Overview

overview

10

Static

static

b433aaa86c...fb.exe

windows7_x64

10

b433aaa86c...fb.exe

windows10_x64

10

Analysis

  • max time kernel
    4s
  • max time network
    10s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    04-05-2021 14:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

  • Size

    212KB

  • MD5

    c283e5ec517605b6226c29f96f6d1d28

  • SHA1

    43caef6a20ab9e045d76f8bf3e4e96d622f2a6eb

  • SHA256

    b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb

  • SHA512

    8a72a611925f7e504ebde23dba0f23f1cb30613bc1c3f6e36dfa3c8e954e152054a154ad3cc5eaeb4861e776135daa77ce19ebc0b00813d83298fd01ca579955

Score
10/10
sodinokibi$2a$10$r6eraudkjk.uehabw3m2ge5gweh9ga6jwmzl5ibhbgkjemukbiur.4722ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$r6eraUDkjk.UEhABW3m2ge5gwEH9GA6JwMzL5IbHbgkJemUkbIur.

Campaign

4722

C2

castillobalduz.es

nokesvilledentistry.com

plastidip.com.ar

waynela.com

senson.fi

teczowadolina.bytom.pl

www1.proresult.no

almosthomedogrescue.dog

instatron.net

devlaur.com

colorofhorses.com

ncid.bc.ca

carriagehousesalonvt.com

denifl-consulting.at

kalkulator-oszczednosci.pl

girlillamarketing.com

polychromelabs.com

campusoutreach.org

pmc-services.de

jameskibbie.com
Attributes
  • net

    false

  • pid

    $2a$10$r6eraUDkjk.UEhABW3m2ge5gwEH9GA6JwMzL5IbHbgkJemUkbIur.

  • prc

    ocautoupds

    ocomm

    sql

    synctime

    firefox

    excel

    dbeng50

    msaccess

    dbsnmp

    sqbcoreservice

    mspub

    onenote

    powerpnt

    oracle

    agntsvc

    isqlplussvc

    thebat

    thunderbird

    mydesktopservice

    wordpad

    steam

    visio

    winword

    infopath

    encsvc

    ocssd

    mydesktopqos

    tbirdconfig

    xfssvccon

    outlook

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4722

  • svc

    backup

    vss

    sql

    memtas

    svc$

    sophos

    veeam

    mepocs

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi

Processes

  • C:\Users\Admin\AppData\Local\Temp\b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
    "C:\Users\Admin\AppData\Local\Temp\b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe"
    1⤵
      PID:940

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/940-59-0x0000000075051000-0x0000000075053000-memory.dmp
      Filesize

      8KB

      Download
    • memory/940-60-0x00000000003D0000-0x00000000003D1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-61-0x0000000000400000-0x0000000000438000-memory.dmp
      Filesize

      224KB

      Download