Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 02:10
Static task
static1
Behavioral task
behavioral1
Sample
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe
Resource
win10-en-20211208
General
-
Target
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe
-
Size
120KB
-
MD5
aef3bcd473104132394c2ea9a018b3bf
-
SHA1
192f010cc7bcd58de99a30e13582c46bb3b11782
-
SHA256
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0
-
SHA512
52610af681e1c4462d70b3f4eb21acbaedfb3e35502d21b298ac7c2301fd1edb5996aa0936c885c67fbca7d07d5bd2b679c4d50ec7056e52c2c4669bb8a05ac8
Malware Config
Extracted
C:\6ch0xv-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0144FBC7B46B0638
http://decoder.re/0144FBC7B46B0638
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exedescription ioc process File renamed C:\Users\Admin\Pictures\StopSet.tiff => \??\c:\users\admin\pictures\StopSet.tiff.6ch0xv 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File renamed C:\Users\Admin\Pictures\UnblockExit.tif => \??\c:\users\admin\pictures\UnblockExit.tif.6ch0xv 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File renamed C:\Users\Admin\Pictures\UpdateGet.tiff => \??\c:\users\admin\pictures\UpdateGet.tiff.6ch0xv 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\users\admin\pictures\StopSet.tiff 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File renamed C:\Users\Admin\Pictures\PushUnregister.raw => \??\c:\users\admin\pictures\PushUnregister.raw.6ch0xv 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File renamed C:\Users\Admin\Pictures\ShowGrant.tiff => \??\c:\users\admin\pictures\ShowGrant.tiff.6ch0xv 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File renamed C:\Users\Admin\Pictures\MountGrant.raw => \??\c:\users\admin\pictures\MountGrant.raw.6ch0xv 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\users\admin\pictures\ShowGrant.tiff 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\users\admin\pictures\UpdateGet.tiff 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File renamed C:\Users\Admin\Pictures\ExpandGet.png => \??\c:\users\admin\pictures\ExpandGet.png.6ch0xv 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exedescription ioc process File opened (read-only) \??\X: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\E: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\I: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\K: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\O: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\P: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\T: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\D: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\A: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\B: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\R: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\S: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\V: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\Y: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\Q: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\U: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\F: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\H: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\J: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\L: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\M: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\N: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\Z: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\G: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\W: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe -
Drops file in Program Files directory 38 IoCs
Processes:
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exedescription ioc process File opened for modification \??\c:\program files\CompleteCheckpoint.pptm 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\GetEnable.mpp 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\MountNew.mpg 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\GroupResume.js 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\ResetUninstall.ttc 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\StartDisconnect.7z 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\SubmitTest.mpg 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\UnprotectExit.reg 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\DisconnectRemove.xsl 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\RevokeDebug.rtf 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\UnlockBlock.easmx 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\InvokeUpdate.dotx 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\StepRestore.odt 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\6ch0xv-readme.txt 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\6ch0xv-readme.txt 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File created \??\c:\program files\6ch0xv-readme.txt 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File created \??\c:\program files (x86)\6ch0xv-readme.txt 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\AddInitialize.mpeg3 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\ConvertToSync.pptm 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\FormatExpand.xps 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\NewBlock.xml 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\PopOut.vssm 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\ConvertToNew.TS 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\CopyConfirm.mov 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\EditSwitch.ttf 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\PingPush.svgz 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\ConvertEdit.jfif 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\InstallShow.htm 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\RemoveInitialize.ppt 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\RequestPublish.gif 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\UnlockClear.wps 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\6ch0xv-readme.txt 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\CheckpointSubmit.docx 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\ClosePush.M2TS 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\RedoSplit.TTS 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\ResetDebug.ex_ 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\ResetRevoke.asf 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened for modification \??\c:\program files\ResolveRequest.ods 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exepid process 476 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe 476 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exevssvc.exedescription pid process Token: SeDebugPrivilege 476 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe Token: SeTakeOwnershipPrivilege 476 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe Token: SeBackupPrivilege 432 vssvc.exe Token: SeRestorePrivilege 432 vssvc.exe Token: SeAuditPrivilege 432 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe"C:\Users\Admin\AppData\Local\Temp\461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/476-55-0x0000000076371000-0x0000000076373000-memory.dmpFilesize
8KB