Overview

overview

10

Static

static

10

da2a3c7f62...7a.exe

windows7_x64

10

da2a3c7f62...7a.exe

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 00:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe

  • Size

    183KB

  • MD5

    e7d37da33838e4f42a6f4c53529e547b

  • SHA1

    0ad890e173e3a785deead0ef9260f52477a39eb8

  • SHA256

    da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a

  • SHA512

    4b41dd537f15b885e00e015789af9923d5cad72ee19c98586da099e81cf0e93098ac0ddef8a1746ce0753dec0c8514a61f3fe7929495a2a254a4de3238684dd7

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\5zkr51gtk-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5zkr51gtk. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E2B336983095221B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E2B336983095221B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: /Euaw/typrnUrfLC2/DQKu24saq6yuztDRCeaypoz8UHjrisNIS6Jtn26rUPR1yU 2Rmt3sUjW6L0NmabFoxFiuTZ4opxRha3VGnQd18jExUQFKI8r1xJJ6h+bgmwZGgD mF/duCyxO1dAr8tYOcEqQPz31FbwUaQRkzSLzPa1aLLOW7TBw9fGdzqUj1RdGAcE fhLFWLv6x0xSW1An7oiGA/j7JUkmXGzFf3cwZp5WCfrLkPQgaG7VfBYSjgPUW3lJ oqLGr5oPfcm7sQapQupx/tnBsvm553TnrcLHT/d18syelswmg3SsLux7KbPrhVpF s0mRJUeT+pbA/iqknttnh52rpR7R+e4GJoOUqttOY5Q8oGESL7B8VZNKeqoNRfBp LziSaxPdFmvk3puC9k4yFk3I3BEjAmgnCWZAUkoeoza24fRorBFzTZKHL8IUbwKj sgYMtlfakEQ0D9gSw2CNXf0YIZra68+92oJ9qc15VPJygluYSadKS6pX+Yq3xpf6 VtPzzDD5jUO40/A+kUoNMiMVWRkWHqiqutnCtfIMXphz8rgIF3bK67/sn4UcMAwF MYmZ0uMz4XXZy3C57orDNJx5IRcnSv8m6Pxs1WavAJqDibLGWNyt+5BfQ6XjCq8F w4EWqJGa4+d07TwPET93PuynFY7Ed98Kzg5E5e6MIrX8ZH/b222y/dYy8S24sA5R kIi7bpXL3Vw+AlCm9CRNiX7vpA+wZ86AtCfC3EMKwWoRdF3Tpj77RP7qQbASKSP4 WQ9wtnSpl3qADI298mtJIENhnYNfz00vEvKEjT2QqcTvo6PaSe8zH5HCucOw37dZ pcCSHx7W7/3fHt7lgDYijsNIfM7aTaOg4o9eKzP+vpwdPsR5yMAt6j9rIhIlmsrz shPyzddoB5PiwGIzH8PnEdHY2jG+PHqFeG6Cqjg4oNrRloBn11V+i/Sk6cr5MSvS EraOPYyQC6wExuTlHZ7iVEZr8Izz0tvBf1+rU2o7qebnFqop/Es808y1Mv3ROKnw asm229JAMHf0O7R93EkM8YATD5qb8zv8E+k02QXuGvLWNq+o6i8/ByEUZEKbOtgA vwW5c29GgAaO1vMKfz4shdVat5GRmuB2srNg1iGyi2qLe+eHoztRn+ply6cA4MWk +p8Y7+gOqbbegMXlTodOlqoq2m244B0lqm1xa4Xfjm6JQZR3BG6hRd7nCYk8k3Vi 4jgtfWD7LV4T0dAHmsF5/3wyYoG2EKZQRtFKAHv5ja2qhP0fZQtAP/pWCURm43ml ugdieCKY/QCq4/+yKARDr6yq+53uXA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E2B336983095221B

http://decryptor.cc/E2B336983095221B

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
    "C:\Users\Admin\AppData\Local\Temp\da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1004
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1280
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:944

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1004-119-0x000002101B350000-0x000002101B372000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1004-123-0x000002101BE40000-0x000002101BEB6000-memory.dmp
      Filesize

      472KB

      Download
    • memory/1004-131-0x000002101B213000-0x000002101B215000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1004-130-0x000002101B210000-0x000002101B212000-memory.dmp
      Filesize

      8KB

      Download