Overview

overview

10

Static

static

10

66060484cc...eb.exe

windows7_x64

10

Resubmissions

06-07-2021 11:37

210706-77ldcs8prn 10

05-07-2021 14:03

210705-kgqynjz7f6 10

05-07-2021 12:34

210705-5cj5sav6qx 10

Analysis

  • max time kernel
    270s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    06-07-2021 11:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    66060484cccedb839fb646d4e6020e079319374b2847c52dcec55c5ad60b1beb.exe

  • Size

    120KB

  • MD5

    ee11b17a14f1b7a6b197e9f38eb5cf7c

  • SHA1

    7fd96ccbccac8731cc8157100740e850facebcc6

  • SHA256

    66060484cccedb839fb646d4e6020e079319374b2847c52dcec55c5ad60b1beb

  • SHA512

    2ae1a8adcd52cc10235d0ae1fcf018d04b6675b951c06c67d61720815c437c9c6b40663da1fab9e8c5390b92798b4dfc65821b27a86121bd4dbdf05230fdc227

Score
10/10
sodinokibipersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\hd3lyl-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension hd3lyl. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/549065814122E616 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/549065814122E616 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gs7he+5c7mmyIEpvp5CR6Lo5H8ip22OM+qTAEU9G8yEeCg501p0nyK1jNTRGY7sv GH6gek+gWs5dyIMjyyfL7Egui7PrcWkSTNrZ3EFOBr0OxF313Ev9oeRmmFueu+QA MEI3wwImsTDFT02iAQoMX/mClgjyqoV+sFLoZkgPioUuM+zRoj0FJhcZgPq8CzlG eAlRZ4/1XGmp2qOTj95O1SB/tFGJG7ycv0+F/ZiJQxKO4ZpaewPZfmvwpK4zW/n4 I50TBHfO3PZhch62/PKwmiwWdyY8v6uSW8mbJ1vgQRD077uUgRrVU0s3ALzd5OKz kUWOqckZ1eKDdrpY0DdipLOh9zoko+LuF/2cj/m2pAbE6iIxcztHUDWieNGDtFZH +0unglmaEsqUA9DdX4pu+9A65oUJ+H2WGHb9pRZHeHPLaB/ekbWHeYtK3MQJwYao KQUjnrlhr86t6u0KpjFdxdIOIrqvcQX7ClYvrY1S1h4f82iiSWWhEJB9qkh11Lo/ j9iUSpCGXPsYoeUzWClk+IaAe5Z5r6BwRWQsFMP8bLiDbYw4r+4ZMGsxzYFHT5Vm E90cCbopD8AX8st1VlpH46+8byomRTBjuu3uqpfE/cypXBylOEWtTgWUxsxI06+L otgjETypFmy4qTjoUwZxu2aKw2rXbyL3hV6TjVoUd/7S6V6edctalLnd5+hxYuI1 SsRru4HeQopiVSH9FU5NTfzoV58SAW7szHcCxc0IwLIfidnXy9w74caBnmRioL3o jn0kWU+mHVPGa+an5qg7ZcMBlWIlQ1WQBB9YG4STMmjwKvrbNh8dkN208/kFLUKZ 7SB6nF7OIQvPJyL03fo4P8BsRnrvQ8H2kypoHRox/A/cGrdvPxwf1i9iiMSFJG9p 87nY1QeGEjYCp1IhDqHy6npBldbq7SQZ5cCeIcJcsrpSkLKT4EX4zmwQQNUknFRW /4q24hYAjJlbQEh9IdRkdJXP3JVHg7e9Py/2Yrab2hEz6Rik9lC1N1liFveIIlwi +ZSDnIGFTV28QM7lquTJqpdOMWHiB5arL3CBXk65cS8D/Gf4+U3J8E7l/m1nIJJr PB57AjkSAKGHehAArDSeiKyL6D8gQnCB93CR11frMO8XfCHEwG47FNUU035+RIOp gi3zLzS2TP22uT7l+9Aojo8N0mz3Kudb0NARgCLJ5XDjWDlgSeqP3yRo1uSCPi1P txCcA7z6Wa/I6pFkL7X43IZPRCAVMJjQpq7XrFEtHHuPgdn5yztH4ob6CDpEX+He dmnkN6lGZXyndDGipWzLGdAHiEbC+g== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/549065814122E616

http://decoder.re/549065814122E616

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66060484cccedb839fb646d4e6020e079319374b2847c52dcec55c5ad60b1beb.exe
    "C:\Users\Admin\AppData\Local\Temp\66060484cccedb839fb646d4e6020e079319374b2847c52dcec55c5ad60b1beb.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1100
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1472
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:516
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2028

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1100-60-0x0000000075A31000-0x0000000075A33000-memory.dmp
      Filesize

      8KB

      Download