Overview

overview

10

Static

static

10

(2021) REvil.exe

windows7-x64

10

(2021) REvil.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-10-2024 13:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    (2021) REvil.exe

  • Size

    114KB

  • MD5

    77be32b91561d1ac5e36464766b7b0a7

  • SHA1

    9c72fe9c8e24b5c0bde50c71d74fb2586c4201ce

  • SHA256

    133bf8be0cf7003b83b03579970997d408a930e58ec2726715140520900c06de

  • SHA512

    c8d0d6d15322172631b184acf5df86851dff7d8f15fde9cee7d0b7e4919433ec5b096f4079b5acba78d27dcfc42bfc2bcd3f184cb0a54c13b71aeb40f8ea4152

  • SSDEEP

    1536:FApx/1k2jbVnO3c+FpR5Q9JzY02pTmZ0ICS4AtebOMZzqFTj5vel1KkK3I:ck2X8M+Fp4vY06A2roFTj5vYc

Score
10/10
sodinokibidiscoverypersistenceransomware

Malware Config

Extracted

Path

C:\Users\2qj48-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2qj48. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ABB2F88F6DA4DDED 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/ABB2F88F6DA4DDED Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ytWkbhNdc16eAiMdOqNMPe06kknO4pVs3QF9TVIonQhhAbca02fr8TTToiaRwIj0 ClNyutR31TkixqO04mnsx4wZ9to9SbhLXmNkDVQschacexvSroQRWSWTGsrHAQkh fjkMq8jSXQ9JN9R0/nhjucwaZ+hRQmNZGHKV7c0kXEKNzAY9GpedvfWG12GdLlDv 0laqkpui9Y+OzSd38fGRzphYIo9oSfo8Z0lwrYNrcZhw60RSmbT07Up2Cbq1a6id itDdattiXI9bHimC06+cz75SGPptRrpHacieMzepn9YH+fSUvJ/bQsVv3Bo7n7QD /kwCuZ48ZlAZkjwpnfqk+zpt663EkVTXgTiEUaWvedC3YTH6KtoxicRwBBLKLPTD 00H6P68TUIALc5c87EP0TRJMcI7YtX62NDZdQEVmrBvpW5hUZdBElGRqT/EpbANM YXYQZ+mMx6EmUzKy697EF69JlsFrrTGJ+0YB7qMnJ11tbU0R7gx1EBaNaLgIbWhv 94/GJ9R2ToEbdBgvEq2Z6IaxfCiG9liaFRm9Ze9eLh9vYNmn95x3KnKuR27yyXb7 ZMCTIiqs2GSuH1ztOeLoN7eY70dfpdJ8uqz+zTC4YDmrOvpNwKH7C69i2XMnEqS4 bdON3JnDJZOSrDR/gjIniYj31A5iWDR75sszZIOr1bxniHZ/mD6yYTMsxDoSI/4c ef1ix4N+jd7U0H4nAiHKZ3FKrIrMMPgcaGnf/odSeekav1gWcAvQGEb3s4ts62A+ 8hmQwv8mC9khgggIoS2+TKuIqP6aICNVPVbnuZaNhnF4hlBZ2hOlB3iiop0d/jfZ /zexSlz6obeHWIFLMnMNUFNoXljw8F/nDA5nFBYohGeF4Y57f/0+HLB4FJ02Gjqw AhUw4JGoKWJBL7ZHUes69mUKcmtJUTjYdd7IvaYcWaCTSaAV63+4pdCl8671Ewkz gTLitoakNUkhG0eCHd0poD4qL27Jn1I2+2vjGuvc+YBNiCcZ99+Zojk1vp54fkao Qt23nQ9cHCBaoSRWyPLobx6CvbRpjNo4e93SS5/HWwGEMueuZEt3dsrte6Qebk0j rPe6Th5cY7Jr9pQ9nk1w57rJzDR9ZEWeOaG7j1QVn04cResqG65HWAsKT2t27Gbe EMSsn58Al1Qrsf0jYPj09Z7PmEOiSV4cRMj4mR1cOAAgCsGWpUIlfQbtxkWOAgV7 p8f91fQUX1zUXMjZ8gdRBz8LmzLJdfoDpDXdu/ErkZdsNbR45WUj4mR5Afx9pipJ S2BBb2ig57uiHnFizr2v+OrjFpVvg3yHXgDosGITwNV1Js7AW5pCLT+VB3Q2oSrS 0IAeV8LlDAUfGWg9QJrzPfKywBOHvgb4kgXNP+YQ ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ABB2F88F6DA4DDED

http://decryptor.cc/ABB2F88F6DA4DDED

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Sodinokibi family
    sodinokibi
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 14 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\(2021) REvil.exe
    "C:\Users\Admin\AppData\Local\Temp\(2021) REvil.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2472
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2512
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\2qj48-readme.txt
      Filesize

      6KB

      MD5

      331517cf68604be7d8ddfbd5344eb0b8

      SHA1

      934214eca48054e4c630d7233b7ae9134554bd22

      SHA256

      6311d6aebe87e821a8f9d58cbf1e09a57d8cb9a06216cb20b22799c3ddbb7369

      SHA512

      e891a3424b37b47d9823a2149a0e6b1cd31b521cd956c5e13699ad97ad0a36a80b31b1be6a4cd98ef15cf186baa1ffe4cdda9e32e22a8cf9b944aa5571835366

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CabA6E.tmp
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TarA81.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      Download Submit

    • C:\Windows\System32\catroot2\dberr.txt
      Filesize

      191KB

      MD5

      c55fa108f0172eed8cf84e58443b1221

      SHA1

      06e94d5c1abd949242806912e64e43c9c4cc0097

      SHA256

      8a287f9379009271d679b97d8e3a773699f1dea4e3807896f81757e526fdbd45

      SHA512

      089a532396a04bbf5499d0fc6427120cc6ed354782aae2eb3b79b474263435cd0edd6c6e078530cc97beea61ed76fbdc0340987e1a2b84b8c23c4824858b92ad

      Download Submit

    • memory/2472-4-0x000007FEF5E7E000-0x000007FEF5E7F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2472-5-0x000000001B570000-0x000000001B852000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/2472-6-0x0000000002790000-0x0000000002798000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2472-7-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2472-8-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2472-9-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2472-10-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2472-11-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

      Filesize

      9.6MB

      Download