Overview

overview

10

Static

static

10

44cd22cb40...93.exe

windows7_x64

1

44cd22cb40...93.exe

windows10_x64

10

Analysis

  • max time kernel
    30s
  • max time network
    38s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    17-06-2021 04:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93.exe

  • Size

    122KB

  • MD5

    84645b3639932f0ca17d8e13c17dff87

  • SHA1

    4435d46fa99b53cc986f16e41dd68823a77161ab

  • SHA256

    44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93

  • SHA512

    5e4039974929fefaa43dc5d2e396bbaf1f4d88c8cfaa477b7705295cd310676f46d5ed17f1a6451e2040b93513654ab6303fcce2cceca1f7b4ee4340e2ce5eb3

Score
10/10
sodinokibievasionransomware

Malware Config

Extracted

Path

C:\v344qf-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension v344qf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/87D75C1EFBD143A5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/87D75C1EFBD143A5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: s+ota16xP1FSnzoLEjf5QJHG1khAdD0BQ9drakap0WV6Kc6aRrNsylAkF1HKiw3J BbW7+6NeisGR4gAW/YREpHpj7go49Gmvs3sk3mBj0nEHMWYZT3uDyFpawT7sxO5Q cFaUnOZjZzVBWDagDvdvInZfah5vJotNIlHW9KYAUSXaZTqFUkw06Sus+mBlDIWX Lgj6XsQbfTQLckN2YHkw6WwdlZfWlG24IF0FXonGjYBJHzGEI6qcAaR9I15bEznq 3OydzxLY1wb6EIslzIUM46w9fvSJGZCGKfMBiddRdQYTIgBF4hwib/5REryZ8zkN RUJCRkCZNnpnVyMi2du7Lb93XqI3tHmfxWb+8PxaqsTRbz4yvmdXBHMumFyiFdXO 2yxdaaZtT5mOsi6M0HDA9G1FoZaj5C6n9eW/KvxZqMn881NTL3C5ai7x9n1op5rd Nso7ltisiYl9XP/kVQN6zipAZdBCGMd8j084GH4lCcOz+64+DSC+zrDcOj+ofI9+ syevrRXTJBCSfORjb+ZPyWIsTQChVxnrgl5LZ7pVJdngee+aH0nZ7oobkpdkZZKV zhQVmx0q9g+eQx8EB/2JOM9emON+hCmNFdV8g9W8spnYs+4RAVAU80Wvh5C0jhzU Yfl61dpZwbGszY5zX561aTQvt0Ry226r+90mfKYMdsuKJAItJTjGd32S3bkBLAor Ahcr6wO1332vsEtGGiNleDCEWFIK7YHh9AiOqcP8naW/iCl11L/G7f8mvMsiZKaD fd3nhx1ddOYKG32o3st8Dlt9MRImVhOu9euNYPL3KYRcYcwgd9v3cxD2+NgF7YLH VREXIqiwaKHUszrEZ6UwmqZ8V9PH9PQpyNYfMFVvkVV/TaidHoXz7g1mi1LLxeqF uTihZCW9ZXsO3ZLTneZH7oG4hNFQvKnYMH5xwfGHShg5DIUc7Fa3H+X9p6RrIc1+ sKDiSfnljPL7AWDlwZctD5VH1UFypaLA3sEoNiO0JQD2j+vHT9Yn8EJxtjBwoYte iEuqSRCjoEOYKUrEjBW2+cCKnuk31KrnBUjCAhUyqErAIwjofMVUF3s/vozscEn1 +iyRN3LU8HBqJkUbbmHOlH4V3R9Tf4Ir2c6tlUdZ51DaGC+zn4V8yCjK3EoFKPNn gSh7/tZQK2zjXcgikafyhilVmCGdQXF/RjGmdXXZBGVAOL958biBLI4DnI+LOndA QZA1WxVy6zen84eW1x0aUi2Skz3eTZWMIf4Oh0FhFjVPOAA//XBqSFlOA00wCRDZ 8pix6177 ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/87D75C1EFBD143A5

http://decoder.re/87D75C1EFBD143A5

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93.exe
    "C:\Users\Admin\AppData\Local\Temp\44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:992
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:188
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:3872
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:688

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/188-114-0x0000000000000000-mapping.dmp
        Download