Overview

overview

10

Static

static

10

2809a1b475...3b.exe

windows7_x64

10

2809a1b475...3b.exe

windows10_x64

10

Analysis

  • max time kernel
    211s
  • max time network
    230s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-01-2022 02:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b.exe

  • Size

    206KB

  • MD5

    0220e281b135f0e32a2794fefe4e6aa9

  • SHA1

    05227068220cc142487806cddb262561a84e7538

  • SHA256

    2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

  • SHA512

    8e4d475bbea73f16d72079d329968aab1de73cf376f1a5988e7c5edd7824b23b29b8cb878da25e366fa98b69a4fe9fff30e912ad80172f51bab7c1bf0c008538

Score
10/10
neshtasodinokibi162932persistenceransomwarespyware

Malware Config

Extracted

Path

C:\wp8b39-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wp8b39. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3918789EF4C00089 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3918789EF4C00089 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 6h6M2j6IMvJqmVMtOsCKSqGr7yNH14e94z21T3vTDW0td9HzBYt8ca4B28/P+pUr S7EKv7lM/ZzHS4hbn0UvKcT94bH+oU2FCQogEU3MeOKhsJXpq614y97K9vvlkXR3 s5ZVaRjQ9ii9xDrJDcXWGGPczRxkHCo9EWtUt8Cc49EjTB1oE9xCGnvA4HXLLY/4 Llq4qeWM0l7n65NVsMiatQAUZcqLLuhnawVwA6VgdZu0b5wVKT90za3COaSx/z2r 2AJvIZJC9Dg3LmVYzWS1Oq7YTxhqvbx5Ga20+g+8wFyylfZGAUnLL7ekUn2qtTqb zZTMHYd2i0omriLwVuejfPoYK9MJ3pahvQcY/hnHYe9rSHXAKlzEPXFE+luOMToY zlIiT1SG32TDZ1wq9KmEPX1cVY3SiUQJFNBwc51f6rj+4q09EdsP75vApNVAxNuT S4+rCaF4+Yoa+PDrDqxXJSfHfdrHXbY/2sGpNWs4hQpzKI1Ze2wJcphCMJoVzA6q enn2oiabmx+lizuEr6rqpjyTmexGtL+yExMYMuKfc124IY6II4xix/5cjVBAOIhg Cd168ZQtjXX2+Ld/NlPZwGPehDDlAyUY1Cf+aUies/dowBlPDt3w2ZTy27bEqX0m 8In70W29YTRiqDCVf+BKp9EvMERXTHTWERW9UOf3ONwmI9W7zZk9eoYNXPpQHY09 WGhYmhY/wiMSuabXHYQBZ1jj6+MY4VdbNerCIu9Ga+t7lostwXXsvPTNBy1dLzhH s/L/yTqtfc73c/NevD/8fCIE9wd5RXRnzR00oaytU+HV8v2CiqLdmy488mXRGsA1 NdntFfwDcv8gaOJU9IOWK3BiRkSPREerz4fkz1JEap5xb5aCb3isdJC3zF73WGUf hGX8CZD/cGO2GLcbFsgcXsbTWA33voc5q5EypdickE6T4JceGztUFiYQbZxu9X64 360Ohb53XAkQec47LhfgiPNjc8CwLvyF9Bdkoij3JTtipbCuvggDS9u2kBcHcO9N h3scNZL9XmtOuvS+X+LXpe/yiA3S3MzipZUIdgmRDPyYslS++p11z4Cq64T1iefL +QMWEbofsj6Mn/B7WjgAIGs3wCmMkSJwFum10BsHL0JEaowympoZTsS8pwA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3918789EF4C00089

http://decryptor.cc/3918789EF4C00089

Extracted

Family

sodinokibi

Botnet

16

Campaign

2932

C2

premier-iowa.com

turing.academy

physio-lang.de

rarefoods.ro

palmecophilippines.com

ddmgen.com

omnicademy.com

baita.ac

cmascd.com

nationnewsroom.com

belofloripa.be

babysitting-hk.helpergo.co

tages-geldvergleich.de

iactechnologies.net

line-x.co.uk

richardiv.com

goeppinger-teppichreinigung.de

dinecorp.com

hawthornsretirement.co.uk

kerstliedjeszingen.nl
Attributes
  • net

    false

  • pid

    16

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2932

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 47 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b.exe
    "C:\Users\Admin\AppData\Local\Temp\2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4072
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4600
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4664
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1356

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Change Default File Association

    1
    T1042

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3582-490\2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b.exe
      MD5

      ff6818d770e34c64c37e6a83a7b24be5

      SHA1

      8af7c387cb323c180fd9c4fde99572a0af8fb228

      SHA256

      47e05f24669a0ffd7ca461aaf7e76e0b6e17f6cf424e4d854ddc584ee26ef42c

      SHA512

      b929fa19a51807605d6d05ae10d0362fe1c0b136eb087ac947637f57fa53811ebe2f58520a123587e9017e6ef66ac1622f59a743adf79751706c4f2982c5ea63

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b.exe
      MD5

      ff6818d770e34c64c37e6a83a7b24be5

      SHA1

      8af7c387cb323c180fd9c4fde99572a0af8fb228

      SHA256

      47e05f24669a0ffd7ca461aaf7e76e0b6e17f6cf424e4d854ddc584ee26ef42c

      SHA512

      b929fa19a51807605d6d05ae10d0362fe1c0b136eb087ac947637f57fa53811ebe2f58520a123587e9017e6ef66ac1622f59a743adf79751706c4f2982c5ea63

      Download Submit
    • memory/4600-122-0x000001E236930000-0x000001E236952000-memory.dmp
      Filesize

      136KB

      Download
    • memory/4600-126-0x000001E250D40000-0x000001E250DB6000-memory.dmp
      Filesize

      472KB

      Download
    • memory/4600-127-0x000001E24EC60000-0x000001E24EC62000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4600-128-0x000001E24EC63000-0x000001E24EC65000-memory.dmp
      Filesize

      8KB

      Download