Analysis

  • max time kernel
    178s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 07:56

General

  • Target

    22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe

  • Size

    133KB

  • MD5

    fa3cbd224ae012ebbef336f49cf83c77

  • SHA1

    7071091b8f7e0387a0d0e643665acb12d5eab211

  • SHA256

    22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3

  • SHA512

    fee1a5408ea269d6b338d338cbaae90f32a90de6061a2e8ed2bf216e9496a7e475ffea8c08c7ceb5022e36595eb403eb8695a87b2b08d316a24662d72940fd53

Malware Config

Extracted

Path

C:\4p8lv6zd8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4p8lv6zd8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/15AE5EE880EFE130 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/15AE5EE880EFE130 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: MiHoweAHhL/rChlblIG9jkr2JlUxy/ih6OeF4oUT7LVT6/GjoNwdx2zG7vN3+dPd oXW/FtALM5yNfTgupSxgUdk3ns85v1aRmsZvHRjjH6OR8nZq7AOmVm/eNgbIjkZh h/7SvkPrffxRKHs3iSrcqv9/j9e4/cP1jne2HdNfnppvTdcRtma6DNQUrlV01lSm u34U80Nk+QYNlr9AO4/X92odyfAlPXJZlVI4KU5/YzT2faAzlmSNxG/9TkvDzyRZ 0o2tInfp77lXLr5rTSz4yw02m4zl3I3Wir0KTKZ1Up0KzSl9s9SJwSS0NYP/JFLD /Kzdz+gs2SG9m/Fwi9p7tUXbgsciBiijIOOwNcmdpCP1YF8BFnxxaWrwvT0n9zp1 JZQ9Fjgv7jp4007Ni9DYZK9ofBqLQ+7unjIOiLASN+dxW/z5X6vK9KMZp+K+C2Jq Vym8Md6iTuf4GqVdqIRmJaPJhUY5cFT2GW9oj9ycmQZ97vkPRAO6TQhCe82+Q3/g lxOWOdmUcroZH9sLsbYDiPgio3DQjcuKanLImcz2XicyZRG9B2MnyXXjVQQ7tJUz 8HCAeI5R6Tb0qIJ2KHwV0rfYGdeSJ4QGDTVcmt+d45KFAO3gYdmAGQOCPsTHP5vf 7DF+6Y87Fh3t08juT01vz5k9WiPWzU/Q0ctPSsLF6ms8/3MFmxCT6UgmrJCU6sZd d8yolf22ZtKg4Hf4Slw6VaJlSPsuEx9zLIiGLxiRcY9cJ29keMG7LMSAAPFjBlJ9 ONyvDU2pZrcWjzHWX5gLfKKC1uOhFipSfBxqOVHAjJ1STB15S2o/PofYLosw+pbG JpzS+mP+YxaLmNVagsN70qR7NAvp+mog5b9wsk4D705RAYP1Nao6juubTM/V6jQI tGgzZiZvzGNZj+XjjUZYcG/soDO8AmUAJ9mDXTmcyPAeBOmQl+bq+kvoBSwA6/ew kL4wDcU+0FiE+T2oEoknfz0yo1r27GaFj2Tav56f+DECusMIerCdTjf+DwUZ4HGI eq6eHGaUKuyA7dy+/Lyemd+4xoo0gPbs8K2yiBfdVRMfmtyW0TJ9926AN0YtgTI/ 3PY1YGJICRJEPhKcnmAFi2XYTUBXyySgcaxyZ80wWZBxyWhOYH9n1mMmMnd5Op/d CYtTc3r3MhuIe67U+ah6oIwf/KXEcVGUDhPe9FPl7RcBD87L5arbkQT7wvLpEwla Eiza2wZwdQnVwCKaS9djIoMPsj3FTN6H9wT0P4LtvmVc8MgX40C/QyTV6c+Kp+G5 /w18yt+91O2oElOYGzKp2MZLyBSZ0A== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/15AE5EE880EFE130

http://decryptor.cc/15AE5EE880EFE130

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe
    "C:\Users\Admin\AppData\Local\Temp\22d91795b7fc302eac6b2ee9a582ab7de1e29028d313a1fd34ff64f8f5baa0a3.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3180
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1812
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2320

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3180-122-0x0000025581780000-0x00000255817A2000-memory.dmp

      Filesize

      136KB

    • memory/3180-123-0x0000025581450000-0x00000255815D0000-memory.dmp

      Filesize

      1.5MB

    • memory/3180-124-0x0000025581450000-0x00000255815D0000-memory.dmp

      Filesize

      1.5MB

    • memory/3180-127-0x0000025599A50000-0x0000025599AC6000-memory.dmp

      Filesize

      472KB