sodinokibi | 8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060

General

Target

8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060.exe
Size

229KB
MD5

36d5afbc2394fb007541d82c61cad41f
SHA1

b1e328dc8dd37aa7fbfe50427a6633f5f077c46a
SHA256

8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060
SHA512

89588e15274d0bfb1d2d74adbc62be05a30faf1f040f3e4cbafe7913ad014661643b1bcdbfbe4f8811bad9f4f88fd6f41630d694db43b5bf6c54b576d4a9de76

Score

10^/10

sodinokibi $2a$10$ceyzqhh6apyg.fvmd5jbq.efimza/mzoem/ogbumflsf73mqre0m6 3597 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$ceyZQhH6apyG.FvmD5JBq.EfiMzA/MZOEm/OgBuMflsf73mQrE0m6

Campaign

3597

C2

ziegler-praezisionsteile.de

saxtec.com

ralister.co.uk

connectedace.com

antiaginghealthbenefits.com

adoptioperheet.fi

fannmedias.com

appsformacpc.com

vorotauu.ru

spinheal.ru

mikeramirezcpa.com

tomoiyuma.com

bayoga.co.uk

celularity.com

zewatchers.com

kalkulator-oszczednosci.pl

amerikansktgodis.se

toponlinecasinosuk.co.uk

elimchan.com

foryourhealth.live

Attributes

net
true
pid
$2a$10$ceyZQhH6apyG.FvmD5JBq.EfiMzA/MZOEm/OgBuMflsf73mQrE0m6
prc
dbeng50
mydesktopservice
firefox
mydesktopqos
ocssd
powerpnt
steam
thebat
oracle
ocautoupds
onenote
thunderbird
ocomm
isqlplussvc
excel
winword
encsvc
msaccess
infopath
visio
mspub
synctime
dbsnmp
agntsvc
sqbcoreservice
outlook
wordpad
sql
tbirdconfig
xfssvccon
ransom_oneliner
...ALL YOUR FILES ARE BLOCKED AND CAN BE LOST SOON... Urgently find: {EXT}-HELP-NEED.txt in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!
ransom_template
Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "{EXT}". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}
sub
3597
svc
backup
sophos
mepocs
svc$
veeam
sql
memtas
vss

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060.exe

pid process

1096 8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060.exe

pid	process
1096	8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060.exe

C:\Users\Admin\AppData\Local\Temp\8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060.exe
"C:\Users\Admin\AppData\Local\Temp\8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-59-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1096-61-0x0000000002180000-0x000000000221F000-memory.dmp

Filesize
636KB

Download
memory/1096-62-0x0000000002220000-0x000000000234D000-memory.dmp

Filesize
1.2MB

Download
memory/1096-63-0x0000000002430000-0x000000000244F000-memory.dmp

Filesize
124KB

Download
memory/1096-64-0x0000000002680000-0x0000000002789000-memory.dmp

Filesize
1.0MB

Download
memory/1096-65-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download
memory/1096-70-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/1096-69-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1096-68-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1096-67-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1096-66-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1096-71-0x0000000001E60000-0x0000000001E66000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing