Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
17-11-2023 15:57
Behavioral task
behavioral1
Sample
NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe
-
Size
164KB
-
MD5
17d54fde8f0dca439f4c32a02598e382
-
SHA1
5eb54861db41b62e9fa296f703f06b8e52d1941d
-
SHA256
5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c
-
SHA512
09473f8ad9cd0d614d4a6fed4f7c34bba89f4a3e8cd0a350870e716b1f499d0d99f25ea436b13512094bf2f56178d5f9ffa8c74ad125c4c61e6aaba7b2a814b5
-
SSDEEP
3072:ffYWjswg4fQlt4ndm8jX5IXzs+M9VQHDOVFI0kmit3:ffYWAw9fcUdmwIXo+M9VQHDlZmit
Malware Config
Extracted
C:\Users\w4drf6-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5DB33878E645471B
http://decryptor.top/5DB33878E645471B
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exedescription ioc process File opened (read-only) \??\G: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\H: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\P: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\X: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\D: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\B: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\M: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\N: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\Q: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\R: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\A: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\V: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\W: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\F: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\I: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\J: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\K: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\S: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\Y: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\O: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\L: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\T: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\U: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\E: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened (read-only) \??\Z: NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2jd.bmp" NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe -
Drops file in Program Files directory 41 IoCs
Processes:
NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exedescription ioc process File opened for modification \??\c:\program files\SubmitProtect.3gp NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\UnprotectResume.tmp NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\DisconnectShow.nfo NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\ReadUse.vsw NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\RestartEnter.MTS NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\BlockFormat.ppsm NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\PopTrace.wmv NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\SelectReset.vstx NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\EnablePing.mov NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\RevokeComplete.mp4 NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\EditUndo.7z NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\SaveTest.jpeg NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\SendDeny.crw NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\SuspendWatch.mp4v NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File created \??\c:\program files\w4drf6-readme.txt NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File created \??\c:\program files (x86)\w4drf6-readme.txt NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\ConvertFromSet.m1v NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\OpenDisconnect.shtml NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\ResumeUnprotect.htm NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\RevokeJoin.mpg NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\TraceUpdate.wdp NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\CheckpointClear.rar NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\ExpandTrace.css NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\GetRead.dib NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\ClearSave.emf NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\EnterSkip.search-ms NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\PublishGrant.svgz NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\RenameSuspend.clr NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\ShowStop.xml NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\UnlockCopy.dotx NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\w4drf6-readme.txt NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\CompleteTrace.vssm NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\ExitExport.avi NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\GrantProtect.png NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\RemoveSet.snd NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\SetJoin.wmf NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\w4drf6-readme.txt NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\w4drf6-readme.txt NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\AddDismount.htm NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\DenyInvoke.midi NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe File opened for modification \??\c:\program files\JoinApprove.tiff NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exepowershell.exepid process 2560 NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe 1060 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1060 powershell.exe Token: SeBackupPrivilege 3008 vssvc.exe Token: SeRestorePrivilege 3008 vssvc.exe Token: SeAuditPrivilege 3008 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exedescription pid process target process PID 2560 wrote to memory of 1060 2560 NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe powershell.exe PID 2560 wrote to memory of 1060 2560 NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe powershell.exe PID 2560 wrote to memory of 1060 2560 NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe powershell.exe PID 2560 wrote to memory of 1060 2560 NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe powershell.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\w4drf6-readme.txtFilesize
6KB
MD5ac7a623ed6e79a71942a84364a1569fd
SHA163bc458de203b995a581cc06397c7d2a5d7eb714
SHA256675a721dd6700f92ae91f4f6d532b4757fa108bbf1feb3c50fee29e542414c58
SHA512a6bf587cb6b2b44aa1b87ef99b08bd6baadee1b35d9568fe75bc9bf4b9aa2caaa922b897b7d664ee419901905d7cd34e09eb635a335e3936edc3d37be4a1066d
-
memory/1060-4-0x000000001B430000-0x000000001B712000-memory.dmpFilesize
2.9MB
-
memory/1060-5-0x0000000002010000-0x0000000002018000-memory.dmpFilesize
32KB
-
memory/1060-6-0x000007FEF57A0000-0x000007FEF613D000-memory.dmpFilesize
9.6MB
-
memory/1060-7-0x00000000029D0000-0x0000000002A50000-memory.dmpFilesize
512KB
-
memory/1060-8-0x00000000029D0000-0x0000000002A50000-memory.dmpFilesize
512KB
-
memory/1060-9-0x00000000029D0000-0x0000000002A50000-memory.dmpFilesize
512KB
-
memory/1060-10-0x000007FEF57A0000-0x000007FEF613D000-memory.dmpFilesize
9.6MB
-
memory/1060-11-0x000007FEF57A0000-0x000007FEF613D000-memory.dmpFilesize
9.6MB