Analysis
-
max time kernel
131s -
max time network
143s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 08:00
Static task
static1
Behavioral task
behavioral1
Sample
14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe
Resource
win10-en-20211208
General
-
Target
14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe
-
Size
164KB
-
MD5
03075b2eea61a87ecc5a1dda76a72679
-
SHA1
a7b98074b9294c47d03c3cb0008df616dd5a8601
-
SHA256
14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526
-
SHA512
b70d1d61bafaaf568e7a59f388cbf8fdede678d83049e0f8da096c18af896a52842422c20df722f11f124ab3df06fc0f974aed53f76d873e3abbd33c81c804c1
Malware Config
Extracted
C:\k6ccg4p-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/11C62FCEA13A0F6B
http://decryptor.top/11C62FCEA13A0F6B
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exedescription ioc process File renamed C:\Users\Admin\Pictures\UnpublishUninstall.raw => \??\c:\users\admin\pictures\UnpublishUninstall.raw.k6ccg4p 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\users\admin\pictures\RepairSplit.tiff 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\users\admin\pictures\SkipOut.tiff 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File renamed C:\Users\Admin\Pictures\TestLimit.crw => \??\c:\users\admin\pictures\TestLimit.crw.k6ccg4p 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File renamed C:\Users\Admin\Pictures\RepairSplit.tiff => \??\c:\users\admin\pictures\RepairSplit.tiff.k6ccg4p 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File renamed C:\Users\Admin\Pictures\SkipOut.tiff => \??\c:\users\admin\pictures\SkipOut.tiff.k6ccg4p 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File renamed C:\Users\Admin\Pictures\UseWatch.raw => \??\c:\users\admin\pictures\UseWatch.raw.k6ccg4p 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exedescription ioc process File opened (read-only) \??\I: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\O: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\P: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\Q: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\V: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\W: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\X: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\H: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\Z: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\K: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\N: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\S: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\U: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\Y: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\A: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\G: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\R: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\D: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\B: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\F: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\J: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\L: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\M: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\T: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened (read-only) \??\E: 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe -
Drops file in Program Files directory 28 IoCs
Processes:
14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exedescription ioc process File opened for modification \??\c:\program files\WatchStart.mhtml 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File created \??\c:\program files\k6ccg4p-readme.txt 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\MountClose.WTV 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\SearchInitialize.dib 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\StartDisconnect.jpeg 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\SubmitWatch.au3 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\UnblockRemove.WTV 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\UndoRepair.contact 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File created \??\c:\program files (x86)\k6ccg4p-readme.txt 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\ConvertFromRegister.3gp 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\GrantSearch.au3 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\PingReceive.mpv2 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\ResizeNew.gif 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\SearchTrace.m1v 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\UnpublishMove.nfo 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\ConvertFromCopy.pcx 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\MeasureDebug.zip 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\OutLock.edrwx 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\NewCompress.ttc 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\PingNew.vsdx 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\CompressUnpublish.easmx 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\ConnectSend.clr 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\ConvertToUnregister.tif 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\MeasureUnregister.aif 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\CompleteConnect.rtf 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\CopyExit.ttf 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\InvokeConvert.001 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe File opened for modification \??\c:\program files\ReadRequest.zip 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exepowershell.exepid process 1212 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe 1212 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe 2752 powershell.exe 2752 powershell.exe 2752 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 2752 powershell.exe Token: SeBackupPrivilege 940 vssvc.exe Token: SeRestorePrivilege 940 vssvc.exe Token: SeAuditPrivilege 940 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exedescription pid process target process PID 1212 wrote to memory of 2752 1212 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe powershell.exe PID 1212 wrote to memory of 2752 1212 14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe"C:\Users\Admin\AppData\Local\Temp\14cb0affce00f0b279fa1843d528486434b903d2917e4d2a328706044874a526.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2752-121-0x0000023EF8490000-0x0000023EF8492000-memory.dmpFilesize
8KB
-
memory/2752-123-0x0000023EF8493000-0x0000023EF8495000-memory.dmpFilesize
8KB
-
memory/2752-125-0x0000023EFA4A0000-0x0000023EFA4C2000-memory.dmpFilesize
136KB
-
memory/2752-130-0x0000023EFA650000-0x0000023EFA6C6000-memory.dmpFilesize
472KB