Analysis
-
max time kernel
183s -
max time network
190s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:08
Static task
static1
Behavioral task
behavioral1
Sample
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe
Resource
win10-en-20211208
General
-
Target
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe
-
Size
131KB
-
MD5
43891fca97addcc70c1389e4be9e93d7
-
SHA1
f08d30eb63f77085da3034906b433a0114d1361e
-
SHA256
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18
-
SHA512
ecb9ad014eb698b8c61734a2d0ca6fb51b67c42406cc74da4e27b637588b0b7182320f78f87e67ca9dae8cfd0f0376bd193d6cdadaa4136e942ee98cf9525e91
Malware Config
Extracted
C:\3nwm89-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FCE44B2F0A1BAF7D
http://decryptor.cc/FCE44B2F0A1BAF7D
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exedescription ioc process File renamed C:\Users\Admin\Pictures\SuspendGroup.raw => \??\c:\users\admin\pictures\SuspendGroup.raw.3nwm89 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File renamed C:\Users\Admin\Pictures\SyncAssert.tif => \??\c:\users\admin\pictures\SyncAssert.tif.3nwm89 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File renamed C:\Users\Admin\Pictures\CompareUninstall.png => \??\c:\users\admin\pictures\CompareUninstall.png.3nwm89 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File renamed C:\Users\Admin\Pictures\InitializeRename.crw => \??\c:\users\admin\pictures\InitializeRename.crw.3nwm89 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File renamed C:\Users\Admin\Pictures\OptimizeRename.raw => \??\c:\users\admin\pictures\OptimizeRename.raw.3nwm89 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File renamed C:\Users\Admin\Pictures\SelectDebug.raw => \??\c:\users\admin\pictures\SelectDebug.raw.3nwm89 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File renamed C:\Users\Admin\Pictures\DisableRepair.crw => \??\c:\users\admin\pictures\DisableRepair.crw.3nwm89 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\users\admin\pictures\ReceiveConvertFrom.tiff c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File renamed C:\Users\Admin\Pictures\ReceiveConvertFrom.tiff => \??\c:\users\admin\pictures\ReceiveConvertFrom.tiff.3nwm89 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DNXeNcyLON = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe" c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exedescription ioc process File opened (read-only) \??\F: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\H: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\N: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\Q: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\R: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\V: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\W: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\Z: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\E: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\I: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\J: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\K: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\U: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\X: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\D: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\B: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\G: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\L: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\M: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\O: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\A: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\P: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\S: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\T: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened (read-only) \??\Y: c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe -
Drops file in Program Files directory 31 IoCs
Processes:
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exedescription ioc process File created \??\c:\program files (x86)\3nwm89-readme.txt c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\UnregisterConvert.m3u c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\UseResolve.odp c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\ApproveProtect.dotx c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\ConfirmExport.tmp c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\UpdateSync.ttf c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\ConvertFromMerge.css c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\GrantProtect.xltx c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\MergeUnprotect.mp2 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\WriteUninstall.search-ms c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\BlockMerge.dwg c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\DisableSplit.csv c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\InstallConfirm.css c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\ResetUninstall.vssm c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\ShowTest.mhtml c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File created \??\c:\program files\3nwm89-readme.txt c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\ConfirmCheckpoint.i64 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\GroupDebug.WTV c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\HideInitialize.wpl c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\MeasurePing.ADT c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\RedoOut.DVR c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\SelectResume.kix c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\SetBlock.dwfx c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\TestBlock.jpeg c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\CompareComplete.tif c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\StartDisconnect.vstx c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\SyncBlock.xltm c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\UnprotectDeny.aif c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\CompareStep.fon c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\MoveClose.vb c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe File opened for modification \??\c:\program files\OutImport.mp4v c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exepowershell.exepid process 4064 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe 4064 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe 4508 powershell.exe 4508 powershell.exe 4508 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 4064 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe Token: SeDebugPrivilege 4508 powershell.exe Token: SeBackupPrivilege 1248 vssvc.exe Token: SeRestorePrivilege 1248 vssvc.exe Token: SeAuditPrivilege 1248 vssvc.exe Token: SeTakeOwnershipPrivilege 4064 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exedescription pid process target process PID 4064 wrote to memory of 4508 4064 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe powershell.exe PID 4064 wrote to memory of 4508 4064 c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe"C:\Users\Admin\AppData\Local\Temp\c377d05e693242bfe0c5655f9e8d58538218c42a053612108c58a16c1bae7d18.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4312
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4508-123-0x000001B17B9E0000-0x000001B17B9E2000-memory.dmpFilesize
8KB
-
memory/4508-124-0x000001B17B9E3000-0x000001B17B9E5000-memory.dmpFilesize
8KB
-
memory/4508-125-0x000001B17B970000-0x000001B17B992000-memory.dmpFilesize
136KB
-
memory/4508-130-0x000001B17DC40000-0x000001B17DCB6000-memory.dmpFilesize
472KB