Overview

overview

10

Static

static

37b8da186e...c6.exe

windows7_x64

10

37b8da186e...c6.exe

windows10_x64

10

Analysis

  • max time kernel
    4s
  • max time network
    9s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    04-05-2021 14:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6.exe

  • Size

    308KB

  • MD5

    ec423a03baa81be57f07cc2243552d93

  • SHA1

    7089c6d938e3bae0febac05f4b4b10bb2f92142c

  • SHA256

    37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6

  • SHA512

    6d533efdd332e362e9cf41c17db6dc07f41fbeb428a1a303c53d3b6b71277a2df3bedc6d2c347279d29ff34cdfc1998201f3b709adcc5ca6d5e8811d11272191

Score
10/10
sodinokibi$2a$10$t3dhtruanqkuwj0zthetbo76elgnsuz6qhedd9elbwxl1fjinkeuq3612ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$t3DhTruaNQkuwj0ZThetBO76elGNsuZ6qHEDd9eLbWXl1fJiNkEUq

Campaign

3612

C2

all-turtles.com

smogathon.com

mediaacademy-iraq.org

nhadatcanho247.com

milsing.hr

cursoporcelanatoliquido.online

broseller.com

ftlc.es

compliancesolutionsstrategies.com

ampisolabergeggi.it

cheminpsy.fr

planchaavapor.net

vibethink.net

rosavalamedahr.com

lionware.de

liliesandbeauties.org

smart-light.co.uk

gadgetedges.com

psa-sec.de

ledmes.ru
Attributes
  • net

    true

  • pid

    $2a$10$t3DhTruaNQkuwj0ZThetBO76elGNsuZ6qHEDd9eLbWXl1fJiNkEUq

  • prc

    infopath

    sql

    mydesktopqos

    excel

    powerpnt

    xfssvccon

    msaccess

    encsvc

    wordpad

    firefox

    ocssd

    dbsnmp

    steam

    ocautoupds

    synctime

    dbeng50

    winword

    agntsvc

    oracle

    tbirdconfig

    thebat

    mspub

    ocomm

    sqbcoreservice

    outlook

    mydesktopservice

    onenote

    visio

    isqlplussvc

    thunderbird

  • ransom_oneliner

    ...ALL YOUR FILES ARE BLOCKED AND CAN BE LOST SOON... Urgently find: {EXT}-README.txt in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!

  • ransom_template

    Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "{EXT}". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}

  • sub

    3612

  • svc

    sql

    sophos

    mepocs

    memtas

    backup

    vss

    veeam

    svc$

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi

Processes

  • C:\Users\Admin\AppData\Local\Temp\37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6.exe
    "C:\Users\Admin\AppData\Local\Temp\37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6.exe"
    1⤵
      PID:1784

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1784-60-0x00000000754F1000-0x00000000754F3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1784-61-0x0000000000220000-0x000000000024B000-memory.dmp
      Filesize

      172KB

      Download
    • memory/1784-62-0x0000000000400000-0x00000000008C1000-memory.dmp
      Filesize

      4.8MB

      Download