Overview

overview

10

Static

static

10

1bb894b7a8...92.exe

windows7_x64

1

1bb894b7a8...92.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    07-06-2022 17:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1bb894b7a8742c7ec6d28fbea08713f842aca4fe6d90a5a5d87c1b247da90f92.exe

  • Size

    164KB

  • MD5

    af93df4d11d547ac7b4f829487eda638

  • SHA1

    573688ef2515b6bb2f07263e98b1fd143eb20c54

  • SHA256

    1bb894b7a8742c7ec6d28fbea08713f842aca4fe6d90a5a5d87c1b247da90f92

  • SHA512

    bd22ffd9251bac4fc39bf1c3e97bbf2350bae1a6bfc9efd626a1d798b48db4c56aa3e0ac2cdeab10eb62387da26bd0c221b1032e770515f01cf368fd93f3c1b4

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\59o937942t-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 59o937942t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EDA38C24453330A3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/EDA38C24453330A3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tSYDMsmo+chJAuGauQZtd07wbSAUQXeJnFWqo5VqI1mrDor4udVppt01C3V3uLPs OZrS9q6RjS+0z87txHnoO0nuLN7qW/HVCROyooXcJunR+gXsB/sl9R8OxAcAmmpy KHbscaZKr3PN6wQiwhbtZ5bYCzkGKhAgEZ47fgVaLcyVP9e9xKkxDDcqliOQx7FN kjsMgy7fh4tvUN0E+L5Dk4L8pM6TK6GaYrsDfb78QHa8urjjQKd7FOzZnAGormof t98uR6o+p3Z4Nf2Vp6PNsNQ8dAWk8o3uNb1x2T+HObMFg/FfY7aOgS49ZTxDVet1 tIcSaUYtgvTcqkMlYnmwGAbQT/u8u2w/R7jgadWPAEBLVFx23bV+fiMVd9z3ArtA UcAIoBx/WVOzLXkSGXsIz0WlwegZlN4f4Kw7yY4YBeG0Zsk0FDLNyCtzzgnxxjOO I7SbF7waap4wjmKtjpXe1KNx3ua+MFJgEur9sQ7wOemYm5NtSShjPugzUBhNpeSu 1q5WCIFI8W3Xcz0TMl9uaq12rZdli8dCkgmggAuw9lFaaYzyupOP4t+JyQGQfNO0 W6+zgssfQGE0tLkbkBFhbb389jqCCK5yZVGa+2k+37hRR9rBUEjIYBlDwrxAKNpO FtEKVIiOMHrR4adh6KCNMmb+sJASiCyhhAHAg4LwILxlqfZm7J9b29Jt/pBsDuQN kFua7o46fZISowG3cG2vF8OBMI/h6MvR0eNwr0GX064jmqiBGrJ/5uoK3HbitHsP HbU7iisr3BahLm5Qewt8uAxR/vZQSn3tgy2rGA+gaoI5pafs+xCwlUgRHeIoK51G RcBuJW0M5Q+y7Ao3ZoQ1mweubAK1Zqq6k5qOkNng/zt6HVo5N7en0grOMSgCXZOA ArQyy0s0Zcz7gdllhCj6FhgM0fJWsKou2Zyjs6+xCuvWqkz7F2gvBdPEZVeSSz+2 rjIOcOxKkoNIg0S3MGu+L+a5DLxWIAr5gEskuvXrdToii7EXVbk8Rifi/R2QA3R1 I0MP5k6AXFCOSOT6E0d00MF7IieU7dH9wYtiCusBt6qPDkS9W7h1soru1gxbIGo6 uyxR+gYT9/tK+IhjuEn9gsL6yo0+yyvemdUv7GmPn9Amx7Ck8DPDlUhvw+FdGu3t 4/aGHQXxdkR+ucsyhNc= Extension name: 59o937942t ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EDA38C24453330A3

http://decryptor.top/EDA38C24453330A3

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bb894b7a8742c7ec6d28fbea08713f842aca4fe6d90a5a5d87c1b247da90f92.exe
    "C:\Users\Admin\AppData\Local\Temp\1bb894b7a8742c7ec6d28fbea08713f842aca4fe6d90a5a5d87c1b247da90f92.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3488
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4232
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4144

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3488-130-0x0000000000000000-mapping.dmp
      Download
    • memory/3488-131-0x000001EC5C610000-0x000001EC5C632000-memory.dmp
      Filesize

      136KB

      Download
    • memory/3488-132-0x00007FF89A910000-0x00007FF89B3D1000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/3488-133-0x00007FF89A910000-0x00007FF89B3D1000-memory.dmp
      Filesize

      10.8MB

      Download