Overview

overview

10

Static

static

37b8da186e...c6.exe

windows7_x64

10

37b8da186e...c6.exe

windows10_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    04/05/2021, 14:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6.exe
  • Size 308KB
  • Sample210504-ctzsd7vp82
  • SHA256 37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6
  • MD5 SHA1 SHA512
Score
10/10
sodinokibi$2a$10$t3dhtruanqkuwj0zthetbo76elgnsuz6qhedd9elbwxl1fjinkeuq3612persistenceransomware

Malware Config

Extracted

Path

  • C:\456ubtz-README.txt

Ransom Note
  • Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "456ubtz". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/110E8423B6333937 If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/110E8423B6333937 After going to the site, enter the following code: ctins1YRR1rpAzyFxjb0tHWlw8U/EsCI3iQ0eHT1NKyvRhjUZ5UnEq0IyRPimn79 /z0/G5jL5wta/UnvHjwFjqcEqJZH9AJm7ROOc3SoCAfRC8bfboBroLzaYP7ulFDe ErOdf6EPN7aqpQmnWOmuebb6RjiYW5FqrSJQuqUOeHO00hM+rYeRFp51g9QWwqNN LtM35Usd2yZd3NULnA0p9w3iqzE4PvW7dmav5FE+TZcX456oF5TIhYYhCVeBawkA 5od8Afalogx6WD5ENehffKE568gRhWJyUoemoE+FBnyO6MxlFBy8EhSQTPfRH3K1 TUeb9hwQ8nRmrBB/PivaHdQywyHiP8endH4KJE82jGHhD0TepDaP+fMOryrJZjgU pM28i0WeHaI/veuS1IU41tDXIlhgniwKLooYOPX1Nq36gHmVqsGWd0LC68tvtI2O G+HDsfItqLKXeL671sZIp3/p9zAqo7054D0o8+q67P6YfLr+ylRtKhrbgIeaQptQ CjWs/FCprg+cM0rH2wEnYNPNyT0kfJ2GEJMnNxampICKex3Hph+o+Iv3zcP0OwkW gssoonj4bZWtYyuqx5jbGd3/39+DP4D7rgtqYDN47FE6oteUykI4W3J+tfXI46lq jBmbT/frj9V6FauQQ/z4LVHH8fwacIg2b8+dnYzwcAcA3WQd06RiwMoiYMTXBXL2 v+eS2DdemXv27bfQ/lz66AxPhwNJHEsm8xT9gjzM1fCfacXkYUSptAFR/Kyi+/Af p5SDPuwKTQC/bKZ9o11XqWTudMCD/bNLxKjgG+73I1Vy6PxynzXO1/2YsZFAA4wf tUbkHrY9kTGmxX3/x1DNzkInQCgx/dhGKBenOTqFFjXcq5pHLnF0er9nctwZFPQM 7qR0jtds8SAH8XztBWiHWlpaZzoTAj7fZUst2jLBkI+5XH9g662iwWfyjDRKEXFA lVoFhAdL6Y3jQwX4EV9lbU/jABt2oIovdLzLV8CGXvEFt2QnZMpVqzf/lo4+6SxT cWIonVltOt3BoxDhmekIMMhKv5YzJLLZOrVMCIXV0gYLa9tm5y6RKmbExAV3K+Jy IJCGK/Jw2B5/Dn3dsyUEwTTjS3qgQMyNXFr/LHVF+pFaReoISAhiq8S0CsC01Gx2 c0nd3eqJTn/QWkTKe4QsEn+z79lGhBsBspl1LZ2J7lojesrXvNWN9YzGiz6aOO30 uM1IykjmUU/ymC2KxqS8FLNuy4uHykQuVVdZ/OvEnT7q8BewqOGiFEmtFRLJRwVD opVjiJk1HF3rm2ADRr7Ujogs
URLs

  • http://decryptor.cc/110E8423B6333937

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/110E8423B6333937

Extracted

Family

  • sodinokibi

Botnet

  • $2a$10$t3DhTruaNQkuwj0ZThetBO76elGNsuZ6qHEDd9eLbWXl1fJiNkEUq

Campaign

  • 3612

C2

  • all-turtles.com

  • smogathon.com

  • mediaacademy-iraq.org

  • nhadatcanho247.com

  • milsing.hr

  • cursoporcelanatoliquido.online

  • broseller.com

  • ftlc.es

  • compliancesolutionsstrategies.com

  • ampisolabergeggi.it

  • cheminpsy.fr

  • planchaavapor.net

  • vibethink.net

  • rosavalamedahr.com

  • lionware.de

  • liliesandbeauties.org

  • smart-light.co.uk

  • gadgetedges.com

  • psa-sec.de

  • ledmes.ru

Attributes
  • net

    true

  • pid

    $2a$10$t3DhTruaNQkuwj0ZThetBO76elGNsuZ6qHEDd9eLbWXl1fJiNkEUq

  • prc

    infopath

    sql

    mydesktopqos

    excel

    powerpnt

    xfssvccon

    msaccess

    encsvc

    wordpad

    firefox

    ocssd

    dbsnmp

    steam

    ocautoupds

    synctime

    dbeng50

    winword

    agntsvc

    oracle

    tbirdconfig

    thebat

    mspub

    ocomm

    sqbcoreservice

    outlook

    mydesktopservice

    onenote

    visio

    isqlplussvc

    thunderbird

  • ransom_oneliner

    ...ALL YOUR FILES ARE BLOCKED AND CAN BE LOST SOON... Urgently find: {EXT}-README.txt in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!

  • ransom_template

    Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "{EXT}". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}

  • sub

    3612

  • svc

    sql

    sophos

    mepocs

    memtas

    backup

    vss

    veeam

    svc$

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 31 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6.exe
    "C:\Users\Admin\AppData\Local\Temp\37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4008
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:396
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3496

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/2204-114-0x0000000000A20000-0x0000000000A4B000-memory.dmp
          Download

          memory/2204-115-0x0000000000400000-0x00000000008C1000-memory.dmp
          Download

          memory/4008-121-0x0000021B6CE90000-0x0000021B6CE91000-memory.dmp
          Download

          memory/4008-123-0x0000021B6CF50000-0x0000021B6CF52000-memory.dmp
          Download

          memory/4008-125-0x0000021B6CF53000-0x0000021B6CF55000-memory.dmp
          Download

          memory/4008-126-0x0000021B6D060000-0x0000021B6D061000-memory.dmp
          Download

          memory/4008-136-0x0000021B6CF56000-0x0000021B6CF58000-memory.dmp
          Download