Overview

overview

10

Static

static

10

DomainName.bin.exe

windows7-x64

1

DomainName.bin.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-03-2023 19:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DomainName.bin.exe

  • Size

    120KB

  • MD5

    af94ccb62f97700115a219c4b7626d22

  • SHA1

    bb67edcfe4e5b6fe09ee96e5b8ace7a4cfe39eb7

  • SHA256

    2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c

  • SHA512

    08c05f8dc98aba168734732d043c3e403f531522e0ec0ec64484d15375f353aa23f9654852ad2c54a3e6b2a9344f4ffb553cac24455f62bb65b55800e311c12a

  • SSDEEP

    1536:J8A4krBJLarHZZd/M4PI8iwplAXpzK88ICS4Aer9DIPcG5zXbwMcClFyFfjRto2C:+/LPrlAZZE0cOzbwMflEBPo

Score
10/10
sodinokibipersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Recovery\lbqnh-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension lbqnh. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/67E8A2017A072ECF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/67E8A2017A072ECF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: PFwCeJwcW5UD1bPySdcCAtU+sIOXbV0FBdiTMvA5gbuN8HPY4sYfpFWDXgpyBJAz DOfOcyLdwDHGgXhP5fIR6sE3Fo9f4Do0o/Ak4jpQIXQdx/2ElPZz8jTZxg/4K7u5 CMRHoEWY7ldzfqGn8zbeK4p+1FTI/l20JEZn1Of4FFro1AEWV+0aYMV4rv6+q8p1 XWPosrLMYGP+znPOqMFvXl4vqkQn1nkVOVPSYEHHM8kSuvDA2l6Il1tQhl7rSwqo 1+VnCefxgb/WttdZ9BhGkAOUrpkDChJ8J9Y7Tyewv1W/iJq9GLk/sfwfrIpBtony MqMh6IFi3w+CpNoUSRfBlcZEXcnInJz5d2rIPYHyv0087DrP8q+nbgGGz20s4L2h Kzg9CPikr8D40e9xnaMjU2ppg5mNeMo3Hy8udSepJNoq2p6LykCCJuDRafgjiW/N tc/uWLInmYYEhNfQ54NcWVKDpiuqN3CcOZARR/idfGbwxDisN2Pwu+jfDuk4SeSZ YxR8Hle9DcLtCjwqauq60yhY9fgD4Rt5r69ov/W2tF+0eFVygboEV7yLZ+8Fsj7H jLwNvfpnz7Q1vE71L5k9wvfucYHOjMVJH/anl1v0peIaM767CNSySfU+p+eTYwuc EDXFAQiODFB+Gy0ug36W7YI1biXO+8J5Wj7TZL767zPhvqyxqk5MzJk/xzIvoNjJ N59kovXDSoy13zwRzwO+hK1fTcW0s2RN86E5P9cqDxF5bQKdgd2xaVHZGBFAiUFP ZJtseslVrVNr2mIkAUk1MKCN4XcU1dkltm8ZJ4Q4Eg3EcFGDL2A/UbgQ5hpJzKVe wSPQ8mgpfyxINTxS7C2czTQgohStznldZ55tO9cqov3eM1m6mDy1h0ufxGnglb6b uUJe4ocXNm5qlIFf4g5Q57+MdNXuePXkUQy6Ym8Kj2WM4pDqFa9txtmtZrktZ0nq 0jU0A+0RPwwQpWKGX6IEdXkDt7GEsyr2CMzPU5ah7VcvHl7bTl5tLVCdTqRjszic gBD9LCiNfviIp/AlISTJUv5WXlfxs9mX+J20cZ2qYeTgGGeAmJPqvsmit59Qj08x S6QgPpOq/coM5QpU1ZUHV3nNCHj5Fw49lB7/Mdrv6Lvr/ELrcUtehHVNxqSOoj/x prYwIaCanqWUYrg/PuqsRkOY1JMQ3V2Lxbukp/1h01/U9a95zQfu4bdCmrPKSHN1 d6KNX3oa8EOMdm3EdF35s7V8sHmq5b2kpknbrFBSUXI7KtO/YeuLJ9K0OMVFfCKT Mov4ehCBKQ/tq4ENUwuDJ3mo ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/67E8A2017A072ECF

http://decoder.re/67E8A2017A072ECF

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\DomainName.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\DomainName.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:364
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:208
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3112

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\lbqnh-readme.txt
      Filesize

      7KB

      MD5

      9603c72c8f8ca39ed064cc219a938341

      SHA1

      1bacb7c52da52d8503e4b00299e4ca05238905aa

      SHA256

      c39466899ba707625e1fde9bc76647deee093528f2e3603ed39c9b7e1330df8c

      SHA512

      d12e71bf3a41b2e4c65575ea976106cbe32803e00713774a9e0da778959c0e8df2065a7dbcc2413857ebb10b5144b6710d899c2a54660d0ae2ec84b193641f40

      Download Submit