Overview

overview

10

Static

static

34dffdb04c...60.exe

windows7_x64

10

34dffdb04c...60.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    163s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    19-06-2022 19:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160.exe

  • Size

    292KB

  • MD5

    ccfde149220e87e97198c23fb8115d5a

  • SHA1

    d514d08571ecd8cece8d704adc8d0c4fa87665ca

  • SHA256

    34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160

  • SHA512

    392a14c9a0c3a98c46e15b873919bdae13f5306a937fd8c869b2a2b435d236433a1eb78d6a953a1722d5b43cb69b4028459d6ea2387a904b4c0f2ec5bc36992e

Score
10/10
sodinokibi73ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

7

Campaign

3

C2

sochi-okna23.ru

www.blavait.fr

kamin-somnium.de

geoweb.software

www.drbrianhweeks.com

kombi-dress.com

johnkoen.com

prodentalblue.com

transifer.fr

matteoruzzaofficial.com

jax-interim-and-projectmanagement.com

hawaiisteelbuilding.com

www.kausette.com

www.galaniuklaw.com

www.atma.nl

www.piestar.com

www.kerstliedjeszingen.nl

biodentify.ai

endlessrealms.net

condormobile.fr
Attributes
  • net

    false

  • pid

    7

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    3

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160.exe
    "C:\Users\Admin\AppData\Local\Temp\34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
        PID:744

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    3
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/744-134-0x0000000000000000-mapping.dmp
      Download
    • memory/900-130-0x000000000071B000-0x0000000000731000-memory.dmp
      Filesize

      88KB

      Download
    • memory/900-131-0x000000000071B000-0x0000000000731000-memory.dmp
      Filesize

      88KB

      Download
    • memory/900-132-0x0000000000400000-0x00000000004DF000-memory.dmp
      Filesize

      892KB

      Download
    • memory/900-133-0x0000000000400000-0x00000000004DF000-memory.dmp
      Filesize

      892KB

      Download