Overview

overview

10

Static

static

1

7d3a5cd80e...64.exe

windows7_x64

10

7d3a5cd80e...64.exe

windows10_x64

10

Analysis

  • max time kernel
    20s
  • max time network
    22s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    04-05-2021 14:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe

  • Size

    175KB

  • MD5

    5a9e750f4d1d2514c496f43b1e20a94f

  • SHA1

    c02a6413d43da9e8299c0eaab2252a20792da5c4

  • SHA256

    7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464

  • SHA512

    8159e927281c9320422132030847fcbd94c2e322bd6cfac2d0c222e27fb11e7eea956df22785a2b19b43dac5e2474ca06c98e0e416162b75d82392cb730fab23

Score
10/10
sodinokibi$2a$10$.f7ipgytyzgmt5skvxp4deexwfyeu6ilqgg3il3orw0f9eevoa7l64769ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$.f7IpgYtYZGmT5sKVxP4DeexwfYEU6ILqgG3IL3orW0F9eevOA7L6

Campaign

4769

C2

patrickfoundation.net

stopilhan.com

johnsonfamilyfarmblog.wordpress.com

bafuncs.org

forskolorna.org

wraithco.com

bodyfulls.com

epwritescom.wordpress.com

gadgetedges.com

commonground-stories.com

brawnmediany.com

webmaster-peloton.com

blogdecachorros.com

zieglerbrothers.de

erstatningsadvokaterne.dk

winrace.no

lubetkinmediacompanies.com

berlin-bamboo-bikes.org

delchacay.com.ar

cimanchesterescorts.co.uk
Attributes
  • net

    false

  • pid

    $2a$10$.f7IpgYtYZGmT5sKVxP4DeexwfYEU6ILqgG3IL3orW0F9eevOA7L6

  • prc

    xfssvccon

    wordpad

    outlook

    ocssd

    dbeng50

    tbirdconfig

    firefox

    winword

    thunderbird

    excel

    synctime

    thebat

    isqlplussvc

    sqbcoreservice

    steam

    mydesktopservice

    agntsvc

    mspub

    encsvc

    msaccess

    onenote

    dbsnmp

    powerpnt

    infopath

    mydesktopqos

    ocomm

    oracle

    visio

    ocautoupds

    sql

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome Riedel Company ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4769

  • svc

    mepocs

    memtas

    sophos

    vss

    veeam

    backup

    sql

    svc$

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
    "C:\Users\Admin\AppData\Local\Temp\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Users\Admin\AppData\Local\Temp\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe
      "C:\Users\Admin\AppData\Local\Temp\7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464.exe"
      2⤵
        PID:2008

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsx119E.tmp\System.dll
      MD5

      0063d48afe5a0cdc02833145667b6641

      SHA1

      e7eb614805d183ecb1127c62decb1a6be1b4f7a8

      SHA256

      ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

      SHA512

      71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

      Download Submit
    • memory/1688-60-0x0000000075011000-0x0000000075013000-memory.dmp
      Filesize

      8KB

      Download
    • memory/2008-62-0x0000000000403ED1-mapping.dmp
      Download
    • memory/2008-64-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download