Resubmissions

06-08-2023 21:23

230806-z8rpnacd47 10

06-08-2023 17:44

230806-wa5xvacf9s 10

General

  • Target

    d09338f3248b7c43b4c58274d453732fca910a0cee2ca50a2b72fe0364fb615c.exe

  • Size

    164KB

  • Sample

    230806-wa5xvacf9s

  • MD5

    6b391f91c63765876e2571e87fe46575

  • SHA1

    d508632ca452af6325c06434b29883cfa55d7948

  • SHA256

    d09338f3248b7c43b4c58274d453732fca910a0cee2ca50a2b72fe0364fb615c

  • SHA512

    2e1c522393b137d7847c405cdaa735a4255fde534c8006460ef1a984eacc135fd8668fbd756d06b9011299911c2fd57c1a9112d01c046ebe8c98058b1abfae34

  • SSDEEP

    3072:pEa2d8CfSXceqmPDu7lvspW0kAo0BQhyI0hQMnnsJ:5CqlPDuBkJpoQQgdnns

Malware Config

Extracted

Family

sodinokibi

Botnet

23

Campaign

2415

Decoy

carmel-york.com

daveystownhouse.com

lovcase.com

trivselsguide.dk

the5thquestion.com

housesofwa.com

dogsunlimitedguide.com

redpebblephotography.com

azerbaycanas.com

brighthillgroup.com

dinedrinkdetroit.com

patassociation.com

ntinasfiloxenia.gr

onlinetvgroup.com

mediahub.co.nz

memphishealthandwellness.com

four-ways.com

kellengatton.com

parentsandkids.com

jollity.hu

Attributes
  • net

    true

  • pid

    23

  • prc

    vxmon

    bedbh

    synctime

    vsnapvss

    pvlsvr

    mydesktopservice

    powerpnt

    mspub

    agntsvc

    oracle

    thunderbird

    infopath

    sql

    steam

    msaccess

    dbeng50

    xfssvccon

    benetns

    firefox

    bengien

    VeeamNFSSvc

    wordpad

    raw_agent_svc

    sqbcoreservice

    beserver

    outlook

    EnterpriseClient

    visio

    excel

    ocssd

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2415

  • svc

    VeeamDeploymentService

    BackupExecRPCService

    VeeamTransportSvc

    stc_raw_agent

    VSNAPVSS

    BackupExecAgentAccelerator

    BackupExecVSSProvider

    MVArmor

    BackupExecJobEngine

    MSExchange

    sophos

    AcronisAgent

    svc$

    vss

    PDVFSService

    WSBExchange

    AcrSch2Svc

    veeam

    BackupExecAgentBrowser

    MSExchange$

    BackupExecDiveciMediaService

    CAARCUpdateSvc

    CASAD2DWebSvc

    VeeamNFSSvc

    sql

    mepocs

    backup

    memtas

    MSSQL$

    ARSM

Extracted

Path

C:\Users\z3v8ehu8p-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension z3v8ehu8p. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A06978159654F0E9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/A06978159654F0E9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LkINV1puwV+WjHcfU6kcQPKklWzh29Vix3i01LJau3ejPio2HVw9C0z3gU+7F7Uy XvKIG1adNidJax6QWLqyNs0z9RbOqhqxvu/a1Fj12qemcWpQET5gQqnTlwFRRc0q avSdeGHZTOPyDstVldk/YmR8YUzkJ6ST5PsR2HMtotM+kesuWJSRzbFMTWEqBg26 vIa+GMMoKEb+OLhaWM5zwkowxjeROjDGpGiheIF7569hn7f9aClR0VAj9BLZr9+j 4tO7HWytDZ23OPFjgQpTS/AQjJhYwQqVFKEGGXY5KmjO1+3dsL4+aa3ZGvyaDLS/ g2KA2kmbkwOAKLmeuZMN7abOKkmXOR6apbpqve+0TWbC5rE9o1AIWsqMAacdAKY3 Sui4bxwBfDzYOYNfJa1vtl0xOTHaJUuoYUXk4HYWILggn5KwVQmhP8Kd0cq3Ithu UDCUR0Ed8cB2bNa8jr7NXeLcy7894AN2GfkjBe3HE9rUDew8fVlpRpal0TksttLr sYLBLA6dkfkxc4sB6VBLOWjO+AVb53HBKvZEa0I1ZhwWsUtK6pDuxcquW1hLiUjV 0RHDoKbkxIZ52Fsc0Tvf+f86YUUjnUjp1LvEZiN5+afooaYprW8To2Mc0B11z4D7 iOZSKntH2WkBaGlku5ld9RTSquUkLm8BRWySmQyLYDxNMgw+zaBAo0ngfW+SZ4iB uxU0GB+2Tjn5ef6A/Xd4Q6LOzBLU2Ma3veTLmmwJKf/6mWGNUZLOTAl607B2QEvw nE0rUbCAU5x0oZTxP8Zb7hHWQSnEaXbY6WemWXLquF69cLl7kQW0I5ddeSIEmCiN 1qtdYCq3LjW2ZEHVU7G+OOKh92h3Qbmt9uqLRjPIFsMWVE/S2hmO9dsgIcmr4ydf qTxrQDKek0LWSjbeyWGRbc+IYhgkc+5i3bCa9tLNGznzsCckSBTBqezu++HZ6lq1 qF/OOru80L0XS6TsrODofQVmee2LgQsAonOZuIXRg1BCla9E42u8Rei5OdBBTSUX MKGct1njF4oqCdt0cPbgrvNOQUY+FkrLYZczH82BJPvxCJpsYj8a49UBTlvz7p+d u8ul/l9++yOkCu+wlUz0IVWPMuXMa1gZVDp6HXm4KQ+e6o4ghFNIGsdQpvXEtWfG XoCTiuSeXZqIdrd7vrU18raVV2pUvozmX4Tgik5HvROVRgysBeW89GYcYFHnVsUU Se5R0gG8NI+PmiP8HAoErJSe Extension name: z3v8ehu8p ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A06978159654F0E9

