Analysis
-
max time kernel
130s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-05-2021 11:05
Static task
static1
Behavioral task
behavioral1
Sample
seu.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
seu.exe
Resource
win10v20210408
General
-
Target
seu.exe
-
Size
6.4MB
-
MD5
bd3c693ecd17dcd9e60b08ab963121de
-
SHA1
3480a1dbc4bcc1bb06a7fbdc82e892ec5ba3d6ab
-
SHA256
8bd2067d088dad4df24e11244f5b72ce1fd22b686e2ce9ba6ee8711f8f6a836d
-
SHA512
88a6cdd1435c85b288cc37bd6f15b82fe8619e00f439a0bf5f3411fd171a4c84a0e1e7c34261f7510dc2f92af3c14323b97e2efc47fc78e61b6db4d3865eed46
Malware Config
Extracted
C:\vh2w20-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8160601ADEEBEBE4
http://decoder.re/8160601ADEEBEBE4
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
Processes:
MsMpEng.exepid process 3212 MsMpEng.exe -
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
MsMpEng.exedescription ioc process File renamed C:\Users\Admin\Pictures\DebugMeasure.png => \??\c:\users\admin\pictures\DebugMeasure.png.vh2w20 MsMpEng.exe File renamed C:\Users\Admin\Pictures\ExpandComplete.png => \??\c:\users\admin\pictures\ExpandComplete.png.vh2w20 MsMpEng.exe File renamed C:\Users\Admin\Pictures\InitializeResolve.raw => \??\c:\users\admin\pictures\InitializeResolve.raw.vh2w20 MsMpEng.exe File renamed C:\Users\Admin\Pictures\OutLimit.tif => \??\c:\users\admin\pictures\OutLimit.tif.vh2w20 MsMpEng.exe File renamed C:\Users\Admin\Pictures\PopConvert.raw => \??\c:\users\admin\pictures\PopConvert.raw.vh2w20 MsMpEng.exe File renamed C:\Users\Admin\Pictures\ResumeWrite.crw => \??\c:\users\admin\pictures\ResumeWrite.crw.vh2w20 MsMpEng.exe File renamed C:\Users\Admin\Pictures\WriteSave.crw => \??\c:\users\admin\pictures\WriteSave.crw.vh2w20 MsMpEng.exe -
Processes:
resource yara_rule behavioral2/memory/656-121-0x0000000000260000-0x0000000000D20000-memory.dmp vmprotect -
Loads dropped DLL 1 IoCs
Processes:
MsMpEng.exepid process 3212 MsMpEng.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MsMpEng.exedescription ioc process File opened (read-only) \??\Y: MsMpEng.exe File opened (read-only) \??\D: MsMpEng.exe File opened (read-only) \??\O: MsMpEng.exe File opened (read-only) \??\Q: MsMpEng.exe File opened (read-only) \??\S: MsMpEng.exe File opened (read-only) \??\H: MsMpEng.exe File opened (read-only) \??\M: MsMpEng.exe File opened (read-only) \??\P: MsMpEng.exe File opened (read-only) \??\I: MsMpEng.exe File opened (read-only) \??\J: MsMpEng.exe File opened (read-only) \??\K: MsMpEng.exe File opened (read-only) \??\T: MsMpEng.exe File opened (read-only) \??\U: MsMpEng.exe File opened (read-only) \??\A: MsMpEng.exe File opened (read-only) \??\F: MsMpEng.exe File opened (read-only) \??\G: MsMpEng.exe File opened (read-only) \??\V: MsMpEng.exe File opened (read-only) \??\X: MsMpEng.exe File opened (read-only) \??\Z: MsMpEng.exe File opened (read-only) \??\N: MsMpEng.exe File opened (read-only) \??\R: MsMpEng.exe File opened (read-only) \??\W: MsMpEng.exe File opened (read-only) \??\B: MsMpEng.exe File opened (read-only) \??\E: MsMpEng.exe File opened (read-only) \??\L: MsMpEng.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
MsMpEng.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\933q48.bmp" MsMpEng.exe -
Drops file in Program Files directory 19 IoCs
Processes:
MsMpEng.exedescription ioc process File created \??\c:\program files\vh2w20-readme.txt MsMpEng.exe File created \??\c:\program files (x86)\vh2w20-readme.txt MsMpEng.exe File opened for modification \??\c:\program files\AssertWrite.bat MsMpEng.exe File opened for modification \??\c:\program files\ConnectUnpublish.sql MsMpEng.exe File opened for modification \??\c:\program files\OutMount.tiff MsMpEng.exe File opened for modification \??\c:\program files\ApproveOut.crw MsMpEng.exe File opened for modification \??\c:\program files\NewMerge.doc MsMpEng.exe File opened for modification \??\c:\program files\ShowAssert.pcx MsMpEng.exe File opened for modification \??