Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
31-05-2021 10:40
Static task
static1
Behavioral task
behavioral1
Sample
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe
Resource
win10v20210410
General
-
Target
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe
-
Size
118KB
-
MD5
0640c1e8e44868f5cf1c0b457bf8f49a
-
SHA1
437c8290d6abb02d75681b9d3271150b6f569abb
-
SHA256
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63
-
SHA512
4dee2ede4ee5e5d3fa5faa8f829b3a010833647e5dd6b42a23d4921d2989112f201b4669c2ec33292f4d56313fbf6bea9fca7ab16f600f76fd714febbc9bbaeb
Malware Config
Extracted
C:\r9q96983o-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6DA3AD33D25DE53F
http://decoder.re/6DA3AD33D25DE53F
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\PublishUnpublish.raw => \??\c:\users\admin\pictures\PublishUnpublish.raw.r9q96983o 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File renamed C:\Users\Admin\Pictures\UsePing.crw => \??\c:\users\admin\pictures\UsePing.crw.r9q96983o 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File renamed C:\Users\Admin\Pictures\ConvertFromClear.raw => \??\c:\users\admin\pictures\ConvertFromClear.raw.r9q96983o 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File renamed C:\Users\Admin\Pictures\PingInstall.crw => \??\c:\users\admin\pictures\PingInstall.crw.r9q96983o 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exedescription ioc process File opened (read-only) \??\K: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\L: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\P: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\D: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\F: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\E: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\G: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\H: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\J: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\Q: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\S: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\U: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\A: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\X: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\Y: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\V: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\N: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\Z: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\I: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\M: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\O: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\R: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\T: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\W: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened (read-only) \??\B: 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\24rza.bmp" 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe -
Drops file in Program Files directory 36 IoCs
Processes:
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exedescription ioc process File opened for modification \??\c:\program files\UseInvoke.contact 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\MoveInvoke.mpeg2 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\SendWait.dxf 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\InvokeStart.vst 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\SearchFormat.contact 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\StepConfirm.vsd 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\SubmitWatch.iso 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\SwitchSet.vsdm 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\AddOut.xhtml 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\EnableLimit.ppsx 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\MountSelect.ps1xml 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\MoveStep.zip 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\TestUse.xml 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\CopyWait.ttf 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\InitializeExpand.htm 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\SyncMeasure.dwg 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\UndoSplit.htm 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\SaveDeny.bmp 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\SendResize.mov 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\WaitUnblock.vbs 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\CompressAssert.WTV 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\FindSuspend.mpeg 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\ResetUnregister.wax 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\EnterConvertFrom.mp3 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\LimitEdit.wpl 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\ResetReceive.gif 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\UseSwitch.mp4 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\ConfirmMount.mpe 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\MoveClear.docx 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\ExpandDeny.scf 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\MoveComplete.3gpp 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\ReadResume.mp3 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\ResetProtect.scf 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\WaitResize.pptx 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\ApproveRestore.dotx 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe File opened for modification \??\c:\program files\EnterUninstall.clr 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exepid process 2112 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe 2112 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe 2112 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe 2112 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exevssvc.exedescription pid process Token: SeDebugPrivilege 2112 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe Token: SeTakeOwnershipPrivilege 2112 818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe Token: SeBackupPrivilege 3488 vssvc.exe Token: SeRestorePrivilege 3488 vssvc.exe Token: SeAuditPrivilege 3488 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\818fdc2d8074b1910e40653067b7984043c25148ec2bccdbb98537ddaff8bb63.bin.sample.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3448
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3488