Overview

overview

10

Static

static

10

NEAS.5d9b7...7c.exe

windows7-x64

10

NEAS.5d9b7...7c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2023 15:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe

  • Size

    164KB

  • MD5

    17d54fde8f0dca439f4c32a02598e382

  • SHA1

    5eb54861db41b62e9fa296f703f06b8e52d1941d

  • SHA256

    5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c

  • SHA512

    09473f8ad9cd0d614d4a6fed4f7c34bba89f4a3e8cd0a350870e716b1f499d0d99f25ea436b13512094bf2f56178d5f9ffa8c74ad125c4c61e6aaba7b2a814b5

  • SSDEEP

    3072:ffYWjswg4fQlt4ndm8jX5IXzs+M9VQHDOVFI0kmit3:ffYWAw9fcUdmwIXo+M9VQHDlZmit

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\Users\w4drf6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion w4drf6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5DB33878E645471B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/5DB33878E645471B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: /7NKZJMWzUWcMWkidSMwg8iL0xw4xVQgpr7qE568YvypMQqTjYXupiSZuWsePnrl Zyx/N/IABEx0ahcJvmRZVueE89AmQeNJlXypCFByHwKeyjLyoLkn8/fjXQrQdQKA 2cYt/u66CHWECCyThGOu81/xeCl3hi2CZLJAuHSRn4R13vJQAui8birmRcF2qqBm RI1Z4l1CvnfZ928gFvPU8fi4y5V5kNT0gtkCTa5OXyDcZuynWgxo6ebpoiJFZezo DNpGv2csEj/h26I62RIadfTcQRrz+bnd8U99O47Nl5hqd7ZEdXqthKQk5SMniAER fPVvLp6hqE/6/REjQ1L9jtMTMw22eyxVbOVge+yZmB/9/dQemgWk/KrqsZQYQdcx ucmflOZcJZDmGaVzW+R6WBaW8hqlXCPyaozYyVNRwmCFjvio8JAvbwh4M92I3gY7 jmmy5Q8mhNF8Ur8rq1v6xteo9gH7A7bEI9iee0guBvAC9Of4VMmy7hU8zrn0cSOp yBu76q2rCO8P2wK9Y94xcnPRUgg76hWS4JPby0KftLf1m5JIV2IiEaOkKF41BGPC 6bGtenOCHMmwn3tFHfFXOVbBGQExBu6rmGrI/G8BkPj1gmfL2/XAC6XcTBaB4t2R 0SCpSWUin7+2l+ow4bDzIGrdXtkzdiS2BCswSzeA1thaPSSGeQBV8mD1fBYQiXuQ v45RvRh6YQWtaLez5aeVdoG0l2RWJzb2Y+T+HGBsKPL7ELgGv+8fYFu6yqiNM7Yq hTz+YxAprZveSIqq8aSNA5RbWc9c3PseFgUEdXkXN1SQBNJF8LqHXWmZZP7mIEm2 jcIZEVTRitGd0MF3L50CtMA64tjvEZ1gwID0Rn0JJjV/lffm8ZuatLgZXjiuLPGZ oE/s2MinCfEPdiVMPwEHi/Wix8CEqTBJBll8HnS2mtKoJZOHTt0+/OYEWonOjwAP yOK3COsqqAaLX8M1RfBgai3uGEWKMdbs76kwZXvoZ8hDivapOny3toeB6SYJrmxA zBncPpDKvTvIP++twAoJ8Qv2ehNWBFhe1H8gi0D6zOpCDDF/CrG18cSyKw/DyMae JD79Z8g4hMDjO5K+hLajpw/89CkitnL9kwcIzLXUHFfEoNTxj9kEnfRaNFXJk6VD CfZDxWybdfRnd8bextKNPQufW4BysHaUv4T57Uv7uOlagsbLACspW13rUGWt3v93 tsfax+kbNwtOXw== Extension name: w4drf6 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5DB33878E645471B

http://decryptor.top/5DB33878E645471B

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1060
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1624
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3008

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\w4drf6-readme.txt
      Filesize

      6KB

      MD5

      ac7a623ed6e79a71942a84364a1569fd

      SHA1

      63bc458de203b995a581cc06397c7d2a5d7eb714

      SHA256

      675a721dd6700f92ae91f4f6d532b4757fa108bbf1feb3c50fee29e542414c58

      SHA512

      a6bf587cb6b2b44aa1b87ef99b08bd6baadee1b35d9568fe75bc9bf4b9aa2caaa922b897b7d664ee419901905d7cd34e09eb635a335e3936edc3d37be4a1066d

      Download Submit
    • memory/1060-4-0x000000001B430000-0x000000001B712000-memory.dmp
      Filesize

      2.9MB

      Download
    • memory/1060-5-0x0000000002010000-0x0000000002018000-memory.dmp
      Filesize

      32KB

      Download
    • memory/1060-6-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/1060-7-0x00000000029D0000-0x0000000002A50000-memory.dmp
      Filesize

      512KB

      Download
    • memory/1060-8-0x00000000029D0000-0x0000000002A50000-memory.dmp
      Filesize

      512KB

      Download
    • memory/1060-9-0x00000000029D0000-0x0000000002A50000-memory.dmp
      Filesize

      512KB

      Download
    • memory/1060-10-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp
      Filesize

      9.6MB

      Download
    • memory/1060-11-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp
      Filesize

      9.6MB

      Download