Overview

overview

10

Static

static

10

df724c49a1...07.exe

windows7_x64

10

df724c49a1...07.exe

windows10_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 00:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07.exe

  • Size

    164KB

  • MD5

    13d4c1451da6fa284c08c669a7d0e7c1

  • SHA1

    2ea65287c7489d8ab5abd04e172c55d1518a4052

  • SHA256

    df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07

  • SHA512

    f845335dd84b5bf9b20889dfd051bf012dfcf96adaf4f6de171b3a8e62f42cf03c0e18314ad6ca59ff3eb5e1c0ef3dce179845aac6582b9438c0b13809f47554

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\ygkpvai-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion ygkpvai. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. If you have any questions, or experiencing troubles with the test decryption, you can use our chat on the website, our stuff support will help you as quick as possible. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/26DB6161C15B4CBE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/26DB6161C15B4CBE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vuQejG0f51Vz+1QGBOz/qn4K1lj/Qg6itHkx+bsAyBFdqcfYJUwJf8tH0Khmh7gF 5uyhxPo1YsK0VpJCaZFO8zyb+nSQhDlRgLP6J1OeifTcT7f6aKxa6RL12puIqd5v kmhqQ5WFCy+7Bi3/FRtcRAyWsa7x5UOOk+HNQZhGLHmaZhpKYK+z8G4vejRdftXH DaOpC4iNYyz7Fhcttxs4e/Qud6BtUJzmo8U2LkjfzVn1fqobKHsHhUSVnFyj/SkM TtL/U1KYG4igqOo1QV/hsuJIKWafO9ICowHFZTLce2Y1U8mHRDicYRy+VKVjECRA mqDE/ffIIDTFnfrT37YM7j1n3Wgf9c7QQOAo+Zbwkr9tQHleJoIOan18zxWryQIG xeBAx7CIzhTdbEUBR02Fz32YYXVxGutBcty7SO+ZslEsKKBpFt6CygOr8zP/NGX4 2HDGrlV2B53ncgYNoF6YIsIk1ytvL2jJcFsiopzm/mzI4egMUNW9iB8Za9iDw4a8 NQuGg5btbeAEDN5fWsyh5e4I+lQdivRwAujlFJ8h3h5njHC4GZWl/o3deum64ET4 ZY6YwhuD/1gKzKkA3WQGYv0c5O6dEE0Ch7eJK/IX+K+p+Fa/4fhV7a47sa2iUNcy Nfx0XYkcYhgamzTTtXTk1UbCWiaOZVbZaX3qZGkNEADdwxBoKPB6g2Dk3DeKboxs Y0+vaP62EFjyDNBa8qXmh0Ja5ohpHvdFUvWQat4Ax8HxbhMLWcJf7Ukd+sHm+/MU C9ev9VKASgYeQY97yGdYJyQk7LqIjdvT7ozb9b4UbTC9uXthG6uo140uhY572Iux AVy3x2oWBoxLF2EpgUKocsEIYdhrUy9mnlNf/+5h99INZVNA5yO9Qv31ilT7GdeA hpwrJ62DHH4vIOJXb2sgAYeRmcCOOvS6Unfz6gzjJVGUFW6J2VmcI80+xHOoabEJ MnmLJx85gXUxu3gV05YGLqn7t0yqCs/rGdv+kpfVLsQe83JbPlHmt9IbWm1OY4Bb J3tghOHfJgU96F5zkZNMB53B037U0AJlFMCIXILtLYDGQTKK1No0Q21/aJFmgLVF UXTH16W1g2MlgGcUlj2qSq++jcSfL58CBzQhljv3+yYXdvif0Fhosb0gAMg= Extension name: ygkpvai ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/26DB6161C15B4CBE

http://decryptor.top/26DB6161C15B4CBE

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07.exe
    "C:\Users\Admin\AppData\Local\Temp\df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3004
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3356
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:864

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3004-120-0x0000026639B60000-0x0000026639B82000-memory.dmp
      Filesize

      136KB

      Download
    • memory/3004-124-0x000002663A6A0000-0x000002663A716000-memory.dmp
      Filesize

      472KB

      Download
    • memory/3004-132-0x00000266219F0000-0x0000026639BE0000-memory.dmp
      Filesize

      385.9MB

      Download
    • memory/3004-133-0x00000266219F0000-0x0000026639BE0000-memory.dmp
      Filesize

      385.9MB

      Download