Analysis
-
max time kernel
136s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
17-06-2021 05:02
Static task
static1
Behavioral task
behavioral1
Sample
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe
Resource
win10v20210408
General
-
Target
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe
-
Size
122KB
-
MD5
32fff05663093102154e887f71854b4e
-
SHA1
8d31d42e61aa0adb5aaff19427a214fd1b65e4e3
-
SHA256
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0
-
SHA512
b5e34c78159396f43042ad19b5c8217220b475e062749e5c5123b166e14ab4af80cea7f856453ded226ea02a507e081a501f51196424f93e86d586ba26f70285
Malware Config
Extracted
C:\se6lon30-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/965DE17EC7662274
http://decoder.re/965DE17EC7662274
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exedescription ioc process File renamed C:\Users\Admin\Pictures\ImportSync.png => \??\c:\users\admin\pictures\ImportSync.png.se6lon30 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\users\admin\pictures\InitializeFormat.tiff de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File renamed C:\Users\Admin\Pictures\InitializeFormat.tiff => \??\c:\users\admin\pictures\InitializeFormat.tiff.se6lon30 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File renamed C:\Users\Admin\Pictures\RestoreMove.png => \??\c:\users\admin\pictures\RestoreMove.png.se6lon30 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\t32mMaunsR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe" de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exedescription ioc process File opened (read-only) \??\H: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\L: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\N: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\Y: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\A: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\K: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\Q: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\S: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\U: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\Z: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\E: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\F: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\G: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\I: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\P: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\V: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\D: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\X: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\B: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\J: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\M: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\O: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\R: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\T: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened (read-only) \??\W: de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f32v6jd.bmp" de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe -
Drops file in Program Files directory 27 IoCs
Processes:
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exedescription ioc process File opened for modification \??\c:\program files\AddSwitch.mpeg2 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\EnterReset.m4v de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\UpdateComplete.mhtml de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File created \??\c:\program files\tmp de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File created \??\c:\program files (x86)\tmp de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File created \??\c:\program files (x86)\se6lon30-readme.txt de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\CheckpointUnregister.ini de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\ExitPing.odt de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\OpenSave.mpv2 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\UnlockPush.dwfx de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\MountConnect.mid de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\CompleteSet.svgz de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\InstallOptimize.jpg de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\RestartAssert.svgz de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File created \??\c:\program files\se6lon30-readme.txt de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\DisableSync.sql de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\OutRename.mpp de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\ReadOut.wps de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\ReceiveClose.tif de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\OptimizeUnlock.m4a de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\StopInvoke.wmx de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\UnprotectConvertTo.mpp de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\WaitUpdate.mhtml de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\FindWait.pptx de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\InvokeSuspend.jtx de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\ResetUninstall.mhtml de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe File opened for modification \??\c:\program files\ConvertFromImport.rtf de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb965c000000010000000400000000080000180000000100000010000000ea6089055218053dd01e37e1d806eedf20000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exepid process 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exevssvc.exedescription pid process Token: SeDebugPrivilege 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe Token: SeTakeOwnershipPrivilege 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe Token: SeBackupPrivilege 1364 vssvc.exe Token: SeRestorePrivilege 1364 vssvc.exe Token: SeAuditPrivilege 1364 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exedescription pid process target process PID 3492 wrote to memory of 2800 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe netsh.exe PID 3492 wrote to memory of 2800 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe netsh.exe PID 3492 wrote to memory of 2800 3492 de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe"C:\Users\Admin\AppData\Local\Temp\de20c90de7becbb2f8b92ac42d71a3db3db498472746d0d6f53c368dadba44b0.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes2⤵PID:2800
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1956
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2800-114-0x0000000000000000-mapping.dmp