Overview

overview

10

Static

static

10

44cd22cb40...93.exe

windows7_x64

10

44cd22cb40...93.exe

windows10_x64

10

Analysis

  • max time kernel
    144s
  • max time network
    38s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    17-06-2021 04:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93.exe

  • Size

    122KB

  • MD5

    84645b3639932f0ca17d8e13c17dff87

  • SHA1

    4435d46fa99b53cc986f16e41dd68823a77161ab

  • SHA256

    44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93

  • SHA512

    5e4039974929fefaa43dc5d2e396bbaf1f4d88c8cfaa477b7705295cd310676f46d5ed17f1a6451e2040b93513654ab6303fcce2cceca1f7b4ee4340e2ce5eb3

Score
10/10
sodinokibievasionransomware

Malware Config

Extracted

Path

C:\j97i62j6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension j97i62j6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3DF9470FB8F43741 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/3DF9470FB8F43741 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zbFHwocJV7ULznt2wddKK3d3WNQ6+YEjOExoAc6PvNwl2Zkh9hT2RGglIIZEduU7 lHknZ5YTVwejAMPAyisu5Ln8SrZSguQLj3mIoSO7DbSbvxY9uvaih9v06qZMV02v bxNqt+Rr+iZ57+Srb3PXQfs1Ncd/7GTMYa0+XQDd7HmULqJLzAdvc9OiJ86+p8U8 3+Atsn9Wh1ZUElYrZAfdQfMXUbtimM/zV8jo5TETbKAIbmyAvIA82W54y3y/9uCy cON6cXbLfCXQD5iUixl2Ztqxg7eGxV/sv7iie5CtzlykS+iLlyvYzxGcmUexDiQr sAzAFUMwgGUWlmKj0LtdbiWn25Yy7BDrLxI5iy1Kr7EZk5QB1OniUCzjUqXtmCZa IiG6WmbXNVd1vz34m+4/RMeWhBDxIOcQzpMOEH7jqW7QQVoQcDotCP6PKPJhNhza zVEk3h+X/2i29q3XO4euokz7kwbJ0b34etbESET95+l+qS6GiVvtbwPxjHOvHTOp 5j1NS7RczSHiBB1ehWy0byjaLH38cObS0bDUlTFYVKAn9dtm+FzQdcfesAogDcoM mXsB38Zw8e3NdGONIiJ9t+O8lX0qeCqn217s/4k3eX4eyxtO2uFP9eS8Yx6aMBeb Jv69iQIjKN5NbNRYJO9zK4nEANRJM4zgAIz81b9p/ozGq0Cl/3D3sCGwEG32mZ6x oG2CEfjrrUwYIkjusUtcC3WewKX0dzd3L3SGUZnHbqo7C6lr6yNAp8vI/4d+c/g8 9mnk64x9/R3RG79pHxXNkisqO/ukA+FsNAW3NFyFlPApdqrdxvF5GCr9iY4E/ZsA D2PBSlpUwxOm1Mp2zk7H+s+nNHagFagimIRQ5w/cAOofF8208AN5PzznXD/8aqll uitiuZbDjU2nTK2+kdbKjRVpUgDVO4KAHEb13p242CaE8NmTRvkzT4LBtSKbC0yW zHLoYguYPBP9yTeHWY19D7Pq9VoBzvKM+TMK1kKMPyM42Cg8vHfP7DUwvxUkJ1Qv EyQ0FCXGkhDx0mYdwvhNghAKUgftFS3MGIiK6+CFTuXtfR1HzTNomHBQ5nBNC1EX DAZPanTudFXbqKomexd/F/m2D1Xn0QgitTkvf5nphV+Ex2H6vo6kahqVDoTZhnE4 c8MGX9HtxUjhQFN21ALLWMwqn4DQpeyMk2KeASTlTCWakVnGLze5J3VtSrSfB+zP BtdLFemFJJ/vr+MI2a94u4+xiE41xWmhmCeL7INKjdEU5aUidF7/kBfjIk4wp411 4JW2tuso3WTpRjhMppjHOg8EsZj08m5EWt8= ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3DF9470FB8F43741

http://decoder.re/3DF9470FB8F43741

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93.exe
    "C:\Users\Admin\AppData\Local\Temp\44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:1692
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:1160
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:348

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/628-59-0x00000000757C1000-0x00000000757C3000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1692-60-0x0000000000000000-mapping.dmp
        Download