Overview

overview

10

Static

static

10

755a0472f6...83.exe

windows7_x64

10

755a0472f6...83.exe

windows10_x64

10

Analysis

  • max time kernel
    167s
  • max time network
    177s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 01:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783.exe

  • Size

    155KB

  • MD5

    5aeb6c929b8f95fafd895c181ca47c1e

  • SHA1

    6b3edfc8dbfb1c7726b38e62a01e209b670e6f6f

  • SHA256

    755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783

  • SHA512

    655d18424864e0a997be068b12b8d655a2e3c76218ef2dcd54b0d4191273cb6e5be09fbc076be2dff19f068fb24ed703b6a3695e0edc0ee99fe53e9fb33588fa

Score
10/10
neshtasodinokibi$2a$10$xbydz5ujztckimolq1qy5.egdrsymjkmdaouedygug3pvckgiwwde4117persistenceransomwarespyware

Malware Config

Extracted

Path

C:\48qi2i4q0f-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 48qi2i4q0f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DA2C16CB244F2C72 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DA2C16CB244F2C72 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7JFjxXz349+x4PFU2xbq4fy2gQpgtHgC4Vrp4UPGfcLJ0gc74CKGATEWdG+a6VBo cEgAYDGFQpGX4XyAYO3oINCerbaSbTDMrdE0AXHRAk1vGmcJ0k5EmzwMsdP4dJTS dAhx9Sfv6Ss3A/5lAlXTvtCcfS4sfLeLcxuwFLJ7qLRX7qAk8y03UNKDHNW2NwXd 8f8fe/R9rBMlm/9TAcHVFUpeDIHa38IA2ch+cyVoDL8GwYJZ3zpDqKCY6KiNXHNa MMFetV/6WjDlUo1rDQ8K7wLIADqstkifzoM/UADW5iEcEBT+wwer9ooZyQFpK6L3 pquQhgYGWVyGpbZ7FwZAg6fZJPm5g7MUcNGr1t09dt0l1FFfxpP5ZDb6qSSvg0Xz 3XW51KTVskmMk7m7exD3gSi4uI0X7i/hdpEy2PuqGWdxeOigyyzku3XM/CvylQ2t PT3D0RRFDa8ZsFq9JU6hFk1yMuq7cJtiIvWg0KMIlA7Hu0EpOlD0yndB7p7NBiEv y86QwnK+ftAfJ+RiLoqLJMjlxENtB2R/vHg+fz0dIVP6cuKEJZFbpjE9ee7fPgAx INpTPI0v4MNXlEDUDHt/4RiyCk3ByOXwmY2FdhD3pwjJOTST/zcr/cGuMazf1XlN 0A9ixJfhrL1ICTDklNPOqLjw+Lb4ES7DEgLXu7ReLJ3Ej6rsb/OTZMXo1UielECq sqx86pAihQXsumvt0chvf+IoUeRgoO8h06gXRnNLJWCQm7a9jicT/5+P9FPjKZXx EAhwgnI0kIFd0+PZmKt8tvPvj+2sA1CzxDRye+uu3MqAUx5MKYKjJnzjzxHQqO1w qCVlg3KJaC/ZsJEs30kxz2tnqnPr8vGQduRea337tim04OHKMi4HRs9jzijdTm1o bwsPAWb3O73MRKJDnvKUZAbF/xUPI+VHnei2ry7dO0CdFzx7zf6gUza7wRmZMh9n DGbip4GJAPjI8HwwNz1eo8yHoW4Mow2+7R33jtzzxiKzlk4G5KTm7lonOPBCU/Xy oi5ARbW/e8B8y6wt64Na8bUhK0HIRpWzl3SLV3z7+qZi7jBqERiHDZfO+O7knorw uiUt7prGbMEVYNwtm5fe/d9sMNmICgDLC90mO9tDfALHDjYxwS8pO0gfxR73aGgm YylxO99mClU+T3jHXWII0g9vnnSLk86CsUYqkOHr8DaKwVnkWuilEL6+l0Ep8BnX xi7qXbxf5DjKC2YYxKqLH72S2F85z1vXI+IWTvV1amWUBe0oxYr+ZIKiLLvvALEd zG34CFtz4QCzVB4RqednBtvD9w7gKXYH ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DA2C16CB244F2C72

http://decryptor.cc/DA2C16CB244F2C72

Extracted

Family

sodinokibi

Botnet

$2a$10$XBYdz5uJZTckimoLq1qY5.eGDrSYmjkMdaoUedYguG3PvckgIWWde

Campaign

4117

C2

miraclediet.fun

austinlchurch.com

i-trust.dk

cheminpsy.fr

aselbermachen.com

servicegsm.net

todocaracoles.com

travelffeine.com

katketytaanet.fi

lloydconstruction.com

uranus.nl

rhinosfootballacademy.com

notmissingout.com

cerebralforce.net

higadograsoweb.com

ncid.bc.ca

edv-live.de

pierrehale.com

grupocarvalhoerodrigues.com.br

yamalevents.com
Attributes
  • net

    true

  • pid

    $2a$10$XBYdz5uJZTckimoLq1qY5.eGDrSYmjkMdaoUedYguG3PvckgIWWde

  • prc

    msaccess

    dbeng50

    tbirdconfig

    infopath

    synctime

    encsvc

    thebat

    sqbcoreservice

    oracle

    onenote

    wordpad

    mspub

    thunderbird

    steam

    mydesktopqos

    ocomm

    dbsnmp

    excel

    sql

    winword

    xfssvccon

    firefox

    mydesktopservice

    ocssd

    ocautoupds

    outlook

    agntsvc

    isqlplussvc

    visio

    powerpnt

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4117

  • svc

    mepocs

    memtas

    sql

    vss

    backup

    sophos

    svc$

    veeam

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783.exe
    "C:\Users\Admin\AppData\Local\Temp\755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Users\Admin\AppData\Local\Temp\3582-490\755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Adds Run key to start application
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4472
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4272
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1448

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Change Default File Association

    1
    T1042

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    3
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3582-490\755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783.exe
      MD5

      908d52413f165f7d4a256b9627b5460c

      SHA1

      3cf4f5aae4b6099be5c34f3b5125835edc2eef1c

      SHA256

      448ca440a1930e89b04ad4a44cfab6f58165b778a22150efdcfb9aaad0d8d1a6

      SHA512

      f9411ac23ebd05fc863b2293b3470b2d394a1f758c6eac0867f68aa84e10d3b34b88dc99674cf009e8899cbb680ad328b86202c9fc52a6e5f543e36235dabdbc

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\3582-490\755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783.exe
      MD5

      908d52413f165f7d4a256b9627b5460c

      SHA1

      3cf4f5aae4b6099be5c34f3b5125835edc2eef1c

      SHA256

      448ca440a1930e89b04ad4a44cfab6f58165b778a22150efdcfb9aaad0d8d1a6

      SHA512

      f9411ac23ebd05fc863b2293b3470b2d394a1f758c6eac0867f68aa84e10d3b34b88dc99674cf009e8899cbb680ad328b86202c9fc52a6e5f543e36235dabdbc

      Download Submit
    • memory/4472-125-0x0000019272F20000-0x0000019272FD4000-memory.dmp
      Filesize

      720KB

      Download
    • memory/4472-126-0x0000019272F20000-0x0000019272FD4000-memory.dmp
      Filesize

      720KB

      Download
    • memory/4472-127-0x0000019276F10000-0x0000019276F32000-memory.dmp
      Filesize

      136KB

      Download
    • memory/4472-132-0x00000192770C0000-0x0000019277136000-memory.dmp
      Filesize

      472KB

      Download