Overview

overview

10

Static

static

10

a2715f4fe9...8a.exe

windows7_x64

10

a2715f4fe9...8a.exe

windows10_x64

10

Analysis

  • max time kernel
    122s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 01:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a2715f4fe971766681c17ccd0e045f87f7b09d4d57adb99601078ea5c8bbf68a.exe

  • Size

    159KB

  • MD5

    89b21e0bdc3be808c42a82e17372b4c6

  • SHA1

    6a19a7205c51dc59938b0264f173eeb1815ff4e1

  • SHA256

    a2715f4fe971766681c17ccd0e045f87f7b09d4d57adb99601078ea5c8bbf68a

  • SHA512

    22449634409904eda5f312266afb6f3200e35a1177222be0bc505b6bec2accc5ad3cef3ba43b17c2d2947f6b6f694ba7bc0b3fe825488365565b7972465354b4

Score
10/10
sodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

C:\g1r6cn8-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got g1r6cn8 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5FA34714DF9BD92 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/A5FA34714DF9BD92 Page will ask you for the key, here it is: EACcvSM32CWobXBJp9crymLpiTToZlWtJdH13TTvJ4WYASXVcrypSxUGk0lTCiHh dTabnJpBAiV24LjYsBpA4pZOcWcg6ReD7Wq5L3fhCN1YzI5Lh0QwTAZdYzJ3VkSF Lvd25DAe7sOLu4BmDvI82RoZEQojzwiCDamNBZQ/eMZTOFdkMenMYCxPS8JjN6eQ LfZtb39WboZ5dU7Y+c7vul60WAQjBxp+k28BPMQeAraflkGN2nxkS+uprsRmmfph 7JJSXYG/73c3lBolCgAWuVlO9H7n0RWAbx8o73jFrOiHqLI05zl+L0/epbZCfws3 jL9yntzNvULdoE2Azwh3fletqHaZhgt4dWlG2eft1ZhCeT8W5DV5mTdZ1JhtJmnL f84sd/OrVbxSWRmODnzQD/U0+jp3/h25ZKrqfGSkAptMUrYFOHfvVN2uX99CgajD 5x6z1UoQ2zmOgkejfG68njd5khDeQvL1kJzZXCAeRvituoDpOu/aB7r/i1EbayTZ AVO/jnJMEqQCZZT2EpC7s+GnpA/+oZiDmSrXvsmiI3DDxny3KkXWO+9PlH/g7UEN LBZsadUMU1H/d/mfGX6JoCNTciPDhEJrApGjbxWKzJbXVo98acJWhbjz4GqAa0Zj 8W+t2aLI4octUjubMMCjAstIbAQqmqwnETbIpe3guXfs0dOYp1IVIIBFordNqur4 LDoNkQrre+INZIltw0Ky2F1MJTbY+Vfu0MQh3XznNjgtJHJn3aw85YiQ3r+aAAAD WnaFht285dl1Ky1vlSiUovyrp/jF1doM6eVnCrb9jQg78ZV4EotyyOYEra/seOMP +HlY8RecVqcr8Id8LeruwNLxahBKbAbZQv7iAhZ+vQRnjJ+/MkJGk1JCARbwMHoY cMcSSVsb91cJ13jAsFkw+00E2roMYAUQacLfS0g9RfCTN1KKgkUczh274UJJhMMJ XiCQmmyLG/zzIBIuhS+iX0L7YZssTHL5Lqh8Sp8PxwY4CskXcTa0+SEym/Ai7Ef/ u4Ky9tyrxl2B+giVJx5sGGm5BtkLPCvlKzrwvTTnwVJGh863CQX5WBKhc0iGd8Z6 YwtQAj4R1fSSzCQgvVtuu/cr
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5FA34714DF9BD92

http://decryptor.top/A5FA34714DF9BD92

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 14 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2715f4fe971766681c17ccd0e045f87f7b09d4d57adb99601078ea5c8bbf68a.exe
    "C:\Users\Admin\AppData\Local\Temp\a2715f4fe971766681c17ccd0e045f87f7b09d4d57adb99601078ea5c8bbf68a.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1732
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:852

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1864-54-0x0000000076041000-0x0000000076043000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1864-57-0x00000000000E0000-0x00000000000EA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1864-58-0x00000000000F0000-0x00000000000F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1864-59-0x0000000000100000-0x0000000000101000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1864-60-0x0000000000110000-0x0000000000111000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1864-56-0x0000000002030000-0x00000000020CF000-memory.dmp
    Filesize

    636KB

    Download
  • memory/1864-61-0x0000000002190000-0x00000000022BD000-memory.dmp
    Filesize

    1.2MB

    Download
  • memory/1864-62-0x00000000001A0000-0x00000000001BF000-memory.dmp
    Filesize

    124KB

    Download
  • memory/1864-63-0x0000000000120000-0x0000000000126000-memory.dmp
    Filesize

    24KB

    Download
  • memory/1864-64-0x0000000002690000-0x0000000002799000-memory.dmp
    Filesize

    1.0MB

    Download