Analysis
-
max time kernel
169s -
max time network
181s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:16
Static task
static1
Behavioral task
behavioral1
Sample
38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe
Resource
win10-en-20211208
General
-
Target
38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe
-
Size
179KB
-
MD5
caab803a7c12918ff5dc44a35589906c
-
SHA1
10a749fca7313acfc08e437e02348202056501ca
-
SHA256
38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d
-
SHA512
0b06a14757dcc718ebaf1d7427daecd576e2688441ef97e00ba785f0e6283f9d16b9650348d1496132c5fa9670058bd03244e62c48fd14c688589ab55da30671
Malware Config
Extracted
C:\48557gg6b-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3CDE368758C84D53
http://decryptor.top/3CDE368758C84D53
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exedescription ioc process File renamed C:\Users\Admin\Pictures\CheckpointFind.raw => \??\c:\users\admin\pictures\CheckpointFind.raw.48557gg6b 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File renamed C:\Users\Admin\Pictures\CompressStep.raw => \??\c:\users\admin\pictures\CompressStep.raw.48557gg6b 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File renamed C:\Users\Admin\Pictures\DisconnectAssert.tif => \??\c:\users\admin\pictures\DisconnectAssert.tif.48557gg6b 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File renamed C:\Users\Admin\Pictures\RequestRename.tif => \??\c:\users\admin\pictures\RequestRename.tif.48557gg6b 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File renamed C:\Users\Admin\Pictures\BlockExport.crw => \??\c:\users\admin\pictures\BlockExport.crw.48557gg6b 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exedescription ioc process File opened (read-only) \??\F: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\I: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\O: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\P: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\R: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\S: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\T: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\W: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\A: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\G: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\J: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\U: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\V: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\Y: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\B: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\E: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\K: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\L: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\Q: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\D: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\H: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\M: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\N: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\X: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened (read-only) \??\Z: 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe -
Drops file in Program Files directory 30 IoCs
Processes:
38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exedescription ioc process File opened for modification \??\c:\program files\UpdateResume.3g2 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\ExitMeasure.mpeg3 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\OutUnregister.shtml 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\StopUnregister.m3u 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\CheckpointUse.jpg 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\FindMeasure.svg 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\StepConvert.xlt 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\GrantRename.dxf 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\OutExpand.pub 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\ReceiveMerge.docm 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\OptimizeConnect.easmx 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\StepRegister.eprtx 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File created \??\c:\program files\48557gg6b-readme.txt 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File created \??\c:\program files (x86)\48557gg6b-readme.txt 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\CheckpointResolve.tiff 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\SaveBackup.mp2 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\UnregisterGrant.wvx 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\ClearUndo.fon 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\MeasureCheckpoint.jtx 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\ReadEnter.zip 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\UseStep.wvx 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\DisconnectShow.jpeg 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\SavePing.mhtml 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\StartOptimize.zip 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\WaitTest.dwfx 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\CompressRename.mpeg2 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\ConvertToRepair.ADT 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\DebugProtect.cr2 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\LimitGet.iso 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe File opened for modification \??\c:\program files\MountMeasure.pot 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exepowershell.exepid process 3784 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe 3784 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe 1212 powershell.exe 1212 powershell.exe 1212 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1212 powershell.exe Token: SeBackupPrivilege 2228 vssvc.exe Token: SeRestorePrivilege 2228 vssvc.exe Token: SeAuditPrivilege 2228 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exedescription pid process target process PID 3784 wrote to memory of 1212 3784 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe powershell.exe PID 3784 wrote to memory of 1212 3784 38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe"C:\Users\Admin\AppData\Local\Temp\38ad0cfb52e6c5bc1938919af2e28f92276f4b93e3b3b047ea561a49ca4d811d.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-120-0x000001944EE90000-0x000001944EF90000-memory.dmpFilesize
1024KB
-
memory/1212-121-0x000001944EE90000-0x000001944EF90000-memory.dmpFilesize
1024KB
-
memory/1212-122-0x000001944EFD0000-0x000001944EFF2000-memory.dmpFilesize
136KB
-
memory/1212-125-0x0000019468F50000-0x0000019468FC6000-memory.dmpFilesize
472KB