Overview

overview

10

Static

static

4de3675649...13.exe

windows7_x64

10

4de3675649...13.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    11/02/2022, 02:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4de36756490f54e1890ea95e057f5fbcc9e01cd4db9fe766b99550ffcc315813.exe
  • Size 285KB
  • Sample220211-cnbrdahgf4
  • SHA256 4de36756490f54e1890ea95e057f5fbcc9e01cd4db9fe766b99550ffcc315813
  • MD5 SHA1 SHA512
Score
10/10
sodinokibi$2a$10$zupg05izsc8vl3ztf9ha0ojtcpwma2hoglyufnmmgrsyjsjcsroje3545persistenceransomware

Malware Config

Extracted

Path

  • C:\ATTENTION-a8u5r3dw1c-README.txt

Ransom Note
  • Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "a8u5r3dw1c". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay BITCOINS to get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/8248CE6B6B71FD99 If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8248CE6B6B71FD99 After going to the site, enter the following code: qPuH0PvNeYBqk4E+4ZBcZxZ+9asEahgaT3U06RYIjD7FskZE5nGwBIyeip0dKkrl DkrXs8iT+GNeMwY9xmys731692xh9Q36awtA2wZXjlxurZLqsGrcYvjboBd9K+6I M0UB2ioE6ncCaU3i9wI3adKt2+QBjSU+KfIO8kG59N6ssssM5cSeR6+2fGLGFKTX Suq79snN12/xfgqNCpoQXGeUU6hwemvDpLO7syIywmKI1DADaFvLWU/MFLX1wwye ISZlXw7fmwE84pyyGumu14pEU55epRv/hLHFWB8VX9jpIacsBeXL1Ub9iLO7WSJY ghp58w8mzCzu8FO1ZGxf2icIqcs3gI5mzqziLcJb6nYwTS2c1dMbqLZpDXIYr+gj jaPBx7IwEMPh81Koj9FfURGmHnvXWdE7RJ5nl+s7okJm6gx5Pp+5ivVUVr9qnQkE hDzeXjoatpNw2aRQebUImTkdZjFgK/2LYOFSa2Iw85vyFdQI3XYHrGGRnjAxmRol N1MFEwdH9NLZ0oxcNnRT+DyEaiIjFnRl5lxvOC4dfQ8ooD2n9+KeVKQ2ewESxMSC jQOGADpiaE7s0OQQHqpqtmx6AZni5d0zrjaDXlVOUktjIX0aEfyrAm7KC1vBbck2 FaZdYyJF1ARDgo3GiagGNFLfhNQ51xJ8EEYltEF0yEreCPy1rRbBPmJHFvKTqMhe 5hiRNGj7t7f6b+eay/K1E7GXFPVYZ4Y+qHdaZDWKwT2IeG9pNxPORitHkOnBLCjY Vmz2k+6oNTpBoFsvJ5u0yA3tvI0E2PQlavH4yAcnBFlwBZ3k0roaSI9o03WLTADw 1W/N+p0ebvdOtHLFt8ZX++0B6byK19s3AZ9Fkj1JrmrtepKHdVQ9hMipzjP4uA09 LySEtzChHSFRJkaO75Rbv34vEXo07znT5AkAJ4P2QBIj4lMwQ7zEEALFqdzi2swT 6XPYobFal5slxyaRFOUvCRW/IQW5JneSIVX5sz6Gds8sKbOYEbFWJElhcvH80Gji FmURwYJCT1Ey+I0/x/T/n/CF37i9V+KILsdE2Dn4P2m7xWb9fuo/zoAmvKzJK4Fn sDlY1R/bZi8OEE9aQOWCVchXMtyOok2U3WRaoo+ZbV82aqfpe5wzNSlYHFaaNlda t2IzK7/qNNaICzHnN4jzPN/0i6bjE7QRadt32kWiMmGg5Fw27f9ZIGtvhsbpBtTf gQS60k4pF2s9dtSOSZ6E0/bOB/hGHc6Sa6wdS2dZWXeK8nU87ofHTkvgtyWisp0e TdrUMjPx/k7hGxIKFf1IQk4EUOmkT8sxD+lwZRhcBnTSQ7pk3b8=
URLs

