Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-12-2024 00:30
General
-
Target
54f07b825fd662618e1142ee47ef5c988c08ae59c60209bef250fc68bfd3826c.bin.exe
-
Size
121KB
-
MD5
cfff09d3936962f72fcee2a50e3fc2c4
-
SHA1
92c64935bda4b9c4d5609b5f3a2555f2527f4c9f
-
SHA256
54f07b825fd662618e1142ee47ef5c988c08ae59c60209bef250fc68bfd3826c
-
SHA512
d4913f96bed96b5cb2f24e34a9597cffe948f9bf475b946605d6dfed2b11f0b1683145beecfbcdc487be1591a831b1255324e53dba50a3a04a962ff189512d98
-
SSDEEP
1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZsc2gzuI51cLX:J1MZwlLk9Bm3uWcbHLc8PVg
Malware Config
Extracted
C:\Recovery\p96z88x-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/98F49F9E76FF4AB5
http://decoder.re/98F49F9E76FF4AB5
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 39 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\54f07b825fd662618e1142ee47ef5c988c08ae59c60209bef250fc68bfd3826c.bin.exe"C:\Users\Admin\AppData\Local\Temp\54f07b825fd662618e1142ee47ef5c988c08ae59c60209bef250fc68bfd3826c.bin.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5e0790a8d2d0e9daa3e646e85e9d7ba58
SHA1fea4dd609db8102eb0dae51bef862269088e4017
SHA256cfdd347697c371e7050844c51620acf3dea3f96ba18bf16897db1a59a9bb7b56
SHA5122e46c1ac97ad54980dc6ab891365fce3d6e160fcf9829bf3a91d69e3d805102d87831312f358d3d529827289f2d5b5837b41548880e17567802011b5f5b6163e