http://decryptor.top/A06978159654F0E9

Extracted

Path

C:\Recovery\v3spnb24f-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension v3spnb24f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A77093FC9CB5ED99 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/A77093FC9CB5ED99 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Wig8KymjjTYCrs25Pg9xosEhciOFHUxsImi7vIOHa+ijuoeNgZaKlh6G5TbuijJX IHir4Bi/L09GZJZEutI4ooTQDFVGJCPUtqB+hsi1YAy0Jk4mdrOXR62yEkEDmWgX WiGzVFPN6bVWXjYHUBhRFKOCSEUnFYMrazrmL0NAEtjvjQZ+U0StDSXSTG9U97aB z513kt00Kg4nkykV3/Th08L6PHFNLniJVKH63aEy9sF4Kfwi7PiLgHmMs20Hy2HB LTDTX4OKC+Mq/9ky4Nwv3UT1gy08yiitT0+zqgYPrMd9dpEHp3umI3U8dHwgLU1v mzie9U2r7b5KSqrB56zC0iac2zFx09t4XFhN84WEychDJ2IZnlIw96AETQh+7KCE V7rlYuhKQdvIfUhhzjjBPilpLTLYsIfL2A6BEQlVdhvc5EYxyQ37Mr4PqvAu/Zy4 zuNUCHKngYwKGs81AcNik+Jn7vLPmv4Fhftq/bcn5pZrMQBV43n/ovyEz1GESlRJ eU84zyIcU3yzgki2YOLzTQAYUJYmH1WOSy59J310xM2WrfwBKWONw3cXHF3hFL4i C4RPQwj9CC2OdWxJLlHUSy9nF6yMXR5htMVb5QMGMJ9HRWzHeMDlNhwPAF54F8vd YZlqpyZKR2zeAZAC/NveJ2tMKpbb3g8aF+SFnxJZg934FlLiBlPiOyL0N/53swKI +X8vwg8GpXI1/cPpDMdDzKb42F0BAXu0wLcaV2CwX3QDGS6qE3hVJO34IImEgTWp kiXpo5dyTJZFPnwbMUxw14zWVH28JgIf1CVdyPf9C4cdWLMGbspgr5nnruHjqCQE EIs3qJhQK72pr462VCdO+rsyyPKczJl9Id7V1FW+IpZTxiYGIQgE1NSHtHL9BvLF 1Kacr6EpiECCZ85J77Cq/wOii/3Fv7WEYl5u516PGkkDHrGlCBLavwAodtZL9UPQ FTeE5cUYy55OMTUFNHIF7mUvxOVQ1CIZeQnnMoh6PPcAtDZ2WhWLahIngvGh47b9 7HNDFiL+acyn8zu+o7UisV5yPvuiO0xUIYwXwKkjZgTuVmYI16S6MxBTyIN8RAqt nHOCS7H03vbVegqNgeZmUoxIBPxWaai5pHUw70P9HXd2lJgPuzbHsensjRg2vsxF NYwWWB0eh1JmvMiiyl/hAE2IgFw5LIIiv0m71hsiKoVOjWRkK1FpN9iirtZ4rHIs MrYOLOuZhI4hsFs4Z3n7YlhlmUWj+mU8 Extension name: v3spnb24f ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A77093FC9CB5ED99

http://decryptor.top/A77093FC9CB5ED99

Targets

    • Target

      d09338f3248b7c43b4c58274d453732fca910a0cee2ca50a2b72fe0364fb615c.exe

    • Size

      164KB

    • MD5

      6b391f91c63765876e2571e87fe46575

    • SHA1

      d508632ca452af6325c06434b29883cfa55d7948

    • SHA256

      d09338f3248b7c43b4c58274d453732fca910a0cee2ca50a2b72fe0364fb615c

    • SHA512

      2e1c522393b137d7847c405cdaa735a4255fde534c8006460ef1a984eacc135fd8668fbd756d06b9011299911c2fd57c1a9112d01c046ebe8c98058b1abfae34

    • SSDEEP

      3072:pEa2d8CfSXceqmPDu7lvspW0kAo0BQhyI0hQMnnsJ:5CqlPDuBkJpoQQgdnns

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks