sodinokibi | f0b07f367f4201816c5b7b1a8d6e705cfac18451eaf77d5790d3fda7d22da6d0

General

Target

CDHFUN.exe
Size

490KB
MD5

4010e2b235310a9a500a331a0549c1dd
SHA1

c4322b99058de0977f004dd94c93192a80a728a7
SHA256

f0b07f367f4201816c5b7b1a8d6e705cfac18451eaf77d5790d3fda7d22da6d0
SHA512

167c1dda994cceb7815b205549eb71d9ea3b7a9cbbc59bfcd0e5f6d79f4b7173e319175fba8b9173150bae1c909efc22042fb671c06de10c17a033040193c72d

Score

10^/10

sodinokibi 48 2036 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

48

Campaign

2036

C2

cascinarosa33.it

welovecustomers.fr

oncarrot.com

ruggestar.ch

johnstonmingmanning.com

suitesartemis.gr

metriplica.academy

alltagsrassismus-entknoten.de

webforsites.com

simpleitsolutions.ch

expohomes.com

apiarista.de

acumenconsultingcompany.com

cxcompany.com

pxsrl.it

manzel.tn

richardiv.com

finnergo.eu

johnsonweekly.com

arazi.eus

Attributes

net
false
pid
48
prc
mspub
ocssd
thebat
visio
wordpa
dbeng50
powerpnt
sql
tbirdconfig
mydesktopservice
msaccess
agntsvc
oracle
winword
ocautoupds
steam
infopath
xfssvccon
mydesktopqos
isqlplussvc
onenote
thunderbird
firefox
ocomm
synctime
dbsnmp
excel
sqbcoreservice
outlook
encsvc
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
2036
svc
memtas
mepocs
vss
sophos
backup
svc$
veeam
sql

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Executes dropped EXE 1 IoCs

Processes:

file.exe

pid process

1488 file.exe

pid	process
1488	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

CDHFUN.exe

description	pid	process	target process
PID 1688 wrote to memory of 1488	1688	CDHFUN.exe	file.exe
PID 1688 wrote to memory of 1488	1688	CDHFUN.exe	file.exe
PID 1688 wrote to memory of 1488	1688	CDHFUN.exe	file.exe
PID 1688 wrote to memory of 1488	1688	CDHFUN.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\CDHFUN.exe
"C:\Users\Admin\AppData\Local\Temp\CDHFUN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\file.exe
"file.exe"
2⤵
- Executes dropped EXE
PID:1488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\file.exe
MD5
ea4cae3d6d8150215a4d90593a4c30f2

SHA1
8dcbcbefaedf5675b170af3fd44db93ad864894e

SHA256
6a2bd52a5d68a7250d1de481dcce91a32f54824c1c540f0a040d05f757220cd3

SHA512
899aa286f4bd9dcaa35939f9110bed5dd628609c418ffdd300941f8fb97b4fd8b8d5db7ff9ce69195218baded49f4dcf15ab1dff32028e4c5e9c7f731a646557

Download Submit
memory/1488-60-0x0000000000000000-mapping.dmp

Download
memory/1488-62-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing