Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15-06-2021 20:10

General

  • Target

    arm_crypt.exe

  • Size

    333KB

  • MD5

    229da2b80073aed77526aaa0f9445334

  • SHA1

    af4b369fc2a8e89f5fb57f22e8b6bc492107fd79

  • SHA256

    98b4d614c3059e606dd802ef64f6cc86e1bf1efc4e3ee24c4543315757339d3c

  • SHA512

    78b68e413f44c830e0783f2154e4ff879bb5074eda53cc16218ebb15c2e19c35fd46b22bfd61823df9ce1f1cf8075b12974d435c30aa5348a97db92c5aac6636

Malware Config

Extracted

Path

C:\j94h91t-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension j94h91t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] We have uploaded your data, and if you ignore us, we will publish it in the media [+] [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7F5922D85C9A2FFA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/7F5922D85C9A2FFA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JNMhR+PLPP+lz8O703ib5SWb9x8Wa2lP+jm+qPYO+pBKhN20zBf6dLvZA3zOD9tJ o7/A5Oe14Zk2RBMZY5cWGy5dbeCcF4G4cOE288ltPUk2v3ThKUlwwAMVYJhKHSMv q2I5fmAD6ANCwrdIHOXCelL7o2aChHMr679K6DT+8flxxY0KIfSMOgUClC55BV1r rNWEomG1Yxz2bdpTx03yKMhB41WVGlSBd2pEzBTvESqNIw6SAFOi31LFhFlaLipl 58HB+GTVGgftGFGUZvIk4ZwTO+CVcbN81MaFNxYAD6mM0JmdWXEuLGG0OZEd2v3b Ml3mcucMQkP4tltGYw/pbQQV+QWMtFL+OGFQcQMd1anI8CLrdPonFrTUUn1apIA6 zsk8R4D2kUVseeGMsUbTax/z7Vtg5K5MX9iQRiF8MetlV01gycEiojaEPfpoJPSe Y5LwiFideM7d47N7UCU1cskCC7hGSds+HMFJoQ84WFg9UllCf9kaSzxLEHAh3Lcx zpBkpvVhEM9EbCmqbJruSqbeIXAOz7gBd3qRhcRsCRB4IRyZJzZOaEX/MLPaUfUD TG2a6h5P5ek5yi/Q3dbKe76FbFLO0jl22FMWZAiQte7yHpJf4SXuqh/fsvAWRHUs 7mPCHgDtXeV7PYdqXyfGiRTIGiSZeHt/VGkF1sptOOLnIGTWrd3dOOqP7a+O8qqs Y2jd7wmj7SjrMjNop4nfLIHdJlFBrv0na3nRjPk20X1NYFZ32mr5TKC4qbDZNHUs ZsJiZ9dyFZwxww5D3wXu4/OBAhy1k63HdqR98Os+CvltMxynPOKV6MAigPbzrJqE EqyCRvHyPmNcGWvK9vGpg4fwpmVkM7BttX6tETKjioWGKpJzXyK090TdIQREm0M5 WJVewrwQhBSS0kMbseNYVq+f069esL4gWLIVAUURrzPb6prQJ333rLz9AU4PIXiu SsLOW9s/Oxk1gwlGBzqtIH++wEF94PIKgoQxQtzaxFrqeaTqMNX+rhdHyWJ5uAEi 7h+Ry7w0xNZPDBUTP1oM+8A//a1VG23KYMJCWNeKiu0FJ/tyXqBSHAsVjspS4N4b W7jb2CetX0dO7LIhdA6rEomTo6HLBw3Uv9nBhTiznvOFrIIUN6zMrGTSvKLG6KTD /mJd84NPOi+jRjbwXUb0QDWYhLODdzmIVLasDGLkHtrdvo9XajMjl1JKnHBOSKnq xQ7JVuYTSFKQ5nL5IRkxtqOY9ww2cyPOP4A4RKfC5jhmmwxcVYiwwk7eTY2ha8iF lLlLj8Yrj84= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7F5922D85C9A2FFA

http://decoder.re/7F5922D85C9A2FFA

Extracted

Family

sodinokibi

Botnet

$2a$12$sr6NKOt2ZvX04hjSD0n/KOtg0WxsKt.tVJ6CFQibmYWNlVrpbBc9i

Campaign

8013

C2

porno-gringo.com

highimpactoutdoors.net

nijaplay.com

ravensnesthomegoods.com

alhashem.net

echtveilig.nl

karacaoglu.nl

theapifactory.com

zimmerei-deboer.de

craigvalentineacademy.com

exenberger.at

linnankellari.fi

zewatchers.com

koko-nora.dk

plv.media

modamilyon.com

galserwis.pl

rehabilitationcentersinhouston.net

danskretursystem.dk

iwelt.de

Attributes
  • net

    true

  • pid

    $2a$12$sr6NKOt2ZvX04hjSD0n/KOtg0WxsKt.tVJ6CFQibmYWNlVrpbBc9i

  • prc

    steam

    firefox

    thebat

    outlook

    dbsnmp

    ocssd

    mydesktopservice

    agntsvc

    encsvc

    visio

    ocautoupds

    sqbcoreservice

    ocomm

    excel

    mspub

    synctime

    isqlplussvc

    msaccess

    infopath

    oracle

    wordpad

    thunderbird

    dbeng50

    tbirdconfig

    powerpnt

    sql

    xfssvccon

    onenote

    mydesktopqos

    winword

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] We have uploaded your data, and if you ignore us, we will publish it in the media [+] [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    8013

  • svc

    svc$

    veeam

    memtas

    mepocs

    sophos

    backup

    sql

    vss

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Modifies Windows Firewall 1 TTPs
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\arm_crypt.exe
    "C:\Users\Admin\AppData\Local\Temp\arm_crypt.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:2880
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:3976
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2272

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2880-116-0x0000000000000000-mapping.dmp
      • memory/3772-114-0x0000000000F60000-0x0000000000F80000-memory.dmp
        Filesize

        128KB

      • memory/3772-115-0x0000000000400000-0x0000000000C1B000-memory.dmp
        Filesize

        8.1MB