Analysis
-
max time kernel
96s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 06:27
General
-
Target
95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab.exe
-
Size
205KB
-
MD5
44ff381ecebea1fe136af55f3200417c
-
SHA1
83fb890c3baf5dbe0ae06621fd363fbbbf219c2c
-
SHA256
95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab
-
SHA512
7273f23a314e09d3f4726f0ef3f7e59ea0dd02f3e2fb4df4b45932f7ea5180e98c77416f2254cf7b4eabb5a82351a6b97976bbc6fcfd86b2d99dd1928aba7c6c
Malware Config
Extracted
sodinokibi
19
1428
centuryvisionglobal.com
rivermusic.nl
tastevirginia.com
rentingwell.com
irizar.com
hepishopping.com
osn.ro
raeoflightmusic.com
kellengatton.com
leijstrom.com
gurutechnologies.net
laylavalentine.com
kookooo.com
eyedoctordallas.com
artvark.nl
ownidentity.com
goddardleadership.org
sharonalbrightdds.com
hekecrm.com
rename.kz
-
net
true
-
pid
19
-
prc
sqbcoreservice
msftesql
ocssd
infopath
mysqld_nt
dbsnmp
powerpnt
encsvc
isqlplussvc
mydesktopqos
steam
onenote
tbirdconfig
sqlservr
agntsvc
sqlwriter
thunderbird
xfssvccon
thebat
synctime
mspub
firefoxconfig
dbeng50
ocautoupds
ocomm
wordpad
winword
excel
visio
mydesktopservice
outlook
thebat64
sqlbrowser
mysqld
oracle
sqlagent
mysqld_opt
msaccess
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1428
-
svc
svc$
backup
vss
mepocs
sophos
sql
memtas
veeam
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab.exe"C:\Users\Admin\AppData\Local\Temp\95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab.exeFilesize
164KB
MD5b8578de47a8ce9d71d6227507792dfbd
SHA1823e951374795a7e365bc9c0f2e435e113e6662b
SHA25694aebcb7c2b2bcf51a848f0b24a6b14f3190bf95e413d16464e8839cce04064a
SHA5121cfa937f58c78b173f026d83cb5cf7e3838b6699cc8dc48af9c00cf71495b80211cac3482645f8d4fc89bf2caf7006f25dd07808681b251a89be507c04b9eef8
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEFilesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab.exeFilesize
164KB
MD5b8578de47a8ce9d71d6227507792dfbd
SHA1823e951374795a7e365bc9c0f2e435e113e6662b
SHA25694aebcb7c2b2bcf51a848f0b24a6b14f3190bf95e413d16464e8839cce04064a
SHA5121cfa937f58c78b173f026d83cb5cf7e3838b6699cc8dc48af9c00cf71495b80211cac3482645f8d4fc89bf2caf7006f25dd07808681b251a89be507c04b9eef8
-
\Users\Admin\AppData\Local\Temp\3582-490\95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab.exeFilesize
164KB
MD5b8578de47a8ce9d71d6227507792dfbd
SHA1823e951374795a7e365bc9c0f2e435e113e6662b
SHA25694aebcb7c2b2bcf51a848f0b24a6b14f3190bf95e413d16464e8839cce04064a
SHA5121cfa937f58c78b173f026d83cb5cf7e3838b6699cc8dc48af9c00cf71495b80211cac3482645f8d4fc89bf2caf7006f25dd07808681b251a89be507c04b9eef8
-
memory/916-57-0x0000000000000000-mapping.dmp
-
memory/1892-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB