Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
29-05-2022 21:36
Static task
static1
Behavioral task
behavioral1
Sample
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe
Resource
win10v2004-20220414-en
General
-
Target
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe
-
Size
164KB
-
MD5
c4f6fca09af28473aac8647fad42734e
-
SHA1
564f41f54b76b850491259cd71ab0ade9a6d18ac
-
SHA256
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018
-
SHA512
89f758dbbae7c8cec596343316e121b635b5268866517c7c754b3919b074bcc82cfc006851127662e978f0d234d91f0e061cd5449e29dfd38936fc4358cabf85
Malware Config
Extracted
C:\5e6n4ju1fb-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B233FEB532EDA2A
http://decryptor.top/8B233FEB532EDA2A
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exedescription ioc process File renamed C:\Users\Admin\Pictures\SetMove.tiff => \??\c:\users\admin\pictures\SetMove.tiff.5e6n4ju1fb 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File renamed C:\Users\Admin\Pictures\CompleteOptimize.tif => \??\c:\users\admin\pictures\CompleteOptimize.tif.5e6n4ju1fb 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File renamed C:\Users\Admin\Pictures\ConfirmBackup.tif => \??\c:\users\admin\pictures\ConfirmBackup.tif.5e6n4ju1fb 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\users\admin\pictures\SetMove.tiff 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\users\admin\pictures\SwitchGrant.tiff 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File renamed C:\Users\Admin\Pictures\ResizeRepair.crw => \??\c:\users\admin\pictures\ResizeRepair.crw.5e6n4ju1fb 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File renamed C:\Users\Admin\Pictures\OpenComplete.tif => \??\c:\users\admin\pictures\OpenComplete.tif.5e6n4ju1fb 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File renamed C:\Users\Admin\Pictures\RegisterExit.raw => \??\c:\users\admin\pictures\RegisterExit.raw.5e6n4ju1fb 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File renamed C:\Users\Admin\Pictures\SwitchGrant.tiff => \??\c:\users\admin\pictures\SwitchGrant.tiff.5e6n4ju1fb 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exedescription ioc process File opened (read-only) \??\A: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\G: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\L: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\O: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\T: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\X: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\I: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\J: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\M: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\R: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\V: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\Y: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\H: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\S: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\B: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\E: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\F: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\K: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\N: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\P: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\Q: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\U: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\W: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\Z: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened (read-only) \??\D: 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97o7818s1c39.bmp" 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe -
Drops file in Program Files directory 24 IoCs
Processes:
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exedescription ioc process File opened for modification \??\c:\program files\ResumeDisable.M2T 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\EditOpen.vbe 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\FormatUninstall.sql 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\MountConnect.m4a 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\ResizeFormat.mpp 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\LockTest.easmx 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\PopTest.wmf 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\SendSync.aifc 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\SubmitWatch.3gp 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File created \??\c:\program files (x86)\5e6n4ju1fb-readme.txt 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\CompleteDisconnect.rle 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\ConnectGrant.odt 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\ConvertToPush.xps 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\ProtectStep.dotm 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File created \??\c:\program files\5e6n4ju1fb-readme.txt 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\CompressSkip.iso 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\ConvertAdd.css 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\ExitShow.eprtx 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\StartGrant.mpv2 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\UnprotectRevoke.ttc 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\CopyCheckpoint.mhtml 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\ExpandOpen.cr2 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\ReceiveCompare.vst 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe File opened for modification \??\c:\program files\RestartUnpublish.pdf 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exepowershell.exepid process 2136 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe 2136 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe 1808 powershell.exe 1808 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1808 powershell.exe Token: SeBackupPrivilege 4520 vssvc.exe Token: SeRestorePrivilege 4520 vssvc.exe Token: SeAuditPrivilege 4520 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exedescription pid process target process PID 2136 wrote to memory of 1808 2136 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe powershell.exe PID 2136 wrote to memory of 1808 2136 0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe"C:\Users\Admin\AppData\Local\Temp\0d29becc6f92a5a1bdce5223867e13596d9dad5d37ef61a38701747e26e86018.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1808-130-0x0000000000000000-mapping.dmp
-
memory/1808-131-0x0000019EBB420000-0x0000019EBB442000-memory.dmpFilesize
136KB
-
memory/1808-132-0x00007FFA59180000-0x00007FFA59C41000-memory.dmpFilesize
10.8MB
-
memory/1808-133-0x00007FFA59180000-0x00007FFA59C41000-memory.dmpFilesize
10.8MB
-
memory/1808-134-0x00007FFA59180000-0x00007FFA59C41000-memory.dmpFilesize
10.8MB