Overview

overview

10

Static

static

10

Tear.exe

windows7-x64

10

Tear.exe

windows10-2004-x64

10

adochi.exe

windows7-x64

7

adochi.exe

windows10-2004-x64

7

autoit.exe

windows7-x64

10

autoit.exe

windows10-2004-x64

6

autoit2.exe

windows7-x64

10

autoit2.exe

windows10-2004-x64

10

autoit3.exe

windows7-x64

10

autoit3.exe

windows10-2004-x64

10

deviation.exe

windows7-x64

8

deviation.exe

windows10-2004-x64

8

encoder.exe

windows7-x64

10

encoder.exe

windows10-2004-x64

10

encoder2.exe

windows7-x64

9

encoder2.exe

windows10-2004-x64

encoder3.exe

windows7-x64

10

encoder3.exe

windows10-2004-x64

10

encoder4.exe

windows7-x64

5

encoder4.exe

windows10-2004-x64

5

encoder5.exe

windows7-x64

10

encoder5.exe

windows10-2004-x64

10

erebus.exe

windows7-x64

9

erebus.exe

windows10-2004-x64

7

myxaha.exe

windows7-x64

7

myxaha.exe

windows10-2004-x64

7

$LOCALAPPD...er.exe

windows7-x64

7

$LOCALAPPD...er.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    125s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 00:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    encoder3.exe

  • Size

    164KB

  • MD5

    7518ecf9cd7d3f204de349103bd95c54

  • SHA1

    417df7e036285c9409affa1e9bef8634d8994869

  • SHA256

    14d09a259f72569f309fdd7bc14519753d01016706c7b9335a215b2d0b64c632

  • SHA512

    71a181e597a5d9eae8ccd22683b650039f2506ba502b44a2da4f786e8884a1538603df9ab57d19c78d9777cb8f643ec78439346c32611776984acc569dbaba32

  • SSDEEP

    3072:FHixaVZFiOCDJtOicNDWEzZQjnS2C/vbgnB:FHigLF5CCj5zZQDV0bq

Score
10/10
sodinokibidiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\9micftzarWannadie.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 9micftzar. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3850925E2EE4773 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/F3850925E2EE4773 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 65StlJFemZSDE4IviMaksfzLvw5VlXCtvo/R/AkoKMlVwQxl4OrGqHQg9LY+a0r7 qWKNauXaRcFjPrhFE1AQuj4DUGcrfJUFxUdzGpjl6dHQPSeV0lsWJlOUrepjHbE4 DjCMwlYC939fRssquU2tirTllG6O46VXS5Gj/jvzOiAjGsaiAdrewO9ncum5l6hA 8G4irptdAWYU7Z4mK4fsrAgjpqjhJl0ChVFjDXXXpDc8hjIsbqZv2BS/+6ar6PDH 1S1eUtm1bpbCEYwDtJiHv//VpENchLU89OJ53sol1kDI1fVivEvMtuwndg+IcxdO I3WPv9hHe+wMuoLa/0KZtIME8gJd7n4V+NVLsNshWPXbNL7Uk1mrwtwH9cLjViTe 2DlXTENfDOEjKpgFQzGBUMjGFNZ8r4Ensh06TRSpJkYcyhcNJehTxUo4QJ9qnNd+ KpXxfrbBLtP/Hs5bhhwuVNrDsutkfodqvGcilsWc1QSJ9xrBNSH3Zj9A/kLGD1GZ peoMS4QNCkM7ExqS2aaikKeHnyXuSLpxSLJcVpKwub6l/KnPO5IghvsP3C0EPVTF ZHXfHGZUYpbxUwsrAIh9TjxarHE9TkFBFdKwQc1TGFYZHn0P3+ujXInMJkHFvxiO Ul7b8GsAH/icl5ni5nE28h8511dV/kfVxUplTE1tZfjXrnRg9J3VISGcXl+tUeUV VggycfWYCsiNDjsA2kwAuPjUbACC2yObTR23A50uDXqyDhdp21EUzTbi50BCf3Ua ZR9c7T9ogvtFkfHhyc01Hi4fCLltmQWNVSu11vzI6o6y1KysIQTBcLqb3efPT/Xa y/Hp9Bae3jFXn54oTYS3kd3Yn6jonXE6MdYDU345z0HnQnTyxhuDbowJ7l5nKB1c +5g14zUcNWYqCLr/9yO/GOqvrUJpOuuiwc+u5oY8GuXh/2kPJFNSzVIv0Fktrq4b bADGi7r9sUQuik+t+a/VeLwwCZABJMFvgPPZBQNQpRhGt9vnLhxa/CPoYUmzgLYH 7zapqSRCWNuVVMvQevW5YwNDCItu3sr1qgq7xNq8QZ8wVwK4cajkwUFJUTlyS6eC JAjvqLulal+9AI85bioqN+R80/teeKL/TsGSnnil65TldA3akXvT92NtMMiu+tdU TxRcw9zbd7DJfNT54newHKZuetU/ftIRoB3dTcUuBbnMK3GmAbvyIxm4xRK+TqDq ++tEFYalk/cNLtTrcGo2u14GE+QZaIR6 Extension name: 9micftzar ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3850925E2EE4773

http://decryptor.top/F3850925E2EE4773

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Sodinokibi family
    sodinokibi
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 29 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\encoder3.exe
    "C:\Users\Admin\AppData\Local\Temp\encoder3.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4792
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2868
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3740

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\9micftzarWannadie.txt
      Filesize

      6KB

      MD5

      31f2d0303477dab29c20b8e9114a8890

      SHA1

      95f78fd6245fbc8c43bf95280d51ee0343ee7b34

      SHA256

      40684ce598f6e34d22ddd3f4bb5be933693bcac7027216c864cb312dea33e980

      SHA512

      3c8b40a69bb6ad1a099036a594e6ec953c73fc1f92b956e21ccb6dbd1e8f91d2cafefa8f146cf425107194023e51ccdefe5342ead7b5ca175bfaafd6bba88abf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5cm2hcy.3ch.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/4792-0-0x00007FFD809A3000-0x00007FFD809A5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4792-1-0x000001AD315A0000-0x000001AD315C2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4792-11-0x00007FFD809A0000-0x00007FFD81461000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4792-12-0x00007FFD809A0000-0x00007FFD81461000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4792-15-0x00007FFD809A0000-0x00007FFD81461000-memory.dmp

      Filesize

      10.8MB

      Download