Overview

overview

10

Static

static

10

42438a6763...35.exe

windows7_x64

1

42438a6763...35.exe

windows10_x64

10

Analysis

  • max time kernel
    28s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15-06-2021 10:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135.exe

  • Size

    120KB

  • MD5

    0c7c5fcfb2368c716ce7eb0eda3f3533

  • SHA1

    96854d0cb673bd8575acc0c864052ce6b03ec9d2

  • SHA256

    42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135

  • SHA512

    a5bf231ba0ab43d0fb9c87b8f2d936381f3baf68a9cb5b4eb8567cec835f468a3200a0834e2fcd57bbcf30f31899f54c680d0a4c292506d78c0518c63a31e89f

Score
10/10
sodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

C:\5w580-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5w580. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D50146B595DBE2A4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/D50146B595DBE2A4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: HjXA4tWqvIma5RZnT02M2D0UZ3XigK0CWtXC8x5ehI6EgEj9hk9VTE29HULLEzua LHg8N8+ifiHLzM5sw1yoJu+H4AV0rYwuZOyG9SuikvzqN4oCW5UEZWw8ngstTPjy /1UASgF/H3/Ep2OgHDooN8JpVg+LrmIum3J1gGc1VKJ1TEnYkInr20GB3KeSwSfs eqT/NXqPALTMCW3dG5OJNxWQQE+lII5xsYyx4gaAVdgn2pnqdRponna2ITKzASUi rEj+Z8st9Myf7k02MfxhuJeF3FYQ+unGFcwmEr2JmnUgLrbkxzOQjw41T4VyTMUo Xx0Ua7/PTrDezPGoNNlpRuJCxj02Wha3ZdX7WWU1vRnGcLWCH6mCey3z3uemZySB tLWmHW37dy+/sD4Z7plt3MJ2lIzSx6O0Yk/p9eyXITHkPRu1F9njlUDHk/2MSf+5 HXYyhGc/v8RUGrivomaV0nWY7tJrmFp7yk3+9/b8h23YH0T1Ia0L35Zq8iIzlv96 00GhdEUGOP8vSzrlZeuu6A/AztdLMj2um5hJmKj5ZGc/+4MhvMIpiIjeZfZVNbkP YA57jV5X4R1SCz9uiWTtbH9Ip9be2hJN2aDosN5dg4DgTNfk6BzCN5g5l5thnidy nubAuHu22MlN4V/G9u7024igf1q2bVeykuCRzWUsqdt5TVLjOhXY/xKea7WUxK5G 6ZLJK/YGVh2OBqMMBifqm8ZxyvanNDwhn/iDDrX+Y8LdTJCHVLDKIyOo7vEHIhzv frzc9MKFgc0OsspRZ665kX2zow55xd3LJdhqLQIHizkh7L7d2sKIiKIqHDqyXf5j 2K+q592AyB6xG8Ct4nZP9yn3LP5Dd59RzAJc1klUq9qsjLgz8mwUykROoxZk/o+1 zsgLVD3qQX3Ga1lRYVP+kMmdvCQvwxpuD7NXcABP6iwW/am7IXUIggKWxIFgNCLB iKU471KAIgueqs7fITG/Gv/x/5Gp9s44xmH7tJgUiZU5IxbyaswoD8OmRDdKDSyj Hw27BIPmU7b7FByogcaChN7whMSBC6S7+UKUq9pL+6H1H/lcGS1/BHK1jZ+DCeyl 6bpOQQoevVyHTOxrSONjscyZoxHZjOXZqC146Tx4D23bCj9gFh/VA4f+ifliKu6f NJn2WXuUqC9S19X33dETwDpUKvELSJOaoJyjMvOmIpIga+3T2u9j6yZcIAL0oHx0 6tcumxF1Jw6acynY3WAZFdIc7ariO9ERZkE6kU8Nf2yDx2COYC5UCFlGDMlWwt0b NIYIGQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D50146B595DBE2A4

http://decoder.re/D50146B595DBE2A4

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135.exe
    "C:\Users\Admin\AppData\Local\Temp\42438a67636a6981b4e3209449040f6b393f10fe0636dfca2260fc0f4271e135.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3912
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3336
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3976

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads