Analysis
-
max time kernel
122s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06-03-2024 01:38
General
-
Target
2024-03-06_41daca921d5f2128ccec2e79140627d2_neshta_revil.exe
-
Size
207KB
-
MD5
41daca921d5f2128ccec2e79140627d2
-
SHA1
20f6dda39b1e6a82a7ec62b533f740af7c14fc51
-
SHA256
a50149e4dc2ba462591cf3bc8cc588fe46d772dec69757727880b5dc312662ae
-
SHA512
c16d04d93a95168f00086f57208c0086d3ab1d60df2b054b103902d3263051d6e80e65ebec5733ca6b14b7f5edba7d587e74514df987ddb8d52c643ffd9573fe
-
SSDEEP
3072:Ur8lmryy2RjLTuVyu7CJDgoMT3QPWYFQxLt79LFrb30BRtBZZg+i2v:Mt2y2RsQJ8zgPWSwxJ0BXScv
Malware Config
Extracted
sodinokibi
$2a$10$EexBKJboSGx7rhv9nZHif.Mbiht5KcVBTHgjgLd4P5BsKEZrqEcK.
1428
architekturbuero-wagner.net
socialonemedia.com
nuzech.com
kafu.ch
mediaacademy-iraq.org
pocket-opera.de
katiekerr.co.uk
bodyforwife.com
commercialboatbuilding.com
naturalrapids.com
mapawood.com
fiscalsort.com
baylegacy.com
koko-nora.dk
markelbroch.com
hexcreatives.co
kamienny-dywan24.pl
shsthepapercut.com
destinationclients.fr
shonacox.com
-
net
true
-
pid
$2a$10$EexBKJboSGx7rhv9nZHif.Mbiht5KcVBTHgjgLd4P5BsKEZrqEcK.
-
prc
mydesktopqos
thebat64
encsvc
powerpnt
thebat
mydesktopservice
outlook
msaccess
ocautoupds
excel
msftesql
infopath
xfssvccon
thunderbird
visio
steam
winword
mysqld_opt
sqlagent
sqbcoreservice
firefoxconfig
tbirdconfig
wordpad
mysqld_nt
mspub
ocssd
onenote
dbeng50
dbsnmp
sqlservr
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1428
-
svc
svc$
sophos
memtas
backup
veeam
vss
mepocs
sql
Extracted
C:\Users\3w6v5q-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BF526BEDCB89A20D
http://decryptor.cc/BF526BEDCB89A20D
Signatures
-
Detect Neshta payload 6 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_41daca921d5f2128ccec2e79140627d2_neshta_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_41daca921d5f2128ccec2e79140627d2_neshta_revil.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-06_41daca921d5f2128ccec2e79140627d2_neshta_revil.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2024-03-06_41daca921d5f2128ccec2e79140627d2_neshta_revil.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD52229e8d5cdc7ad9b5e84ce366fd527b2
SHA1736460d41892167b892d6426a5fd1196b9d5cb05
SHA256c0cc8340991a3b48fbd169604a36fd88ef4056f1db10a929bdc0cfdd5123a098
SHA512a4d482f1e3a442d0adab865ac26cfe08ef2b368f2cbb82fd1374ab5d7a93afffc122f28c9c357dd902d857f6c599b9e0e3108ca68dc08064f4737e8c4280991f
-
Filesize
6KB
MD55d6c79495179a4233dfcba2e7ead314c
SHA1fba5027a094acf95801d621657192005bb181689
SHA256d4a7b1d57803eac66fccf234502aa832e0c7f97e136bf29a28de40ff21e323ea
SHA5124f5a2993744a257b71afcef44edd67b8517ffd0dd14a78c2456119c3f32de127661e6e6a31f8c882d68d81a46de92c151ea263179190fe5e32b2cc50bf900bec
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
192KB
MD5dd859ebfb9f732f599b44f267d7fb71f
SHA1c5a0d41695c1276c2f68ea01e1e2a0149b348186
SHA256d2f6b14f0f37c2756ebbbfa2efe4f85b03d2a838254d279f90ac1772f2ffecc3
SHA512de078bb3013458a0c22840e558a4e7b828133d24c6dfc24e754774e9da2d339ad48ff1ab88312b1aced3a977efe794efff81a42ae808d21c5b651c109add11a8
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
166KB
MD572e82c3418eefd708ef7887848278760
SHA1cda4b494105853375379ae9009152a274e8880b2
SHA25629ad3ad31948e4a58d4a6402b5dccdd5bfa384b996fb7ff94b7f4be29929b05e
SHA5125041aaf1e8246933a1df0b34bb8772b7d7573a6767c29f728addabb89c5800701e552f5794f3e109cb9fb7b95190e2f96c115bbc9dcb86942bfa7bd56d3b5e5c
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB