Overview

overview

10

Static

static

10

ecac12520e...97.exe

windows7_x64

10

ecac12520e...97.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    1796s
  • max time network
    1799s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    11-05-2022 05:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecac12520eaa08addb97ed05c2ac1406d56e58eb422954b704ef5c5516e02397.exe

  • Size

    1.2MB

  • MD5

    8a18fa2696f31992ef9bb3a971724f29

  • SHA1

    5aa9a303eedb9d0a6f0dc5d6c78ccd90b1e6852f

  • SHA256

    ecac12520eaa08addb97ed05c2ac1406d56e58eb422954b704ef5c5516e02397

  • SHA512

    29739792b87432f7aa065a99bcbe613e91edc3957ea0742f98bc7a3b44773a56b6c49c8b844cd1353b9172c2970c0b07767b8b9ea5157457c8bac2e1b18795e4

Score
10/10
sodinokibiransomwarespywarestealersuricata

Malware Config

Extracted

Path

C:\odt\p9836f4476-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion p9836f4476. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/72872CA1B3B79513 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/72872CA1B3B79513 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: kLFBkfxNlYjw+GwTJnIboHIdiTc/R2ux0gHiS3mDceOJN6Kh79KeHEaKTAzloH2J 9YzO682UeV8U4rjMozkRcwh1Jv9JqNr+jrHGHODnl8xsnDViRdMzAWcio3uenf/Z DqiKccXwsYMkLcwHei5yhsJkXpaTmSRoVsTmclkuQmMs+zNKkc10GGzQwYEblNIK Fh+Rb3RftzE67YTuAte6dYnjEQvcG8Sm6J3PZXe/wRZ5IrTK65w+/ROBcmE01V7D PaSVcSngaJGuyufy8lW0eb52vViecF4+RBaJQz7Lmo5ZohJN8keQmgwzA6xL8URs pShl1pRT1DrILjFro1O95Z1zcxzIL4zLs2D62FgDUfbzG8vDnuazYpCltYBRnKkZ 3FTV59PZHARzJjZ0It8r+TCLgCWEeIQg056e01p6iqigYjMZnDGXKRtTivlPOhO3 j6eekGuytVpjcKDxxy55mpJ9OuyZLZPtO8+/vyBCrNPtgqy4PmRyl/clysqj10Yw r9hhpf3fxtRn8egx3EfFpzB9a8wc7HgINhQ2CRCEYOamrbvqN6CigDwz0Rwain8/ 5S7XMUAMeSMxTosYlXLbm0x1wxMp6dpfNH4s98gjMDE1ti7QrzUsnzz7alocwg0M V+eMR2DIo8rL4WdqGxdkPDmelvoTDJCPygUZOoWZxYg656EFREJ4E8XpR4jI/ev+ PuzR5qWJF6Q9wwNJCoU7V/dHs0qQizkPCCdyidG2vgpuLR+3/ymS5UWBcSDV/Lap gdBrjggObbQQVf/uNaytroWacVrouBrKuxHIaFj163B/s//2uLhTwFmBh5li3AIw KVjYbFeM8LRbY9IXNQmmp3WRyKu+Ma+aIsWgkpgokm4ze0qimseKpli84W++oo+1 ZbkAarvRdrYD6vZE3Ex+a9VHxPzhQn62o4/Bmr/x4Ht4ls8Zgw87ymLJHLiEOVYh 9Pl+kCioKBbV9AggM7uB+6tNYopCN+sZV7onsV6ibbDImPuBGfvqqRtqGNzjiEi/ vTEuyXRdXKJubAhsqog9Db9J3VsaFiK+p71Jhwprri/eEiffecbe7XUr7LnW5RHz 4VjMerrwwMW26ql2GsXrcSI/rCaNlcra Extension name: p9836f4476 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/72872CA1B3B79513

http://decryptor.top/72872CA1B3B79513

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • suricata: ET MALWARE Self-Signed Cert Observed in Various Zbot Strains

    suricata: ET MALWARE Self-Signed Cert Observed in Various Zbot Strains

    suricata
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecac12520eaa08addb97ed05c2ac1406d56e58eb422954b704ef5c5516e02397.exe
    "C:\Users\Admin\AppData\Local\Temp\ecac12520eaa08addb97ed05c2ac1406d56e58eb422954b704ef5c5516e02397.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
        PID:3292

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    3
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3292-130-0x0000000000000000-mapping.dmp
      Download