Analysis
-
max time kernel
44s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 02:46
General
-
Target
b9a04a0aa16ca1e5b2190b0f9e93dcf96059ae3fd08a3b245e29f4e6ace82618.exe
-
Size
206KB
-
MD5
8fb991c5001d197b20d0c659d71ce6b9
-
SHA1
ae5320034f50180d0b4e4ac7134365699d71d410
-
SHA256
b9a04a0aa16ca1e5b2190b0f9e93dcf96059ae3fd08a3b245e29f4e6ace82618
-
SHA512
b2e009d9ee6682ce2fd8d434b802f45e510925e811ba9b6673cf5294741b64763c53e54d2e2ebb67fa9e50ba42925d4df15ae2930898bf4e4a091f0f44174720
Malware Config
Extracted
sodinokibi
19
2847
fotoslubna.com
geoweb.software
boyfriendsgoal.site
thegrinningmanmusical.com
brannbornfastigheter.se
buzzneakers.com
bagaholics.in
leopoldineroux.com
endstarvation.com
leadforensics.com
palmecophilippines.com
pureelements.nl
innovationgames-brabant.nl
jalkapuu.net
tetameble.pl
jax-interim-and-projectmanagement.com
bundan.com
encounter-p.net
ownidentity.com
eastgrinsteadwingchun.com
-
net
true
-
pid
19
-
prc
powerpnt
dbsnmp
thunderbird
ocautoupds
ocssd
sqbcoreservice
encsvc
mydesktopservice
tbirdconfig
synctime
outlook
steam
dbeng50
winword
thebat
isqlplussvc
ocomm
visio
mydesktopqos
msaccess
agntsvc
excel
mspub
onenote
sql
oracle
infopath
wordpad
xfssvccon
firefox
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2847
-
svc
mepocs
veeam
sophos
svc$
vss
backup
sql
memtas
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9a04a0aa16ca1e5b2190b0f9e93dcf96059ae3fd08a3b245e29f4e6ace82618.exe"C:\Users\Admin\AppData\Local\Temp\b9a04a0aa16ca1e5b2190b0f9e93dcf96059ae3fd08a3b245e29f4e6ace82618.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\b9a04a0aa16ca1e5b2190b0f9e93dcf96059ae3fd08a3b245e29f4e6ace82618.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\b9a04a0aa16ca1e5b2190b0f9e93dcf96059ae3fd08a3b245e29f4e6ace82618.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\b9a04a0aa16ca1e5b2190b0f9e93dcf96059ae3fd08a3b245e29f4e6ace82618.exeFilesize
165KB
MD5baf8729cc740e48887b1d82292db2d9d
SHA1be5663be7cbd44f70eb7ddaedbce336e764ea103
SHA25668cace785ac03c96a1ddadf2d542167959fc322e5246b43df825d9331c0350cf
SHA51210af56293b37a2258543c37ec992a287b80083b1a8938294a3aad0fd5bcf4f4f24216c9640ed21da35527b17d6f1f50d1bbbc66eb34e08e4f754d1a237c63f6e
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEFilesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\b9a04a0aa16ca1e5b2190b0f9e93dcf96059ae3fd08a3b245e29f4e6ace82618.exeFilesize
165KB
MD5baf8729cc740e48887b1d82292db2d9d
SHA1be5663be7cbd44f70eb7ddaedbce336e764ea103
SHA25668cace785ac03c96a1ddadf2d542167959fc322e5246b43df825d9331c0350cf
SHA51210af56293b37a2258543c37ec992a287b80083b1a8938294a3aad0fd5bcf4f4f24216c9640ed21da35527b17d6f1f50d1bbbc66eb34e08e4f754d1a237c63f6e
-
\Users\Admin\AppData\Local\Temp\3582-490\b9a04a0aa16ca1e5b2190b0f9e93dcf96059ae3fd08a3b245e29f4e6ace82618.exeFilesize
165KB
MD5baf8729cc740e48887b1d82292db2d9d
SHA1be5663be7cbd44f70eb7ddaedbce336e764ea103
SHA25668cace785ac03c96a1ddadf2d542167959fc322e5246b43df825d9331c0350cf
SHA51210af56293b37a2258543c37ec992a287b80083b1a8938294a3aad0fd5bcf4f4f24216c9640ed21da35527b17d6f1f50d1bbbc66eb34e08e4f754d1a237c63f6e
-
memory/548-54-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/992-57-0x0000000000000000-mapping.dmp