Analysis
-
max time kernel
198s -
max time network
215s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:10
Static task
static1
Behavioral task
behavioral1
Sample
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe
Resource
win10-en-20211208
General
-
Target
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe
-
Size
120KB
-
MD5
aef3bcd473104132394c2ea9a018b3bf
-
SHA1
192f010cc7bcd58de99a30e13582c46bb3b11782
-
SHA256
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0
-
SHA512
52610af681e1c4462d70b3f4eb21acbaedfb3e35502d21b298ac7c2301fd1edb5996aa0936c885c67fbca7d07d5bd2b679c4d50ec7056e52c2c4669bb8a05ac8
Malware Config
Extracted
C:\dpyup6kgl9-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/40BDFBF83863F243
http://decoder.re/40BDFBF83863F243
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exedescription ioc process File opened (read-only) \??\U: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\V: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\H: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\N: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\O: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\P: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\Q: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\T: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\A: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\E: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\G: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\J: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\X: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\F: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\I: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\K: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\L: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\M: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\Z: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\B: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\R: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\S: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\W: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe File opened (read-only) \??\Y: 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe -
Drops file in Program Files directory 1 IoCs
Processes:
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exedescription ioc process File created \??\c:\program files\dpyup6kgl9-readme.txt 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exepid process 3484 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe 3484 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exevssvc.exedescription pid process Token: SeDebugPrivilege 3484 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe Token: SeTakeOwnershipPrivilege 3484 461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe Token: SeBackupPrivilege 528 vssvc.exe Token: SeRestorePrivilege 528 vssvc.exe Token: SeAuditPrivilege 528 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe"C:\Users\Admin\AppData\Local\Temp\461edea118edac029c456b0942e78bf9f9f517741682fc3ed877bf340b6561d0.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken