Resubmissions
30-09-2024 21:45
240930-1l2rsazhpg 1015-09-2024 22:03
240915-1yl7vsvbpf 1015-09-2024 20:03
240915-ystcwa1elr 1020-08-2024 16:21
240820-ttt9cawalj 1024-06-2024 04:58
240624-fmba1a1djm 10Analysis
-
max time kernel
52s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
10-10-2023 00:01
General
-
Target
v2.exe
-
Size
121KB
-
MD5
944ed18066724dc6ca3fb3d72e4b9bdf
-
SHA1
1a19c8793cd783a5bb89777f5bc09e580f97ce29
-
SHA256
74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
-
SHA512
a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3
-
SSDEEP
1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY
Malware Config
Extracted
C:\ProgramData\8mj3kuir9-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1D62A34D9CBF563B
http://decoder.re/1D62A34D9CBF563B
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 18 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\8mj3kuir9-readme.txt1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD50b3fe28f4319c0e67db46472a92c7bdc
SHA1b86c69cfbcbf35a76c7c72596db334e554a9d444
SHA25600c408448b87513d0264f6b48f51041037e19692956cc73fdef8ecd3fe31e648
SHA512cf1521ed747dab9ae4d89d67910a84f11978e1ce2addbba2501acde4b1a5139e043577a0fe86e45ab1866960a52e9f5b558e4da522e609b7690dfc927c751464
-
Filesize
7KB
MD50b3fe28f4319c0e67db46472a92c7bdc
SHA1b86c69cfbcbf35a76c7c72596db334e554a9d444
SHA25600c408448b87513d0264f6b48f51041037e19692956cc73fdef8ecd3fe31e648
SHA512cf1521ed747dab9ae4d89d67910a84f11978e1ce2addbba2501acde4b1a5139e043577a0fe86e45ab1866960a52e9f5b558e4da522e609b7690dfc927c751464