Overview

overview

10

Static

static

10

23d96b2a01...1c.exe

windows7_x64

10

23d96b2a01...1c.exe

windows10_x64

10

Analysis

  • max time kernel
    194s
  • max time network
    194s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 07:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23d96b2a01d190a2146849c6cfe59fea9f3c6c6a8f71367dacaf89d3fa1ac51c.exe

  • Size

    165KB

  • MD5

    46357f434f7a6af45d039812360c5fb4

  • SHA1

    413637aa0d885aa3f35aef237d04c549d74b1d89

  • SHA256

    23d96b2a01d190a2146849c6cfe59fea9f3c6c6a8f71367dacaf89d3fa1ac51c

  • SHA512

    b48c571d0bc28eae58426eebee334baa49a78eb6f19a2efc31997233cd97caa914356657980222e0acf9eb982b45978ab103168c11f5a5964edce628816b3089

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\9q1zg6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9q1zg6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/116A7C8FB1C82C25 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/116A7C8FB1C82C25 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: QmvgBSjmJpmcqzQJDvOrrMa4OBekQkPAUw/L8TSQGwoBcB8e87vtPL+UX7sg51/K 0o1h9DzvzWlw04Nv7MIbkhipB9sA9h5hwyIokhMaZYDAqVSSfhPr4lub9EXTeu3V /raX5u5OCpE44H5C+4qf1RvMKGjsVOXBH7r4uI6OcEZtS9p2n9/WzKZ0KXLqQH9K awv1ws+6h74fo5ChzuaQcGpwv8UXKBNRu2dVJ0UWS0AZxqDKf+51TR56ciFrPHn2 /Ji4H93K6ygvOof8jR+J+86TqPDC9J6cP1NgAV1JJ7LF/y+SNRuhCzIxEP/pJ7vu Vny4dKv22XI3VHlg5dVerA1XQvdCdNtWePUq6TufQlh515Xn+Kspi7mFefBn8KQu a9kyi4EqXj5CtN/GVxFoY5EE9TEu+cxOXlqaZuC8Ee8GmvBfTGQh07jjmEOrNUoD wI7B/oFSY98+erQqX9UeQ+Kk+SE7qKpUHW3zXIpwbpr8V0/BRpp1AEfRt+sPzVLV 01nY8dvzacueiZ3e1qXddQreW9kjjEDV6NSEIPdk798ZyHySLFoaCYNbL+KvBOjy EMQRrrlxbyhw9wlmHervF/EJ9j+FAHS5fmF1RWd+GdoQ07N0ocKlymjZrBNFD+yh 8taXW5zpx6lP4UazJ88c20SMPkbcF/5FVBgSOr3Zf2CfeeZ7D+uydKP8toTMzfmO +KWG66KAYGEemTzwlLbSUPu4mTHwq213IxlsvTYZ6exeqB/il5E+lzF5Y8G2FyGB 1l20WEkh7VA6OyG3POuZFK7Tw71usHImrEuE6Nq0CiTGRTHWfyd6zsLfkoTaUdqn NkoHyee17LZHir5q4DCRV+4PqV2hSAfh2r/hlUfEhRA5p4yrP+WBVVpvk4Lp4jn7 kW9nroDV1fboWiQguJY16l7vLOoaTfe0Ke8JCTSQ+i7V1ho49ctEi89RazimwW3+ CwCAUnRtrwPoPBRSyi1I94rgV+KhTO1yBtBj3wAExFYOUudlpHQlh8qGokScGHtx 53gpBcqBpdwBK8tM7/FFtj+mCqmGnK2J+6/2p4YL4G4TXlaNUxO/HcrnvjnYB4Wz AHO0AsAY9adRJmeFCSGjgsb8tCFlqERj2JoyLKuEbSw436kcBr0OKbTPbGQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/116A7C8FB1C82C25

http://decryptor.cc/116A7C8FB1C82C25

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23d96b2a01d190a2146849c6cfe59fea9f3c6c6a8f71367dacaf89d3fa1ac51c.exe
    "C:\Users\Admin\AppData\Local\Temp\23d96b2a01d190a2146849c6cfe59fea9f3c6c6a8f71367dacaf89d3fa1ac51c.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:640
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3084
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:812

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/640-119-0x000001FD65400000-0x000001FD65402000-memory.dmp
      Filesize

      8KB

      Download
    • memory/640-120-0x000001FD65403000-0x000001FD65405000-memory.dmp
      Filesize

      8KB

      Download
    • memory/640-121-0x000001FD65450000-0x000001FD65472000-memory.dmp
      Filesize

      136KB

      Download
    • memory/640-124-0x000001FD7DBD0000-0x000001FD7DC46000-memory.dmp
      Filesize

      472KB

      Download