Resubmissions
30-09-2024 21:45
240930-1l2rsazhpg 1015-09-2024 22:03
240915-1yl7vsvbpf 1015-09-2024 20:03
240915-ystcwa1elr 1020-08-2024 16:21
240820-ttt9cawalj 1024-06-2024 04:58
240624-fmba1a1djm 10Analysis
-
max time kernel
74s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
07-03-2024 21:32
General
-
Target
v2.exe
-
Size
121KB
-
MD5
944ed18066724dc6ca3fb3d72e4b9bdf
-
SHA1
1a19c8793cd783a5bb89777f5bc09e580f97ce29
-
SHA256
74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
-
SHA512
a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3
-
SSDEEP
1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\oitd618-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension oitd618.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/66EFD50C7CD78C48
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/66EFD50C7CD78C48
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
UaGiRjW4GJrpFEKKjV69WOpG39uqXwKwLUp6IPRZu7mwHrsYg58KCm7BcylvhiMG
WdhBqRppHjXd+yWmHXDV44mdERwelGd+Z6Jp3cF3hy54OsYMvjTsh+abPN0dTaH3
bXXFbkM9jC190A3Wr7MpBgKH5wx+rllweOGZlnoORdxm0NpfuP0M37dgNr/BDTVS
yS45Ng7cvPJrJBP1QgftxaU6rOMHpU4mwWfzLS2a1p8zGOlxPnv0TcRtfKuaZFbR
gX0XJG4xqMnDllgQqMEGrESxEoUErjn+UVcs8UfbvMUGpKiW1WRTZYhTK/tNqi6w
CDreyxZQcstgY8/jqOaZEUcKcVsKTC1wBcHcasTvHEsYhY/tn7WN8JsOdLyE69uV
aQvgLBOUoZQ6UYaDxfboMX1KYY0lsMjtXHMTYBjqq3zo4eDZH3qEcBbgzryOSz9U
t30qQNDKN3zt0v+VHPk4FxuMpfF3f8XqWvfB1HSR3tl9NUiR4Cvi7v3R4UlRxFuz
/seTRkZPuzTlCa3E+wARPdOTNIbQF8+yOdV4flkhtQv3PyxB5M+9c/JRPw6nFCW7
cLyIaX5W+majzXlkE3nhLci70kUi2nWssuiLXw+kxhTZb/JnS+5gxGLvIvsnQETL
OWOZoiGPaP4J/LAs7mE7VfHeQcysL0Tr6infpAHY+IgmkMyMqDLlft9XxE7gNekc
XKZkq2GGg9960senqiaYrMp1EAEQlGVkSMKL2xdbabQEYAPMepBvpNC9p9BE/0zV
WT8PNDc6RzhhmOIHQVJwEbvcahgd5WxDer9mYQ1wW558J38wEfmgiSX1FCF1o752
NIz/mSA6QhYYoqS1resB9CUyOQS8VS1qA1xX0ppxDOy0zSIcVmPBy5s1PdkbBmWa
Csa/OK91zFjdg0kO929HiqZxMuxBeQVrJ1hmfcxP6ihKGq7lQpNgcAtIbV4AbkiQ
PWcUuS4s56MjX1V9kiRyOQv6Qbk+BPQbcK+AYP3uabETKZJJ2CcnQaEVYL2GGjzG
yfvd3hnaaKnQKw4wPaZuEG5r6lDJMjnuCEjcI3jsjjgfy99VoZD1mCi9pbyMPzA5
Ak2hnLDltrPZXOoiXA4xEZ0NjjBPZHKvew4hS5yDOYph9I1upjBH6QxpeiAITfKg
+qzaj6ukw5UAg7NVB/wDitZi10Bjqxe2/YWeSHE1+DJlOccRwD4GGXN7p2/fKEgo
Qv+H5U8V27FimFrRO2xN/zopZ+bOgxMnHAuYcAkgYog73DTyhZAW4HiiBvmmVp3l
wbBMb62u4GlA0q61TCxPiObOwogjZDOGvVrxgdjnLnLJhqJVM8HD4pW7ULXRf0jI
F55juZhTf4QAW3zs2wez9Sr9005MUImxTZ+u//3k
-----------------------------------------------------------------------------------------
We will use the data gathered from your systems in future campaigns in 14 days
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/66EFD50C7CD78C48
http://decoder.re/66EFD50C7CD78C48
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 23 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5bc91618cbaf3b9d2662e7e8088494798
SHA1138d85b6a68efafff88cc6b3d43ee276fcb2c4fb
SHA256e14ad66101022e5293afa16507f5838dc9522340e4d8600723a0dbe9c3d6a5b2
SHA512a0bef39bfe2216a77e6a7dee05d5546c98d404e12f93ad27c3bbdb15fba16bc868830ea41f7eaf840105626a469687d6f8f428a659ff3833a1c8c5c90af8d41a
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB