sodinokibi | be13f79d3afdb19a5a880d549e7f511469542e8b81f5f259e9ec104a8e2ec2fe

General

Target

df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe
Size

911KB
MD5

0299e3c2536543885860c7b61e1efc3f
SHA1

682389250d914b95d6c23ab29dffee11cb65cae9
SHA256

df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e
SHA512

f451031bc12e096a50b19f80422e9db5b6913f22ceab000f0dfb5aca767ff0b7fc25ee75482875bc9f2fa1953aaf06b3f50ec2ecb901b31f5e27ffd0707f2781

Score

10^/10

sodinokibi $2a$12$vdqtdjoxfyv.wboex9g4zofey483g1yccc4z7m8glmp7fmtv5ywcm 7598 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$vdqTdjoXfyV.wBOEx9g4ZOFEY483G1yccC4Z7M8GlMP7FMtV5yWcm

Campaign

7598

C2

ecoledansemulhouse.fr

promesapuertorico.com

oldschoolfun.net

hardinggroup.com

fax-payday-loans.com

chrissieperry.com

chandlerpd.com

birnam-wood.com

ivfminiua.com

berlin-bamboo-bikes.org

vesinhnha.com.vn

geisterradler.de

lefumetdesdombes.com

slimani.net

vyhino-zhulebino-24.ru

lusak.at

101gowrie.com

pixelarttees.com

live-your-life.jp

yamalevents.com

Attributes

net
true
pid
$2a$12$vdqTdjoXfyV.wBOEx9g4ZOFEY483G1yccC4Z7M8GlMP7FMtV5yWcm
prc
encsvc
powerpnt
xfssvccon
oracle
thebat
ocssd
sql
msaccess
mydesktopservice
visio
winword
dbeng50
ocomm
mspub
isqlplussvc
infopath
ocautoupds
tbirdconfig
synctime
agntsvc
wordpad
firefox
thunderbird
onenote
dbsnmp
excel
sqbcoreservice
steam
mydesktopqos
outlook
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
7598
svc
backup
svc$
veeam
sophos
sql
mepocs
vss
memtas

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Executes dropped EXE 1 IoCs

Processes:

MsMpEng.exe

pid process

1956 MsMpEng.exe
Loads dropped DLL 2 IoCs

Processes:

df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exeMsMpEng.exe

pid process

1940 df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe
1956 MsMpEng.exe

pid	process
1956	MsMpEng.exe

pid	process
1940	df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe
1956	MsMpEng.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe

description	pid	process	target process
PID 1940 wrote to memory of 1956	1940	df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe	MsMpEng.exe
PID 1940 wrote to memory of 1956	1940	df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe	MsMpEng.exe
PID 1940 wrote to memory of 1956	1940	df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe	MsMpEng.exe
PID 1940 wrote to memory of 1956	1940	df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe	MsMpEng.exe

C:\Users\Admin\AppData\Local\Temp\df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe
"C:\Users\Admin\AppData\Local\Temp\df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
"C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
MD5
8cc83221870dd07144e63df594c391d9

SHA1
3d409b39b8502fcd23335a878f2cbdaf6d721995

SHA256
33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a

SHA512
e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mpsvc.dll
MD5
849fb558745e4089a8232312594b21d2

SHA1
1bcf1ae39b898aaa8b6b0207d7e307b234614ff6

SHA256
d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20

SHA512
48d1e77e426d0a96b55e54c4cd81e8376395f17fe1efa5f11467ecfa8f214c52cc202c561be76ddc8a9958fbba74250947fba0310ce9febaa46894f7454a2bbb

Download Submit
\Users\Admin\AppData\Local\Temp\Mpsvc.dll
MD5
849fb558745e4089a8232312594b21d2

SHA1
1bcf1ae39b898aaa8b6b0207d7e307b234614ff6

SHA256
d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20

SHA512
48d1e77e426d0a96b55e54c4cd81e8376395f17fe1efa5f11467ecfa8f214c52cc202c561be76ddc8a9958fbba74250947fba0310ce9febaa46894f7454a2bbb

Download Submit
\Users\Admin\AppData\Local\Temp\MsMpEng.exe
MD5
8cc83221870dd07144e63df594c391d9

SHA1
3d409b39b8502fcd23335a878f2cbdaf6d721995

SHA256
33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a

SHA512
e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c

Download Submit
memory/1956-60-0x0000000000000000-mapping.dmp

Download
memory/1956-64-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1956-65-0x0000000000170000-0x0000000000191000-memory.dmp

Filesize
132KB

Download

Resubmissions

Analysis

Sharing