\c:\program files\UnlockMeasure.AAC MsMpEng.exe File opened for modification \??\c:\program files\AddSubmit.dwfx MsMpEng.exe File opened for modification \??\c:\program files\CheckpointMerge.ttf MsMpEng.exe File opened for modification \??\c:\program files\EditGet.ttc MsMpEng.exe File opened for modification \??\c:\program files\ResolveUninstall.mpv2 MsMpEng.exe File opened for modification \??\c:\program files\RevokeResize.jfif MsMpEng.exe File opened for modification \??\c:\program files\StartUse.vst MsMpEng.exe File opened for modification \??\c:\program files\UpdateLimit.dib MsMpEng.exe File opened for modification \??\c:\program files\NewJoin.xltm MsMpEng.exe File opened for modification \??\c:\program files\RedoInstall.wmv MsMpEng.exe File opened for modification \??\c:\program files\StopAdd.pdf MsMpEng.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
seu.exeMsMpEng.exepid process 656 seu.exe 656 seu.exe 656 seu.exe 656 seu.exe 3212 MsMpEng.exe 3212 MsMpEng.exe 3212 MsMpEng.exe 3212 MsMpEng.exe 3212 MsMpEng.exe 3212 MsMpEng.exe 3212 MsMpEng.exe 3212 MsMpEng.exe 3212 MsMpEng.exe 3212 MsMpEng.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
MsMpEng.exevssvc.exedescription pid process Token: SeDebugPrivilege 3212 MsMpEng.exe Token: SeTakeOwnershipPrivilege 3212 MsMpEng.exe Token: SeBackupPrivilege 3688 vssvc.exe Token: SeRestorePrivilege 3688 vssvc.exe Token: SeAuditPrivilege 3688 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
seu.execmd.exedescription pid process target process PID 656 wrote to memory of 3044 656 seu.exe cmd.exe PID 656 wrote to memory of 3044 656 seu.exe cmd.exe PID 656 wrote to memory of 3044 656 seu.exe cmd.exe PID 3044 wrote to memory of 3212 3044 cmd.exe MsMpEng.exe PID 3044 wrote to memory of 3212 3044 cmd.exe MsMpEng.exe PID 3044 wrote to memory of 3212 3044 cmd.exe MsMpEng.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\seu.exe"C:\Users\Admin\AppData\Local\Temp\seu.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeC:\Users\Admin\AppData\Local\Temp\MsMpEng.exe3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Loads dropped DLL
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeMD5
8cc83221870dd07144e63df594c391d9
SHA13d409b39b8502fcd23335a878f2cbdaf6d721995
SHA25633bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
SHA512e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c
-
C:\Users\Admin\AppData\Local\Temp\MsMpEng.exeMD5
8cc83221870dd07144e63df594c391d9
SHA13d409b39b8502fcd23335a878f2cbdaf6d721995
SHA25633bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a
SHA512e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c
-
C:\Users\Admin\AppData\Local\Temp\mpsvc.dllMD5
040818b1b3c9b1bf8245f5bcb4eebbbc
SHA1c0f569fc22cb5dd8e02e44f85168b4b72a6669c3
SHA2560496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402
SHA512bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1
-
\Users\Admin\AppData\Local\Temp\MpsVc.dllMD5
040818b1b3c9b1bf8245f5bcb4eebbbc
SHA1c0f569fc22cb5dd8e02e44f85168b4b72a6669c3
SHA2560496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402
SHA512bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1
-
memory/656-117-0x0000000002E60000-0x0000000002E61000-memory.dmpFilesize
4KB
-
memory/656-119-0x0000000002E80000-0x0000000002E81000-memory.dmpFilesize
4KB
-
memory/656-120-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/656-121-0x0000000000260000-0x0000000000D20000-memory.dmpFilesize
10.8MB
-
memory/656-118-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/656-114-0x0000000000DF0000-0x0000000000DF1000-memory.dmpFilesize
4KB
-
memory/656-116-0x0000000002E50000-0x0000000002E51000-memory.dmpFilesize
4KB
-
memory/656-115-0x0000000002E30000-0x0000000002E31000-memory.dmpFilesize
4KB
-
memory/3044-122-0x0000000000000000-mapping.dmp
-
memory/3212-123-0x0000000000000000-mapping.dmp
-
memory/3212-129-0x0000000000D00000-0x0000000000D21000-memory.dmpFilesize
132KB