Overview

overview

10

Static

static

10

2024-03-13...il.exe

windows7-x64

10

2024-03-13...il.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13-03-2024 15:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-13_ef598744788b296ff432ef23f236df15_revil.exe

  • Size

    123KB

  • MD5

    ef598744788b296ff432ef23f236df15

  • SHA1

    0c3080bf3ffe321f67ed0ee712e02f054e63b614

  • SHA256

    40538175f74819e6f70ccb3c3677529d6ce2bdfe41f224cf4701807485387c84

  • SHA512

    acc465c373f1a2c1babc034eda94b83e222ff97455599454501d192d438cb357e32c5cc80b743e35f47c20756e9478c0ce6f1ec82ad6ea0767d87d8d61dc61da

  • SSDEEP

    1536:7DvcP3aXhpshwVs5OE8yNcYQpG2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOxd:ylSVhaNcYMkgnBR5uiV1UvQFOxd

Score
10/10
sodinokibi$2a$10$ctl6mpbcozzcr.aru3gxp.pcftg0jof6upmmrky0hc0o.x.alltz.4085persistenceransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.

Campaign

4085

Decoy

sandd.nl

digivod.de

southeasternacademyofprosthodontics.org

resortmtn.com

mdk-mediadesign.de

tetinfo.in

fayrecreations.com

ecpmedia.vn

physiofischer.de

highlinesouthasc.com

antenanavi.com

blog.solutionsarchitect.guru

deepsouthclothingcompany.com

coursio.com

quickyfunds.com

atmos-show.com

pawsuppetlovers.com

hokagestore.com

midmohandyman.com

mmgdouai.fr
Attributes
  • net

    true

  • pid

    $2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.

  • prc

    sqbcoreservice

    dbsnmp

    mydesktopservice

    outlook

    ocomm

    excel

    mydesktopqos

    isqlplussvc

    onenote

    tbirdconfig

    msaccess

    encsvc

    infopath

    steam

    thebat

    agntsvc

    sql

    visio

    wordpad

    winword

    dbeng50

    powerpnt

    firefox

    xfssvccon

    mspub

    oracle

    thunderbird

    ocssd

    synctime

    ocautoupds

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4085

  • svc

    memtas

    mepocs

    backup

    sophos

    sql

    svc$

    veeam

    vss

Extracted

Path

C:\Users\38fk8pf7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 38fk8pf7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7737960A37E4E13E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7737960A37E4E13E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yYJyioy9v7z1Dmvaq3EFDctNFlLeoJacrOzEl+lI4vQXM7dnP+VjqbzjzbuzZVPR 2GMXtH1ZhpV94oH/ZgZaJ8ztFMoYX8nuegaiPi1O+0MxswFEfv7rggjYH8oDLhAW d7r1yqSIWCBWUpCdc61651CnplDXZ9D5kDYjkToegQhYwtpabkcIgvkt+03OU/CI MxMFM/fGmWk6Py58URvM7SaSbqj3oX12b5UAbYkXBN2f8ArAfUc5+Om7rmaayLti 166BrgcHWnqJETRcCudr1s1ir94c8MwZCzokiKNm3G44N4Y3nu8ZPTZPLywskbFV KLd9Cg8vBEN/nrH4W2odd6mGNu8SVfU159rd3onb+6qQwyxtgBWdUzTwRRnw0eW4 W+kmsIau5JjrQz6vkqoKiSdCosaOmU/MseUbOHFyeKRbMLd+5C6/W/iExj01Nj30 pgYUbkjlF7matelv7tQH3DRwGQ8oIW2UZ0QtiHvf8cPkmh6M4Dz8HqAiybB0FOfc woiyP5Y6mG3/9YvjzghFFR4hdO6E7FOC6fvChTAhyUfZCFJIAmlo22igtyyeqkII 3fCutFbU2C8tPlP61r5sz5askErLZGE7W2rB+fLFJFjKtTWISwlY/JUo5afl8VXm 1Xz12ew7OAdppJIeiK97GOmZXl/LOmE2mYw9IBpCnpgduVVjPMphv9p2GeM3DD8z BpQTqOcTwI54UEyKs03s7nZnj7gR9AAwGN1+O19dO2DgXxl0eZ/2bqPCdB3ibB1Y fxaWd/hjY++vVkfYBUibVQpYmA8y7Wctdftu+AAG97/2jCqYt+gmEl5ap8qGzqEa //aRoFLa8Xwrw6RjK5zjb4ypshXPuLS0FV4FJMa1f7SQzBmGjTyOfrdc/A/G7MP9 vwpYkvmOrOt6RWrVpzUhixP1S8p30mDzcmvKFRlRxOUexl7lO//wCKvJed+pZivN EHoN8xZQ+PWHPhukOGIgPZEUAEeFWcVP7bufqz5DOs/nlcDK9Mc2ATRV/F6SKNNu znE5albFlfG2V0AQqLW+1xO9KM/01JWU3e7ZbrLjseX5wmkh1wedEpZH5haGmP4J Xt3OsHjbkItJs+XHvQIzBSG7m75p13zg7bZoWyvMriYqI8G+BPZzCi5KfFGyVrbC bqqUqNBLGG5de8WSvjxM6uDIfFzBKvAf4kv3z+sV697asn6GN3cDvtUEpcmT4Yfg Syu7oXPmTVWL6kXEG2QzVlof8kCsNbViN6Qvqq7qoXr/R/YUkUmzWGMkJ88UpFHO tzoPCWymWhJgoCrElz7IO8OEilhsq0upTAMUoQ2p0buGqxgwC3YC56UOVO+zqdUn 5Tbc6JJe822oyr0TRC5HZL9tT0utoxgZ2Us+8RBVhTd9B/v5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7737960A37E4E13E

http://decryptor.cc/7737960A37E4E13E

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 42 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-13_ef598744788b296ff432ef23f236df15_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-13_ef598744788b296ff432ef23f236df15_revil.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1740
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2264
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\38fk8pf7-readme.txt
      Filesize

      6KB

      MD5

      9235e99ce4da55a850f2c7e8ebed1a60

      SHA1

      55646396f3721a2d9d5a9b802c5d5b413014cd12

      SHA256

      5f466bd99083f00d1a37336b9eb1709e25b146b6ccb59b4d95bcb702a277bc8f

      SHA512

      83ea7f9974e694e71282d7f8be51d5b71cbf41ee2bf5e0b796ec3ca1df34c97de1f96b00edd919ecda318c69e0763fca76291e24d6d5f64899109455a61f4e50

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Cab9520.tmp
      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar9843.tmp
      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

      Download Submit

    • C:\Windows\System32\catroot2\dberr.txt
      Filesize

      192KB

      MD5

      1d3013e707fdf118fdb12e6cca8674d8

      SHA1

      330a36a72ce6411cb14536bbf913160ef1d813dc

      SHA256

      3b289fdf2280b82c7d6de9f784f8f142dede82cbeeb2287622c9ed7737769521

      SHA512

      d0ab6e6d29a329e0172d309377553eeecbbe095926e76dd39c0c15b5e9c2c875fd8955ef935b852b035f984364fe3d2937be4b1c64b7bfa3bfbded99889158d2

      Download Submit

    • memory/1740-8-0x0000000002720000-0x00000000027A0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/1740-10-0x0000000002720000-0x00000000027A0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/1740-11-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1740-12-0x0000000002720000-0x00000000027A0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/1740-13-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1740-9-0x0000000002720000-0x00000000027A0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/1740-7-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1740-6-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1740-5-0x000000001B6A0000-0x000000001B982000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/2088-541-0x0000000000E20000-0x0000000000E42000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2088-0-0x0000000000E20000-0x0000000000E42000-memory.dmp

      Filesize

      136KB

      Download