Overview

overview

10

Static

static

10

0ea283bade...0e.exe

windows7_x64

10

0ea283bade...0e.exe

windows10_x64

10

Analysis

  • max time kernel
    185s
  • max time network
    200s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 08:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe

  • Size

    141KB

  • MD5

    bbc4b3eb90f4ff9f03a4d56171f0019b

  • SHA1

    051b7eb98447c7f8e7eb8d3628ab1382ded08034

  • SHA256

    0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e

  • SHA512

    f679bfd0baf769284f355939c809be865d0559d561af1850749a78c30a2d8a8e84ba5f046b9aeb9403acf181231d76cde4603d586708919896c1b331930b5ff0

Score
10/10
sodinokibipersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\16xy5z3x-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 16xy5z3x. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F0143D13C3C4165E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/F0143D13C3C4165E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: s7JT6ChfNpN1aL8Ey/sTTVRHyUSEtf3KA7tiFS/kYF5FFyHhKP+t1YfdVQYqefKB UyDO5DhdbyD7Pzw4Tr4s70ttMFMCmR4h4K9tNR2Wa2ntoJGHuAnvUZCswLf0ccS0 pM8arYoWbX2h7OvyupJbaPvUrccrwvxSNaBLtkvYkw0IM/4YqFYGJ7g/J2sQBrKa IEBoJR5uQsgygW3N1PFGEDWLOKeKKgT+lnAEolL5SkKrZ+jkpafZt9D01yp4QP8b pe5+UVCj+eWVsvxGLXjFvww7UuBk4Jp5kku1Pd/tKJw51No+htAzTiGHUy9r+GRN MVMgfk3VSvR7vSAUqfOqacoQeaiHGPDvOOAx0d9Aj6byEQhWHqFZOa3VPScwWmfh /CdiEDK27eLU+6J9Uib4StJRuQcGKUgjbA2Vn4sbsBtimwmESxSqCJFVrL2MrV3k 0y/EOhtSoDyrXJTU4gjTYZWYtVYkj0IxgD5VGqegwrv+h26gj64zkG4zicpSHZ+C A3nlaJrGOY0WA+cwVgYcpcyOw0ew7LChSiKgYii8cwQgsp/4xhaRo09YYjSI82pk /q3BkTR6Lglio2Q106Gsqm4htlKHLSbi19JsCmYEpbdw3ZFhQo0akrLo6FUJnuyz EtJVdWgzCPHtz4tfRupMVFMELJIV2H8ahRRBJalR4ktTa1D6T1UEbxhdLT+sHsqo zQHRQjZgj8Tpi4cjjbQ3TIuEvVxK+sv9bLc0THgA3P1Kb3Ivw7rml4cPDh5n4ntP awkreXum/catz+l/5z2mSUymkJd1Z1HJ4RfC3qe0N/nvagnX355HG7/dBqTFX+dr hzy9Vy7GUkYYb7M09tq7bdF1z9N9dkiY0R+b+kiFYFLLlFsXVowc4sPF1h0aNIVC lAaq1qeOqAPRpooPly2Kt37b0MvtUnQzjoDLXK+DEI0m4/OXOLb224yjhSD2gTAx fm8AmPz4V9/FHpeR4T3Eg0G5GdDtPFtZK4ctC9gGs5Cx1SmGuMvG8zYxJ6L8pR51 fscIVAX5pt2jgItqDBVGCQTh0GKJEIWP69RB5DLojm25EOS5J4S8jHKGGD/VFc3A KqcIrMyDoYsqiYJ72wtys17Tw8qu7cMzn5HyF5ZnPSNQ/3dayTXI5hoRuAhMg7tR J2zRlB7ux1f+7X/Jo9fdr+dDOZonspXN0YMpNzJyK6khv7saMXt2aBlc26dPJn8g 823n0u+k9Y94UUfXj8FzH83GTCOj8yUu3wiC5htPEo+88piMjuNJA3KIVKmlo6Rp hJEMEHX4VQsylu6syHEPrvuwmnA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F0143D13C3C4165E

http://decoder.re/F0143D13C3C4165E

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe
    "C:\Users\Admin\AppData\Local\Temp\0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4120
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3140
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4236

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads