Overview

overview

10

Static

static

10

939f58c102...le.exe

windows10_x64

10

Analysis

  • max time kernel
    80s
  • max time network
    25s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    20-10-2021 12:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample.exe

  • Size

    120KB

  • MD5

    9a24b3de7af3b2a2f1917e72e64da268

  • SHA1

    783bebb04eda5a88851aa741133ae49c29f44415

  • SHA256

    939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d

  • SHA512

    631b8165326463749e8bb01e74304343158b4cd4c6c4e4a8e60922a298b90dab9c83c60fd69c4eda8ddf2dcf97c4040dc723f7e9beeb9a94aee568c30867044d

Score
10/10
sodinokibipersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\5f2tk2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5f2tk2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/96EC8990C36043C3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/96EC8990C36043C3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: g+Q5pGCUvbPegYHcn7yKFA5FIa2pwA7f4anoWcPP+T1LIVrG14J+wlminwkXD4RF 0W2JtsrxJV4XMu/qvEqoe5x0LofZVzkrhCsA5pCRg+VvNxerf9loKL/kbLNIDxKf cHm+3LiJ3uSgTyc+CUpNRswIC5Ml4ax6OVcxb+626nHRy6BANMlido9752mA9pkS o1s0hAw12RdBGfxq60nYcCvy8hhyNWePav4ixWeCH53EmvH92MkH2zKmlUMLj6fH 8m0CvpLQu+Wci6awzEZvw4oGgBtq/FJyulgiThZNYnlD0IUWjf7SmYyPMdO5/nzs Ym9isKKaQogW9dNRWq+T6HKbLszuwtR8mlbNf01q0w4ImA1K1yY1bH+1K7dKKkfw iL5VxYjnrMcQt6ZQl7ss/rPNZhNofy9wG2FTBp/tawNfYNAYzx6O9O3OTjps3Vab GzfE8IR6Os6hj9us9cvxbpf8qiBjkU0qHevSe9Z3TJtODOKpmDNoQ0Ac9pHHCveC lUafmI9Y2S4Hb/72sV7JVAPiJyhhtTL1btB/m+mW8lJj1gNBHJjIdGREMlxbedNl 7DgwyvP5lAlldrFgP+vsiZkdcnF3yNyzg5Ji4f0gwqMNnq45RJkiCO/RP5OeG21o q+5akj0ol6gsTaSAm67S4nQDsMIAC5DL1iabX3UOpdZiStVG3WY13CvlCuUGEuFH mU3xa32lASfut9aWJsFImEv3AHDCJLBsHgbrej0ZkjGIHmC/b+K6Jv/D3v3Ssx/i LOXVaQ0GMwq6tU16cqcPbdG3mCt+9qeiP9QLonMbtkSjnLaSEepe7QIE/DIfDsT6 KH44b5D7lq2n3PiMBJnAes/3y1DhiIGYI2VdgYDCJ3JuukexYCnk4rSA7R23l+53 gKsWpazv8j3S+5suHjWyy8z1apaUEwLmuTTm9U0nwWE1GgutrS100rBCHn4ZBQo7 9I0v+T27hvM3YSV4/eixIb3/5iUIoL+lkNqfuawlc8xNaDkdXWrSw/vmeA2uZsYQ 55tDRzuxrKIOZ02NFbNITUyGsXFsixzWaDnAiql7VF48sEPPksj+JLJG/ePRhBLi MeJ0TZN42RU+6JmyATH/xovlYSt1WI5SzVR2m/5xmhT7PYg6zQUsldQBIH8GQiBT Nbph+O1tdJqzv5LZe8aMc91BMevXc/7XTvbBrODrSa67EeRJyKvWnuoIFhBNNpx2 emYsU1DA15cVh5a3gB74Cpcety0MIkY2yZkz9WowUwJyPV0K0amd9kA6WYGVn+lA BDSqeGZp ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/96EC8990C36043C3

http://decoder.re/96EC8990C36043C3

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3464
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4076
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4404

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads