Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2024 12:08

General

  • Target

    aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll

  • Size

    1005KB

  • MD5

    650dd09b5077b157727868148ddb3307

  • SHA1

    67c6b2344e9f13eeef5969979a58e999f2f09542

  • SHA256

    aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729

  • SHA512

    dfcfcd5fc543291a1ea56f6ef82fb98d7c0269bc9be4bfb338aefe08afe700e0b055ac3a82d1426defa53cb1cd63cb46ef9972da776b2c10104293926365b5c8

  • SSDEEP

    24576:R54YNXJJPMNYGBVsWpZW7Qy8G0DpmAU8wKwTDS:R3JPMNrH40D9hwKWS

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK

Campaign

7595

Decoy

hiddencitysecrets.com.au

groupe-frayssinet.fr

rimborsobancario.net

vietlawconsultancy.com

live-your-life.jp

verbisonline.com

sachnendoc.com

htchorst.nl

bridgeloanslenders.com

petnest.ir

myhealth.net.au

gopackapp.com

jenniferandersonwriter.com

logopaedie-blomberg.de

osterberg.fi

bierensgebakkramen.nl

refluxreducer.com

thenewrejuveme.com

alvinschwartz.wordpress.com

leoben.at

Attributes
  • net

    true

  • pid

    $2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK

  • prc

    firefox

    mydesktopservice

    xfssvccon

    infopath

    visio

    encsvc

    onenote

    ocssd

    ocautoupds

    excel

    agntsvc

    outlook

    mspub

    iconcerto

    wordpad

    sqbcoreservice

    winword

    oracle

    thunderbird

    ocomm

    mydesktopqos

    steam

    dbsnmp

    sql

    synctime

    tbirdconfig

    dbeng50

    isqlplussvc

    msaccess

    thebat

    powerpnt

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7595

  • svc

    memtas

    veeam

    sophos

    sql

    vss

    svc$

    mepocs

    backup

Extracted

Path

C:\Recovery\647nkcs9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 647nkcs9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/865861541418CF3A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/865861541418CF3A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: SJSAfwbmX+qZ2anIHz/Nrlq9KxLbgf5AOpY+Up380HwtAOADSCt7rbWpYHRWDR8I UVOvMP9du5eoZfKTJ8QnDHr7DzdTM6iXLZ6jrJcvovQoLWzcrOvawogSUV6et8OI wDD/kvAUCoZWtKtSR5O5jIYRtMyAPzHIgpw/NxDIa95JF0BL1WjEC15BYDiAwM7e kMaQ7gfYbONpA/TYOdJzC+qnNQM8+fOkGEeq3sr2pDQVBXNAUK1Oz0GqlRgZ4ns4 xx4FG/bBgfZfyvkdXEOrOv4e9hnKipeYv8jjjcHyd7Zy48pKmZy3Nj6SIa3kJYDi mVj+eLrw7LO5qe84xolK79CB5vkoGq/SCRELhzqoUIMCtlkJ4nMJ2mNk7ws1qahk 2MgEJpjGj8m0MtLGDRiBqidXwnQ2Ht3imxT3CRc+eM9sb/34M7eDYVazVIqbMy6N wtWarcVsRrdjeLAuDSdRDqVgmT+g1ThQ4daDUl+ufYiIiRHyaQaH0ooJdOVavi8g WGpvzkIkXAZKMCuqMg0Ky85IkkuRFTqQ8DqIXR4lwOJNeyHp/IzFVxiXlg1j1mVB yz6JtWqfU8L5aKQsHQrpXE4fpytj3Bn0IilSxD5KfWHOgfpVZOIn5D5MnuBW9F3y 0mQtXk8HjsZDGsd+uu0TDWIM9reCfmtaENQAILuJHrN5d3iHNhlnEtaCbcjr4lpo SrVeqsZ3+/eoypOkGt9/4wUySx8YxL/65psdR9Rw8uCjlC1vtScCP/HWWnyV/zkw 9myJHuxMznCOX9OYLimdmmSJ78U2uAXLg0qG4EBFwL5ryh9M5WX9fZ+b9XIcSv7E axR8ouxdGosvtUkqtzYb92bZxtMjLSRl9/RQRTfdq+8Ch8Y1AEVjsvrnUtaSissT y18OUCkvfAF3Pf+W58mS24oNss/A0HIIzvNnKy5QXpU1d3I2LDakRauUAnJJpYXT 6bvsztQlX0M99iV+BEGtAfYa5/gRm3NEBVtvGxg+YxD8re85HXfAr2VeGkZQ7Qrg 9YdKVHq9SNWlogKUnxszqWWeNczdIMYC9AFbUbPFnoCBxbwHJH04ZWl7kK463cD6 6qfjV4qFxW0lYNmyqUiD53ky9nugYCgfifKaUe6O7wlrLVav5Hi1nAOtKNWu/EKI RUybY9yvrhPduJ4FlBRFl6jqB5cy9JJ8GR64j66kgNJMUACaj1eFGiOGx3MrX6ES tM+Sb99HV8HH1oC2iuH+rckZRd/W+jPirctgQG0tfqtK0t7hWObxsHyTv5zbyS7/ uboMezd4wIqj/8QHW+rgGyM14ZWbLnA2WdcqZnRIH/GpZOL7G9NuAjM6boWjgei3 trW0b38D8pnOc2QPllTB82bZyoxVTny3g1aJ09OzC0k= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/865861541418CF3A

http://decoder.re/865861541418CF3A

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Blocklisted process makes network request 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1840
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4708
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2820

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    1
    T1005

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Recovery\647nkcs9-readme.txt
      Filesize

      6KB

      MD5

      e9db9249b6126df1004ed6bfc20984b5

      SHA1

      39c7fce464491fa42bf7635dae429e6e6c0cfe25

      SHA256

      82d5902f4b0505aad913817122c5cbaf4e0036bd963afbf69ed270f9851f8e2b

      SHA512

      c337c466deec97976cbcb51d86994182e3b1ab95dd17f8c73d011aa13ee8c03413b9d55d2b624ece6cd18f4fda54adc17acb6d625d3a90d21bf150d7664cc842

    • memory/1840-8-0x0000000074940000-0x0000000074A27000-memory.dmp
      Filesize

      924KB

    • memory/1840-6-0x0000000074940000-0x0000000074A27000-memory.dmp
      Filesize

      924KB

    • memory/1840-5-0x0000000074941000-0x00000000749B8000-memory.dmp
      Filesize

      476KB

    • memory/1840-3-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
      Filesize

      4KB

    • memory/1840-2-0x0000000074940000-0x0000000074A27000-memory.dmp
      Filesize

      924KB

    • memory/1840-0-0x0000000074940000-0x0000000074A27000-memory.dmp
      Filesize

      924KB

    • memory/1840-1-0x0000000074940000-0x0000000074A27000-memory.dmp
      Filesize

      924KB

    • memory/1840-9-0x00000000028F0000-0x0000000002911000-memory.dmp
      Filesize

      132KB

    • memory/1840-29-0x00000000028F0000-0x0000000002911000-memory.dmp
      Filesize

      132KB

    • memory/1840-4-0x0000000074940000-0x0000000074A27000-memory.dmp
      Filesize

      924KB

    • memory/1840-486-0x0000000074941000-0x00000000749B8000-memory.dmp
      Filesize

      476KB

    • memory/1840-495-0x00000000028F0000-0x0000000002911000-memory.dmp
      Filesize

      132KB