

    true

  • pid

    $2a$10$sfGomAv/vdodU1RKLqi.CuDzf5dyENYjxjvACVad1Ng/Xv8SwQgti

  • prc

    ocssd

    isqlplussvc

    tbirdconfig

    winword

    dbsnmp

    firefox

    mspub

    mydesktopqos

    onenote

    ocautoupds

    outlook

    ocomm

    powerpnt

    sql

    wordpad

    msaccess

    infopath

    oracle

    visio

    steam

    agntsvc

    xfssvccon

    encsvc

    sqbcoreservice

    synctime

    thebat

    mydesktopservice

    excel

    dbeng50

    thunderbird

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We downloaded more then 60GB sensitive data from you PDC file server, include your clients documentation. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    6420

  • svc

    backup

    memtas

    svc$

    veeam

    vss

    sql

    sophos

    mepocs

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad.exe
    "C:\Users\Admin\AppData\Local\Temp\3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Users\Admin\AppData\Local\Temp\3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad.exe
      "C:\Users\Admin\AppData\Local\Temp\3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad.exe"
      2⤵
      • Modifies extensions of user files
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1960
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2628
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3544

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    1
    T1005

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1960-114-0x0000000000400000-0x0000000000421000-memory.dmp
      Filesize

      132KB

    • memory/1960-115-0x00000000004043FD-mapping.dmp
    • memory/1960-116-0x0000000000400000-0x0000000000421000-memory.dmp
      Filesize

      132KB