Overview

overview

10

Static

static

bcdb6f903d...15.exe

windows7_x64

10

bcdb6f903d...15.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294188s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    05-03-2022 18:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815.exe

  • Size

    680KB

  • MD5

    d8c45725b2b0654be969ea1366e1994e

  • SHA1

    38feb428aa76ce397b33865cfd26a39bdbe3166c

  • SHA256

    bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815

  • SHA512

    3975f885b650830c9300ba05c38f45869172d88bf8e20a270a9543dc30c75ef8c329f61c99caab8e1688df7f520fe7cdb06804586ba497ca9e73b7536e8fe8f1

Score
10/10
sodinokibi73ransomwarespywarestealer

Malware Config

Extracted

Path

C:\Recovery\12m121-HOW-TO-DECRYPT.txt

Ransom Note
--=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 12m121. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7E446A02EB004011 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7E446A02EB004011 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XZbZjeawO+Hm3j1ZPkveasTph37JSC4sMnxAXxF5clMQ+7EF6GMJBw3ZGL7AB8eF Q2VeOy7n3v4XLCDELnU21/kOva0RyXFYgNNlYxgPe4z7TQ3R+2qvW661cY1NfNeC wmLqa0GKpS/JNSGXVfDhXE5gqvb0o894KGKmstce9Ual99kpi0OKU4Hdn25JAung vFMGUfLdwQuz54TNHsKRFAaYhgVdJZ77syLFXNUKJdjQMxnhRYKL2EN0oL267P4t 63BlD3Bmoq81XhuV2lgK6veeQt6Kp1M/l6RVvVP4kWWtpN4XTdXz9OONkR3OkDnn 2/BH3W/FhuyBeR3lpPARCUMUx98t3W9z/OSi687PZRJzNTaYv4o6qft+YhKq9kkT w1ytJyNWhpc1MR7AexA0HfObXTpyjRf2VN27InSz+vEMZb3AmJJXNFtRYhjgOppg mlJBsqQUqrZjJQMhWXYcokeqRSstgRyCET8ApsUfPKIBDR9Oswckc0WBs+TRhfSv LhuxA38umVpDHY0i8ssesvJSyllV2HhniEetkNQ9bcQ8YT3kMBDoAzJvLmrPWGRv T6GMEompGMtLrITdyt4uxQJaQVrmnXdoJ1Gamq+qwVXFA2bZzwQr9X1YzNhMkLXZ TbzCUe8bKcpwCx3/b6qB78ghKEQ+HQamiRWnJnIvu8dkG9EAhpXCUSRMkR2fk/pq YREQ6mLVZkOPKAT8eQlxGH5mpKFS9SE6cwCumXQQjt7cDb66uUzBC4clCR1db78h nMFRvn2ke4j3ofaZHRyMxec2AJnqWR0Xp7nMwExk2zCwgaBBo4Rmog6sN+4wCQ4n 81/hprdXu1ltc+9vVIQ6uagxhVGdL52rK9WmYodvwYNmd8vTlnvwSJ4vKpxRaX92 yk4i6P2IFOagAZKt2rMJy8jh0aRd8pM0RyHR8kZOl9p7X9MXjdkA9s70tWpEJB/n NpBRSO5OeG4WWy1g7kRl3cSpB90e2VNwCUZwl0dkip09dG5uCbCD1SxHQT57F1SR 79UsvFGvdGywuOnOPqknWjTElEf43+weUzguW/ugmuRkrc7E+jw0oyAI3dPP8yVv Fe6HZ9ERbJ6I0UiTPdM= Extension name: 12m121 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7E446A02EB004011

http://decryptor.top/7E446A02EB004011

Extracted

Family

sodinokibi

Botnet

7

Campaign

3

C2

cymru.futbol

altocontatto.net

rvside.com

noda.com.ua

christianscholz.de

wallflowersandrakes.com

tanatek.com

pinthelook.com

tastevirginia.com

campinglaforetdetesse.com

poems-for-the-soul.ch

k-zubki.ru

selected-minds.de

smarttourism.academy

the5thquestion.com

sochi-okna23.ru

osn.ro

suitesartemis.gr

efficiencyconsulting.es

kickittickets.com
Attributes
  • net

    true

  • pid

    7

  • prc

    mysql.exe

  • ransom_oneliner

    You are infected! Read {EXT}-HOW-TO-DECRYPT.txt!

  • ransom_template

    --=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815.exe
    "C:\Users\Admin\AppData\Local\Temp\bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:784
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1188-54-0x0000000074FF1000-0x0000000074FF3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1188-55-0x0000000000400000-0x00000000004AF000-memory.dmp
    Filesize

    700KB

    Download
  • memory/1188-56-0x0000000000580000-0x00000000005AB000-memory.dmp
    Filesize

    172KB

    Download