Overview

overview

10

Static

static

10

85f0d23c08...dc.exe

windows7_x64

10

85f0d23c08...dc.exe

windows10_x64

10

Analysis

  • max time kernel
    171s
  • max time network
    204s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 01:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    85f0d23c08ab9a6ce1cb28c6b0f943127e6425d1fc7baa9404fc87e1324f1cdc.exe

  • Size

    165KB

  • MD5

    4dacc5edb44b305ab1f77a33b3e16362

  • SHA1

    dd413b4f2e6c4cb8dae4c41d95ef5ae92c1eba50

  • SHA256

    85f0d23c08ab9a6ce1cb28c6b0f943127e6425d1fc7baa9404fc87e1324f1cdc

  • SHA512

    e4140ad7c232f01045de0ebef18d8048d73ef7afe5147f1c744d2b90c1717ac70259afc494a9f708abf7cb89721d784aca19cba7e1f39bcd09834ea80a0e46da

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\us3a1w3uv7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension us3a1w3uv7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5B7594A48B1C47AD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5B7594A48B1C47AD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LVL+XPeGwBFFuOD1G3Eo9loQmFAxFoG7UBkusr+4YLDHo+obBIQSdEttFAXXYwUf UjrSAInRSnF2SuOqAlr5EG9eLwR+NNhDoIsL7bmtID1Ftpa5AtZKh132ZVPi7qGe ZaGjqvrx8kLl0u32fqZXJywQXZrvziCCzCpWCS0v7NBHfhgIml8i3hvJp9Q8z0Jg DwpxJORsBPvPQhs9etZq5PID8JCTrh8XBaXcWrTfUW7wmTMKGbo8Ic6xIngPzBcx g8o2b1Ye6Wyz2+iyeBs5TZgfpA6pC0PXtc6FpRe11jVEtdk5TBIIfyh5kx8Eh0e6 1idEDWA1q8Bnjhz6xNLO8NPGyrSlRboUcwSgRLGVkoJ3Rl3BJMG7qo3U41oaCh+5 Pbm26VoEV7QFImZTMxJ1Pe88Si9K1ugNYqCMjMLeH+TEYndo9Pmt9bj53pjwcONe 3Jm/SdXR4CKKreVCi/ruHvzXpsLsbz+uMKBaAsPW7A0e31N3NEMMXPVYWmYYtGri 8mN6nUqZVMufDCH9xA5NFPGsiAIfoSukva6o7Er5d0yISk0quROJSUEorlumqrQd y9jDXa3XFvjbtGiZhr3dSro0GJ4KqH9/L7Nk3b0J35bN5ONyZlrvvkv/A83LYxWL sejvnXJtVO8kBN3lFDSMu6RxYbIhx6J+A9efpUnvcERIdn7gnT4H0mBzT+xUOPkK 51ZSpN88HgPFK7vP3jj8366rLFtJKFuiMuLXhFfponP3dmkw3Ypab72eRtgtnbVg Db5p34ogindr2DWn4ezrxNeJHA9v7ozSwSLgAXL5vPaQ8MWGRT8s4hZ3fVSjvwbI cF9HDM9MYRbmsWw1GuUny5Fx+jIuP4PNRxcg0BTWgR2uyxPTGsWxe/d2/nv3ENvk WkFFwCFYEeH0H2XyvM5niM//heSLd2tiP1zXahHXgdp/WeCAKMjuL4+07YMI73Wp UNLgAKA6My9ElbU0S3u9uCvfQLm3MFsmtVmH5ClSfpeNTPXqYs4SuZMePVXo8xQn euduJlFLEBLwuFbEGHe58VXaN+XqDQny/db181INpJVnzRM7TyyBoa5+I3E1dYYI kLOYL0usimpFftFKGvtDpPVJQp38LeFrxcIfK5ewmCQtZIVUfhzP/gJDV8Low9mZ LriCOw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5B7594A48B1C47AD

http://decryptor.cc/5B7594A48B1C47AD

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85f0d23c08ab9a6ce1cb28c6b0f943127e6425d1fc7baa9404fc87e1324f1cdc.exe
    "C:\Users\Admin\AppData\Local\Temp\85f0d23c08ab9a6ce1cb28c6b0f943127e6425d1fc7baa9404fc87e1324f1cdc.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1560
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1988
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:428

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1560-123-0x00000260BED10000-0x00000260BED32000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1560-127-0x00000260BEEC0000-0x00000260BEF36000-memory.dmp
      Filesize

      472KB

      Download
    • memory/1560-135-0x00000260A4B70000-0x00000260BCD10000-memory.dmp
      Filesize

      385.6MB

      Download
    • memory/1560-136-0x00000260A4B70000-0x00000260BCD10000-memory.dmp
      Filesize

      385.6MB

      Download