  • http://decryptor.cc/8248CE6B6B71FD99

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8248CE6B6B71FD99

Extracted

Family

  • sodinokibi

Botnet

  • $2a$10$zupG05iZsc8Vl3ZtF9hA0OjTCPWMA2hOglYUFNMMgRsYJSJCSROJe

Campaign

  • 3545

C2

  • kojima-shihou.com

  • 4net.guru

  • promesapuertorico.com

  • truenyc.co

  • longislandelderlaw.com

  • waywithwords.net

  • insp.bi

  • candyhouseusa.com

  • stopilhan.com

  • dsl-ip.de

  • purposeadvisorsolutions.com

  • despedidascostablanca.es

  • wari.com.pe

  • panelsandwichmadrid.es

  • tennisclubetten.nl

  • dirittosanitario.biz

  • softsproductkey.com

  • vibehouse.rw

  • bauertree.com

  • portoesdofarrobo.com

Attributes
  • net

    true

  • pid

    $2a$10$zupG05iZsc8Vl3ZtF9hA0OjTCPWMA2hOglYUFNMMgRsYJSJCSROJe

  • prc

    sql

    outlook

    thunderbird

    ocomm

    powerpnt

    mydesktopqos

    mspub

    onenote

    oracle

    winword

    dbsnmp

    tbirdconfig

    sqbcoreservice

    isqlplussvc

    wordpad

    agntsvc

    mydesktopservice

    dbeng50

    visio

    synctime

    ocssd

    xfssvccon

    encsvc

    excel

    steam

    infopath

    thebat

    ocautoupds

    msaccess

    firefox

  • ransom_oneliner

    ...ALL YOUR FILES ARE BLOCKED AND MAY BE LOST SOON... Urgently find: ATTENTION-{EXT}-README.txt in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!

  • ransom_template

    Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "{EXT}". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay BITCOINS to get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}

  • sub

    3545

  • svc

    vss

    sophos

    veeam

    sql

    mepocs

    svc$

    memtas

    backup

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4de36756490f54e1890ea95e057f5fbcc9e01cd4db9fe766b99550ffcc315813.exe
    "C:\Users\Admin\AppData\Local\Temp\4de36756490f54e1890ea95e057f5fbcc9e01cd4db9fe766b99550ffcc315813.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Users\Admin\AppData\Local\Temp\4de36756490f54e1890ea95e057f5fbcc9e01cd4db9fe766b99550ffcc315813.exe
      "C:\Users\Admin\AppData\Local\Temp\4de36756490f54e1890ea95e057f5fbcc9e01cd4db9fe766b99550ffcc315813.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4264
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1424
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:5036
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4464
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:620

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/1424-130-0x000001D8E0530000-0x000001D8E0540000-memory.dmp
            Download

            memory/1424-131-0x000001D8E0590000-0x000001D8E05A0000-memory.dmp
            Download

            memory/1424-132-0x000001D8E3270000-0x000001D8E3274000-memory.dmp
            Download

            memory/1636-137-0x0000000000400000-0x000000000042C000-memory.dmp
            Download

            memory/1636-134-0x0000000000400000-0x000000000042C000-memory.dmp
            Download

            memory/3488-136-0x00000000001C0000-0x00000000001EB000-memory.dmp
            Download

            memory/3488-135-0x0000000000DA8000-0x0000000000DC8000-memory.dmp
            Download

            memory/3488-133-0x0000000000DA8000-0x0000000000DC8000-memory.dmp
            Download

            memory/4264-138-0x0000023B4A6E0000-0x0000023B4A702000-memory.dmp
            Download

            memory/4264-139-0x00007FFF87B33000-0x00007FFF87B35000-memory.dmp
            Download

            memory/4264-140-0x0000023B4A6D0000-0x0000023B4A6D2000-memory.dmp
            Download

            memory/4264-141-0x0000023B4A6D3000-0x0000023B4A6D5000-memory.dmp
            Download

            memory/4264-142-0x0000023B4A6D6000-0x0000023B4A6D8000-memory.dmp
            Download