Overview

overview

10

Static

static

10

5eb43204b6...3b.exe

windows7_x64

10

5eb43204b6...3b.exe

windows10_x64

10

Analysis

  • max time kernel
    144s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 01:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5eb43204b611cace05c47e2b6df1c37343f7c585cad9992dd39051c5d2c1e73b.exe

  • Size

    166KB

  • MD5

    ef2352669d8aa88f9fdedefead182acd

  • SHA1

    48b4f8b70a8f937af7f8888223209652f6a5d229

  • SHA256

    5eb43204b611cace05c47e2b6df1c37343f7c585cad9992dd39051c5d2c1e73b

  • SHA512

    5cba9efbcf919196e0e142e8c9a87acee65baf8af3ea6a14dc8f4e39eef94c2d9a1e86e57fdecb2d643b2cdbee5640d3b5db96e63a608920a6d66e0ea639c962

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\z513v6e6hw-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension z513v6e6hw. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/24175D0469D1241C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/24175D0469D1241C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: t1S7+2oXGUbPY93k1xAZK+czgEeS1rYNoO2yzNl8U6wOziQDyRF6xoEHvrun0Tdr AzxSXzC7xiXd/QQFQETYVmzu9n88yOV4lNgq3v++gqjU716YK699G8MRjrxiAJ70 jXk8uI33hg+pjNPK/S99u3bWyCerDmCXQCB2Ymemc3aBV8vzcM2Cb4HShwcCAlg7 O+KIrfNKgw5thVB9gb9J5LA3R8zfyl3Pvwnk2wE4dd03pS9cqdfRs2p1nK6KcXp5 jLWH0ftfp3D1kH6rqpAhJu21OMFoYatOl1jXuEMY5D1Kx/t1fKHzYpfB+71xbkHF Kc3cVKM/jG02zdcpSUttVGozecyNs32DmpEMYuHEnRrvM0EHxtI6+VMwnNE7d5W6 l9x1Fyd+40FCA+OrpZ+hTMUrvBBdBBXxx991viGUwnbkdMqVRMoyreBcbPu7Xuzg tV1JEhk9b072oD5sC2Hn8uZd2qdm9TCG16V+jLhCpjhQW8DQGhF7G3JJHxTokRmK 7P9uq94s9R1paGmpF+fMjpWV7FNfIV4ok0GfQofXeo1uEzwh5UbeamsX49cKyJff Z4aYRREV+WFTeaNnzpf6TWe8M8P6xzbPXqxZpL+6hkjol0GlkEvNZwIRREEc5Az4 KeZI/wjZBf6raJUMKsGUbjRHsO/QKYaa6p2lNcnhoj2xaL7JORwKzH/Kh2gKjmH+ iCJiJ3alrQhyNLA5fqm2YTAVeTmh6SXQRlzx2YRW+0i85iQpdtMK/t0tG/eC6GPc Axnq52KhO0ItDaS7gRwiivHZq4/yu+O463F7ut0LBIRk+6oyZba4eReyKxS+Qtgl VVN7zL0kYS5bKQ60OahRYYYOdP5zGG7qaEWD+dlVN/RLihj0xT1EPdjdgVBAcNdc gujgWy7V3lBro6bjFe5tJ8yn0Zd4AhEqCfzC4Ac+BLKjf2VHQnsFrO8urSk4QaxH oSR5wkOlq24/IulQ3rvg+m044Z3GlOKem+KrBhJ3nhWAdPbAcD1fq1u7pXEyU1cv tVUvmLE6yVXDVq+XvG0KcQMPPKaExWmkiaIfo27p9z1cCiPJnHG5eN/N8USBI0lk 4w1KokJLGCV8OhQmaowyChHAZPhJ5SVOMPWHgFnuIvCed8rt0jsjHKgpimGyB7Aw xRlTve/tUA9zm2rQrv6qTmQ5XwCcmAOgPkRbNJacWsyQ/1CM//xF91GAjQI1255b CbuxHJ7BoZXeb7xhGqNYyGxOna7WGWcNqOzuNA0si5vmv0YtWfg//zXtgAwbDJF4 qNQ/af0Kqw16fWGfT3YkyebQiOLB6xwR ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/24175D0469D1241C

http://decryptor.cc/24175D0469D1241C

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5eb43204b611cace05c47e2b6df1c37343f7c585cad9992dd39051c5d2c1e73b.exe
    "C:\Users\Admin\AppData\Local\Temp\5eb43204b611cace05c47e2b6df1c37343f7c585cad9992dd39051c5d2c1e73b.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:496
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4200
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1648

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/496-124-0x000001B1EA493000-0x000001B1EA495000-memory.dmp
      Filesize

      8KB

      Download
    • memory/496-123-0x000001B1EA490000-0x000001B1EA492000-memory.dmp
      Filesize

      8KB

      Download
    • memory/496-125-0x000001B1EC760000-0x000001B1EC782000-memory.dmp
      Filesize

      136KB

      Download
    • memory/496-129-0x000001B1EC910000-0x000001B1EC986000-memory.dmp
      Filesize

      472KB

      Download