Overview

overview

10

Static

static

10

12b3e6349b...a9.exe

windows7_x64

10

12b3e6349b...a9.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294194s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    05-03-2022 20:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    12b3e6349b1f32152e8c903fffd163f9275c2d470e4ee872b9337086afcf63a9.exe

  • Size

    118KB

  • MD5

    807fa62cce09239af79a462c489825ca

  • SHA1

    ffa32ce56808c3a2dc29b0e2246ee1e60d9ed12e

  • SHA256

    12b3e6349b1f32152e8c903fffd163f9275c2d470e4ee872b9337086afcf63a9

  • SHA512

    46afd27ef450188de2ccdecd838cb9c8af0ed1c96a5d704805224a2714df784396831e1f05b3d10a7457dd292e32f27fef1f82982577af9714978c583d6f1f3f

Score
10/10
sodinokibipersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\s26zjyx4u-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension s26zjyx4u. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). CONFIDENTIAL DATA WAS EXFILTRATED! (SCREENSHOTS ON DEMAND) ALL YOUR DATA STORED ON OUR BULLETPROOF FILE SERVERS! IF YOU DECIDE NOT TO PAY, INCCIDENT WILL BE REPORT TO THE WORLD NEWS MASS MEDIA. YOUR FINANCE, CLIENTS AND PATIENTS DATA WILL BE SOLD ON BLACK MARKET! YOU WILL GET CLOUD CREDENTIALS WHERE YOUR DATA STORED AFTER PAYMENT. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/55FD095AC4FFAAB5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/55FD095AC4FFAAB5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WbV3kf0OkeVCYtddunjJLs12aTZPCahkNz8H3/lxjMXWzfZYyZPC83NuXTQjQe43 GY9zpJqt+2+cK0z7nqW1Dx9aUnP23mip7s05ZsnATgyb4+eWJU42TMWIL/N1Bwve RM2k+rJfgIRIw35QIjohdu4Hm1Twf7Coy1qBpfEwQajwtiZtgu7+O83ATOtF87uo tmSlpiMeeE8PtyyjObGbDeNCGVUpTRcLVTU177/WATXWk35lJ2qLORAqjkaxB3HF kEhxo9hKh08sWmYanmhZeWbui0kc8QHHBLiwXinf516R7oQ/v88Dkq5McYsXR9/P AY5bFpFJZIOimbJFcT2aAqiXnBrNpWlwALA/wRnsZbIQ2QR9YYcp2lxiCWbLehZL bAjA4oZJEBLU3yxmPM6wAHPhAdiSVlREYZHbPsZjHW4K/8M2cqScab+z3wRzwehz Fcu/azVTIhmB6Ou+620bpii1nJ+I893PIUMCZDnDhMyqrGeHpBFyPI5NsJLrerl2 7DMop6cNxtRMcHJOe5tgvtNyfRIRje5U/TXU6rEbaFLyFMxeTKyLF56S7B7hX/kd H6ORDph0cx1TNEZGBGBNz8aP1LYqSiEREYLa0D9b1E70TgQrNSwyQCa/+E+kOcS4 z6AiZWJVlferTOpPZ6qsKYKVrGTk9rp9PhdaSh/1Ja8Xyrmxgz4aoifYMguGmJZH JekOXZUNysahITn7ZKMFr3/qC2CwIOlrnU5jtYVpYE9QbeQDONlKGMY5s9/wISbC pcHJplXbdnhavRYhjmnzv1SlTJiGQydHokRT+gD7xaHnwyKs51lB78tpj0UxFWp/ jJSU8HA0A3ig0nRqvo2TwSWXCO1ktDVY4oghRxNeODroFLXKTnvlVKHK6lI4/uIJ ZRaOuxwIfcfQ2txEfHDjkAxbnhdr5QEvb4SiE+c94giRx1TRyqPl5L+DDTa7B6J3 aaBx5LpRvLBh7yt62OKlATvfbFzGziEazrpymi+9NHE6ENJ8sUhoOWrKXbrz/Az0 +OZRXJ7bpKhKPDxSFYCVhfivgouQuCWxN4MOcB1SNKF+6sWzPYgo0iwi6Imu77XM drenKhjUV31qFpxBv3lpbyCFzfrmZFKOqBh954zoXpkt1n2AWN28AOmZwDfchfsf 6haplzwX4uuewQuybWN12+xhY3XWpXU3jlw7SNYdH8qIAWEGKrUx/7GwFkGeJt35 Q+Er1U+h+a14GwJClc3rnvqripljI6Z6RdAzy6KmNB5fUoaYbWDt7BuVMWPk8eLh N5h8E99+LGcbU9KK7jcDmPcPRiu+YXtlhU+DyNj2 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/55FD095AC4FFAAB5

http://decryptor.cc/55FD095AC4FFAAB5

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 25 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12b3e6349b1f32152e8c903fffd163f9275c2d470e4ee872b9337086afcf63a9.exe
    "C:\Users\Admin\AppData\Local\Temp\12b3e6349b1f32152e8c903fffd163f9275c2d470e4ee872b9337086afcf63a9.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1104
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:868
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1128

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1104-54-0x0000000076A01000-0x0000000076A03000-memory.dmp
      Filesize

      8KB

      Download