Overview

overview

10

Static

static

10

44cd22cb40...93.exe

windows7_x64

10

44cd22cb40...93.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    17-06-2021 04:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93.exe

  • Size

    122KB

  • MD5

    84645b3639932f0ca17d8e13c17dff87

  • SHA1

    4435d46fa99b53cc986f16e41dd68823a77161ab

  • SHA256

    44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93

  • SHA512

    5e4039974929fefaa43dc5d2e396bbaf1f4d88c8cfaa477b7705295cd310676f46d5ed17f1a6451e2040b93513654ab6303fcce2cceca1f7b4ee4340e2ce5eb3

Score
10/10
sodinokibievasionransomwarespywarestealer

Malware Config

Extracted

Path

C:\92y6uyse-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 92y6uyse. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/64F9D9A943E5E574 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/64F9D9A943E5E574 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: TTFXCIng95fRGknLh0GSyDHfTVQtQ2b09P9SRdfuApZ/26QgwTuvCJ188jCh4JrC our6ptLzxczkY77Ziul73jf3PHbOcuGrZF2rMIPR259kW3WKv9OceJUC6zlLwBYI AYyiW8Md8uQojFDeloChi8Y0tuw/O1VkNfUikhE55hrKVyYcR2bwLCWiz+wyvNQ3 /TigwlDyDh3hbAnKguVecQ8ylYdQZTTtKnbLTWZZvPpT9xRGLaeagZ2KWX4AbMe7 aaxxNyv8L0WBQ9igpqLEgQ1rulp/u286rWGCXus4hgKQUnI4jJlADMKE5bZVIHjD gL7BQeU6IEThxqkSpUlIwFHBBGiGOQ0z3LwEJ9sFcyOqOftfIjciqASH/ycfNMJ1 u1JKSDjFBB+nl7y3LceSd8y2z9NpUC1VLZzpD7+hydKJZ0ovYxMacrNE8rxMOl1z HkC2LojeUW7mLwuNWBiHDMCe3/58aILRpE+y3lYytwkSEJRMLfdfU5mx9ijnv9+C oMBE7X19HLHHFO49b8EvUvA2veKdxuFeFnLwpdTnPJusT1lfxCD1ft9655RojTxH RgA4h38znQy5UgMYkBgUW8E27PD9bIBXoTfKLrOecB0BF2t3TzPMKcU9pskH6Fcu nYe2tAZQsJXT25uXkvJXtXrTImgecEvF/QdDJaGjkTRjga3jgNDZTL2tHwW5S2lj BBPV1BkaHOO3o/akk9gS2P9qXGFzYc8RR+hq54KJM/i6bwovQlEwACFrMnVHRpEb DfDiRYvpg2mnsUpPdRQpQwWRYbyJCW9aQUiiNoWsn1qD+Re/gMTadJW4+LIAL/1B q56mT5qpK0oQOMDVAqIxrjOOCUToI7R8EiqyP4MmHh399p2Zq9sgd3M5rosu+mEG 14P8GUxF6kpHo8LKa1x5TP1pgYJNWAmt/O7mtKV99F4WruoYboV+Z4bLzlWB9xz5 1ryc17wjDV8b9QXILgVyqeiQKmuiOk8tspf7L+F6wb07nwjWbRH8UGPkPhV9MJT7 YhBRZIHymqIaJC86Yzs+Z0PFuKoQh+Xiwi3Uu0iPk4ZyKgxOETI9kYhMMZNF2TuY 4nMJPL2OTwajSLCW61uTJb1FhQo8n9YScFCmE2vFLD+ZBEYuDnWxbsr7ZsvsfYw7 HY/q4hD4QcJgJZIWbSt/OKTzJqwqm7elCJ4r6VV6T7JnLpzc4JkakAc4ir2VHzR9 oYLS9+l04gP5M7q6bdkWaYRrwS7/XiLcHeCVmcJVzouDzo7j+jsqdqzlXe5Lj0hf eaC8v4sssM8BeQ== ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/64F9D9A943E5E574

http://decoder.re/64F9D9A943E5E574

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93.exe
    "C:\Users\Admin\AppData\Local\Temp\44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      2⤵
        PID:2484
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:3604
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3280

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2484-114-0x0000000000000000-mapping.dmp
        Download