sodinokibi | 34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
19-06-2022 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160.exe
Size

292KB
MD5

ccfde149220e87e97198c23fb8115d5a
SHA1

d514d08571ecd8cece8d704adc8d0c4fa87665ca
SHA256

34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160
SHA512

392a14c9a0c3a98c46e15b873919bdae13f5306a937fd8c869b2a2b435d236433a1eb78d6a953a1722d5b43cb69b4028459d6ea2387a904b4c0f2ec5bc36992e

Score

10^/10

sodinokibi 7 3 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

Campaign

sochi-okna23.ru

www.blavait.fr

kamin-somnium.de

geoweb.software

www.drbrianhweeks.com

kombi-dress.com

johnkoen.com

prodentalblue.com

transifer.fr

matteoruzzaofficial.com

jax-interim-and-projectmanagement.com

hawaiisteelbuilding.com

www.kausette.com

www.galaniuklaw.com

www.atma.nl

www.piestar.com

www.kerstliedjeszingen.nl

biodentify.ai

endlessrealms.net

condormobile.fr

Attributes

net
false
pid
7
prc
mysql.exe
ransom_oneliner
Image text
ransom_template
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}
sub
3

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160.exe

pid process

1492 34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160.exe

pid	process
1492	34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160.exe

C:\Users\Admin\AppData\Local\Temp\34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160.exe
"C:\Users\Admin\AppData\Local\Temp\34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1492

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-54-0x0000000000648000-0x000000000065F000-memory.dmp

Filesize
92KB

Download
memory/1492-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1492-57-0x0000000002240000-0x00000000022DF000-memory.dmp

Filesize
636KB

Download
memory/1492-58-0x00000000022E0000-0x000000000240D000-memory.dmp

Filesize
1.2MB

Download
memory/1492-59-0x00000000002C0000-0x00000000002DF000-memory.dmp

Filesize
124KB

Download
memory/1492-60-0x0000000002660000-0x0000000002769000-memory.dmp

Filesize
1.0MB

Download
memory/1492-61-0x0000000000648000-0x000000000065F000-memory.dmp

Filesize
92KB

Download
memory/1492-63-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/1492-62-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1492-64-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/1492-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1492-66-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download