Overview

overview

10

Static

static

10

d4935989bb...35.exe

windows7_x64

10

d4935989bb...35.exe

windows10_x64

10

Analysis

  • max time kernel
    129s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 00:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d4935989bbc355ab3d612d046ed01b06503374d2888aec46c639f7e8ccfcce35.exe

  • Size

    164KB

  • MD5

    20ec4f0e06c982452745ec8d49adef38

  • SHA1

    954938af3c1311035496971281d91741974658cd

  • SHA256

    d4935989bbc355ab3d612d046ed01b06503374d2888aec46c639f7e8ccfcce35

  • SHA512

    319dbcc021908fd667b11d17fe8ee647b72a00617a102d2c4c0422e1725befaa9968d6204f15c4808a30e78827abc6d8e71f473e129fcadf02f789f03c17fa11

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\97suoj24-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 97suoj24. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FF6F87AEDD8EDA74 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/FF6F87AEDD8EDA74 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 86LQqAejBU6k8AckO104DI9s+CRBI+DlivDMWmLWYK8nowpOC0KGa3y9TxWsAc9d yCNNLEiEdUYb9Dcy3+6VfjeW9K4sigKhlFTRbk7zx9LwPveuMa0h9Q2QiSqXkb5h m13BONM9+vydYsgfA9JDAJVdkjpGVEnBRX5DQBKooevWZn52PnXzRvPN802BHxV0 ZT0e4Kh/JrE9XZXf99s/tsxr4rHGdTWivf1la2uNZEowKaJK6SHHqKlGlZnWa7oz h5wE+fYpFUjfEjcsTiUcMM7GC/n2VHs52P9FoTb3TqQ99Njk8qwEukpgsihxKs5R BP9uRg5aysHCzXZHWDleGB6rYMLEwb04EfbVu6P4vlI71kNStO4fSs9KdGjo4yct 2wInx29fH3LV7esZ3dubT/W6UsESEotj0GU49huk8uNaJI+/zTdsT1VydvkUNSZ0 xD6/R/edLjboL81lgcYl7lgj8E+k7vk0zZFRonpR64ORGI/uAxIFIfnhiJibj6cR MNah40jYguuju3gAJeKcLn+Ijx3QApVw/2t/e6Ka2bIh07y6/7m53UnZB7/rxEhD EQ5FYcgmSc4rOuHRyqBQMoNqknAUfIc0AFI+yLU1KZ2HfNkIjc5r7sSgUaS6SeWz 9iEtTKuTqOXE+WxmpH1jjqj+5XhjlBp88Iuj5naPm2rx0Cfm7YbN1gXav0RAzTbE 41z8OFwZEdWtCCp8p4XioU+ysYL5AVl3YGbuEOIuX2JRn3k9viwEmEoSlKgoqfMK QBTUlSCAjxnFWg3vNeXvMnHTErmZWSjW7hsXHMQN4J8uoWJx/duzgiRdfgqwXTOA kGys+8pfm+XgrZbvChLyrIPSz2rnE8YYE7lHscIOpMAN/M5hA2quswr2llFMNyBF 7skXjUeLv4x3AQqBw1faoCck0cYXxMAWOpWZTAgu6sVA7lnphlRgaEvcZr46ar8v jXX9pduUwtpdZc21pcYK4AVi6nQ/Mv7H71hrN1l8I4o060bnw4vfAXMtQz+rJULm kgKWUhdEnEBsHVmvTENTzuHyFcQxyKsVNahF5JNO9+2HxSfC4eHCQt8phDYb+H/I QirQtImjaYPNdKeDJJqQLHPRZI70S5dk1OwyuJ1FhAtqtTBW/jr9w6gTX9+VxFdH rri1Cw== Extension name: 97suoj24 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FF6F87AEDD8EDA74

http://decryptor.top/FF6F87AEDD8EDA74

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4935989bbc355ab3d612d046ed01b06503374d2888aec46c639f7e8ccfcce35.exe
    "C:\Users\Admin\AppData\Local\Temp\d4935989bbc355ab3d612d046ed01b06503374d2888aec46c639f7e8ccfcce35.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1696
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1408
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1788

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1696-55-0x000007FEFB771000-0x000007FEFB773000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1696-57-0x0000000002550000-0x0000000002552000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1696-58-0x0000000002552000-0x0000000002554000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1696-59-0x0000000002554000-0x0000000002557000-memory.dmp
      Filesize

      12KB

      Download
    • memory/1696-56-0x000007FEF29D0000-0x000007FEF352D000-memory.dmp
      Filesize

      11.4MB

      Download
    • memory/1696-60-0x000000000255B000-0x000000000257A000-memory.dmp
      Filesize

      124KB

      Download
    • memory/1700-54-0x0000000075601000-0x0000000075603000-memory.dmp
      Filesize

      8KB

      Download