Overview

overview

10

Static

static

10

2df2fab33c...8c.exe

windows7_x64

1

2df2fab33c...8c.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15-06-2021 10:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe

  • Size

    120KB

  • MD5

    56b9c44b62a03b837df7ad35e8ef3dd4

  • SHA1

    75a8ee1cba41ff1e0bc042d54657b3b76b7275ea

  • SHA256

    2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c

  • SHA512

    5f34d8615ba06c704ea83ab201b6b3f7a7fc42b20caec40426918ed987507a53be0656447b34ed2fa33bb607ddfa74f533c4d8d6f5c844812c741d63ab7202a6

Score
10/10
sodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

C:\0182h-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0182h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5656A6FD318C5E14 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/5656A6FD318C5E14 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: pcGpn2Scs75vfkgCFnVqipk6Lb+qJii/f3kn3xayxBoXgT36BqCOe9KD6onAqaMA LdASjusOShYIGObck6mwh45s9ER8YoTM6V7epDwwmZrTLEV7celRS/t+GsLs8VvQ Yvqj7CeT12V4VHAm1E6dH8f0UWA4hAI6RiFPvebLN/31BF4dDZa2ecdQKuUfmzEI 3wRu88b58nUKPyG0/ch+RlMNmQjaXnXT0P/Ega/BcgAezS9vrGnqKuDEpdGTczYo xgN9aSQoyzLm3eE5Cic+xO4ve9iqfPWkqrRWXG+Efl46aXRe2SgGF6mqA5Ibr2Jc dwxQXDzgZx1Di5nNFmW8gpMBJ9edYEFdcrm4DOqbehbHCdgScyXkt9shWlbhoBaX UVe/RoKOVwRaJlVjeiIMQf3jf3lTUkUOwEW7Lek185+/0O2azJcPHROVO7OzbU+j 8Kypmd9f5sdEczl1d2UO9TgBR+HTSUJrz7O/uZ8MvhF7Bs07ChgfmUk9geDg/KvP 7JZiM+IKiPW2LGbU9wx1ix88MONuSSGESagjq6aChAv+OONwacM7iml4ExyPsL1n LEcvUWzxDEDkFKjzFkb2M8EtMPwcpObAsw/boV8PstTz3JzKM0djPFcCVQvHeylX hexlk7yN7YlodU7GXEyJd++RLfRNp56vNa0aPLD0ACNX7O+o1nvHV9l0Hr4TAOe8 QDxrgaiUPdisrBvowO9pnE5IB0kL5I6hitG9Up5kcU4zIjOzpcOsEaVQpf4SgBos ntTTK59yteV44wJyZmfJPwQ0uW6rjEcfhRY+mPaboq7MwSDKc3ZbVMgvVJNoVxs5 TBAPn/06ntSGTxG5ufsT/pWbeRNkLlZOQ4MokhOFDVUmZOo+BkqtOK50HRnRMpdn SdWWdl8+IyhzlK2G2LRIpJxdFQZTHCh2u22yHZORbdCBP1b7T+pHV1JNnO3sKcpW CZvnTHEf352uJ9wFGGfmBmyPa+AldISL7583ipShF22QMuthjv6gL1K8aRwGO/sC FvJLePFnAPqvuafuIaPJE790VXK9sEJotRemkRxr878Fu7Qeau9bo+4n3AvomWdl AOVFfcULoGAmcYj1Bitgzm14CCheNLxsX2x1YJGsilvgBBqhcDKz18IU1SDHirVQ MKjQS40G46BFE+vv8MDbBNhzXyq264sfWpcBJHRjw1l54ZTZvz+ezCKM7H1APlTy /Aeyq5lJH/v3xI5ZJdXU5HmGCaXQBp1lAgB8+g++hDe2oah/ZqRleqyRAwSbWEYH jMxavA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5656A6FD318C5E14

http://decoder.re/5656A6FD318C5E14

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe
    "C:\Users\Admin\AppData\Local\Temp\2df2fab33c1db5b049284a6bd5aa1f58bec4cb370b0663870b6a57ef33b5028c.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1968
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2688
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3824

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads