Resubmissions
11-08-2024 04:29
240811-e4cpqavfmp 1011-08-2024 02:35
240811-c2187avfqa 1018-02-2021 14:36
210218-e988k496be 10Analysis
-
max time kernel
77s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11-08-2024 04:29
General
-
Target
2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe
-
Size
118KB
-
MD5
9c08dfc58885a9a7beca989ea5ee9108
-
SHA1
ce2f51348da7a19dbf0e79b64f9eb8e46f45efa3
-
SHA256
2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e
-
SHA512
34cf39e4976f264f31b3236cca87aeca04ebc447fe99b35bbb72dd126462eed78310954fcdebab48b1f3ad9eaf5efe22ad8405b12d80ddd357244138067a1ae2
-
SSDEEP
1536:pRGfmACfvCHeQ5EJRDKiMIfB6Ym5p/eyxICS4AxpoC3/0bZ2YySvKxBPyAU0DeWj:omRj6YaWm8/0bZCSvKDyhVv
Malware Config
Extracted
C:\Users\Admin\d38vws2ov6-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5DA3E1805DFB79EF
http://decoder.re/5DA3E1805DFB79EF
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 19 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe"C:\Users\Admin\AppData\Local\Temp\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe"C:\Users\Admin\AppData\Local\Temp\2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\d38vws2ov6-readme.txt1⤵
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5d38e8ee353080716c72a5d97401f7653
SHA15e598f03c76fd8c77e8b3147e1e8297edffa75a0
SHA25695fb6d7a8949bad243c0d2ceb2ee1c5212ad1df420094d040fb4825eb268c43e
SHA512afb26e75e08146c6ef00c6daa4f5d4ecad9cfa14762734a93cd09fb9cbe7bde395aee637640953033e781b1dc2ca1c7a85b5bc50a9034390c0188e15b97afd3c