Overview

overview

10

Static

static

10

d7123e6371...4e.exe

windows7_x64

10

d7123e6371...4e.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 00:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d7123e63719339ead8b5912d8ee6d8197034984c6068ebaafb6e920496fbe54e.exe

  • Size

    117KB

  • MD5

    b9cf7a744228749115e6f0b958b5bafa

  • SHA1

    1056fdb6eeca8ca2eb136af40b81d8f99b28c79e

  • SHA256

    d7123e63719339ead8b5912d8ee6d8197034984c6068ebaafb6e920496fbe54e

  • SHA512

    2659e4adef4ee3c7aed83d22686bbdc2c7e97a42645b8a299c5032ec71ac2e28390c2eeb4ed998f87771cd603cc29a35d0ef044fd23f8b54711db14d25918c91

Score
10/10
sodinokibipersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\3d6r53wup-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3d6r53wup. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3DEA5211D2A588C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F3DEA5211D2A588C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: pPIL2soubTpyqvo04SZ4xAs0AZ1aTyKxD3nGQTQX0FE44nYbih7kTLJkgv2Odu50 8APYG+sOvQCwul7fKYkjoDQBEZf/KKvyHTk4HA3/vhPnwVrAB6zUvR+oDBb08yj0 KyspQSWTqHXOwmYZienALPno4x5H198XE3mn0IR3Zzz2b2dQi/PcYFq0PgqosEIs 8YVWq7AGGn14Bh+5YbElFfNWYz4QyMPfOVR/MhhNCeUFkfSurPIombqCdzYepN42 siUBXsuZjYukY4v9srW3cjmlnWq0JQ/yJEHbhzG4TGUlFLmnVEyMT0gmBib9N3H4 CPpIb6E+rczoQ8DAw6HT0XxzWhdE5JlzvULWbfj/Ht9qlf8JoB/slo6AnspCBvID vm98k+Nvh6bzM819KGmN5tEza7bMGBFrSkUZ41/EH2IIn13uhXOlgV5D2qcxMZ8V cPDZjBG4vL7qhxz4FLD7XveLlFJkrjd5lbH5AybEUjBQVp+DZRyjmJZPLVvf2iNA 9ksrmGMihNSYmx1r+qlqfBjJ84Ik+B4WSZDj/EO0ApASiArI33IZpiOUNV073wBg sR8vON4Nhn6f2huJGFhbZoAuApdu9RIu1qih0jCUIaZDrvc/lNIRYMIBnMgxeFmE 6SF5WW33rmlWbhODzWcqVhVVfMYWFu2UUgQv+J7OjpI1Xj4mpRxpOzBxo4BWh9MA kw4BlBx/trrTr/nfh7jxA2OsQM/zhaUetvehxW2wpVnbJL6jty8awocZuayEC4Ct f7FkfzOxAtHN3lHQRYKDAbBGghEhzA55e6a3Qc60/9iLXGlCdOlEwbEM8c64octm xwhv7iXKtqrfhKG9kFEFbKW9V4gBnDeXR/ZyXcu8t0xYVHYyqDip0fHCGMsSSqd3 DJ6Y4ck53MiLFYveO9Gort74nxzFIkYQzPKdRTtudAnw5CepmpUOZwAUEBDXucwt ofotUe7SuGZbQvKSKiFJE1698uPEnA29e4l3lp2Hs0n40quqw22hvVBqR8/MIsvH 4tWNtyl8SXVOiZf8PpksReI+LDALC1mUU5Ry/LfvGzJTQPXvz1U3DKdfgebtkESn UN8ztpcOca/wz14s6GS/A7rMvuSICQyzzljoMRGaqJ3m0x5S66X2i9/sfRxocZBb IdynRj5eyYX2SXiTMaWSvI67gCmu1gbDRHyKH9yYjPB9Eu4B6b9EaIBIaZGK4U/2 7Lbjsf1N/apA5CvhtZ6eQyUCeqTrFtGfxRy40mEPkPkagbcgpMaHjy5zhrp5s4x4 F/tASqBw3q2TOcPJ76WtxHghpYwpwLWPbPzFNFSE ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3DEA5211D2A588C

http://decryptor.cc/F3DEA5211D2A588C

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 48 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 44 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7123e63719339ead8b5912d8ee6d8197034984c6068ebaafb6e920496fbe54e.exe
    "C:\Users\Admin\AppData\Local\Temp\d7123e63719339ead8b5912d8ee6d8197034984c6068ebaafb6e920496fbe54e.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1116
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:828
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2028
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1356 -s 1200
      1⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1696

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1116-55-0x0000000076511000-0x0000000076513000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1696-56-0x000007FEFC151000-0x000007FEFC153000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1696-59-0x0000000001C30000-0x0000000001C31000-memory.dmp
      Filesize

      4KB

      Download