Overview

overview

10

Static

static

10

dc92f1c232...9c.exe

windows7_x64

10

dc92f1c232...9c.exe

windows10_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 00:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe

  • Size

    116KB

  • MD5

    6cd56946aa6245d1eac3a88d4470a40c

  • SHA1

    b4635b3f442e3541a92f026fbb108abeb5d67df7

  • SHA256

    dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c

  • SHA512

    4dffd58030258616b5123246d88abc4f2444aa0cc2809cb3cdcc81e01beaaa1ea784c5e7b969c1982ecd938041e658300c24a67049fe868f4b172a55311dbd8c

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\nn12moq-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion nn12moq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/64F0CB5998F404C2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/64F0CB5998F404C2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ke1tGeA82NgZ8TehFO/0puUZxqBvtKIe8oRGKypDIoDBp/al3dmT+1NW5siQjwi7 KBm1MUnFPh8vRXND43MKwu3+YbpuQLydUDIQumhqpisz0KTlGJrM9A8FKIkCFvoZ S0KAb0dLTxNQvsAnygWithWj/9CRsHGlRRbMy2S6TED02ZFog4yjRxI6dIhEcbhD peI3PqYpW1hVKOC0fLApx2+ADAz30cvL/ViztMREE/zjMwcTPs5HwSF8mVeEvBJI FdSrhS0Sbh6WGcc4b45BUDp7LTdF/aYFYn2y6Y8QwXah44fWl35mlTru7elcgsn1 prHu0WhJhkB1b9aLxE5SPnxbg6JveLFCt7FlQQTXfNkbJ8rbnIkyBJWc9oolqRfN rJVKK2kPeA6WUO6zDW1V2EmEeREyQExajaWZKInUP8adTDMJOk0BofbnAHz/VSQC Jr37liiSXNxjvf+zf5cQc4WBZABa3L4UoJw9T1QmPE8aM58JNNG/hAY2pe27hphe ecnV2ceXTkXAELuxIUfzCJHP5NlxfAqW+nHab9hL3CP66PKBQiOP8zpilckjWWU/ BxtNDdNescvxJe88Gl8qPMAL8MeqOFBJ5irLYf9iZQdeIG82dz4IlFNLKZrVz4JT LSLqNgIZF8+DPUr8cSJORNCyDAKqcOo1Mye0eeUCltAmMeuLzJ9KRdFSN1QG1UTM a1BZBD1PjPKvTGc5ZZ+JM3UUEtJi+qajg/jpQwpD07xQD404ikJ1GbsGnUQcJh0O a+JOueQLRG8DfWLixwYlLpBnr/NKczfLduQEjzczB2+68wxZ1kAovgWt2zoEdVbb 5MASMzMujRmC9Z2hAv6S34MSbg8zvxQDLIDFTpBYWxujNXhrwhv0tQM/PaDPsV1l pnjOHMYQ+O5UAAVqJuoJIldlxEo6hlGsmQUQYm6AIeBKK63gGwfhszWdTdy89nll kfFSn66V2as7M/PjIENpbz2dngJRODSt8cCB7LSuixohNCf1sOf6a0aCgMCStB+a dVzQdDC+KLj/aO8u9rILwbiBh10YS/MD7EguywpxLeiBBvNhXHmtyra1K3NY4u4P KCJ7vccn9Ixf+y9pSJ9B+m36F0yXpffPVek+eHnnonYv5s97AjJV1FCBgxpcFee9 NttxFRtlsL/8i/++XhGfUCEG4Ib+9lh+GPqqEYdRzkwSc45yoiSWVK3SSDg/zCRq +f5CuPU2rWlhdZmfilLmEWlyEoOVb9DlDwuGua9KnOMKthz/RxoqlbZogWpy7icD CyrZQOYcNSurAwjlpUsT5Uasj9iLODxM Extension name: nn12moq ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/64F0CB5998F404C2

http://decryptor.cc/64F0CB5998F404C2

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 28 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe
    "C:\Users\Admin\AppData\Local\Temp\dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:792
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1060
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1932

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/792-54-0x0000000075D11000-0x0000000075D13000-memory.dmp
      Filesize

      8KB

      Download