sodinokibi | bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9

General

Target

bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9.exe
Size

542KB
MD5

61c19e7ce627da9b5004371f867a47d3
SHA1

4f3b4329871ec269043068a98e9cc929f603268d
SHA256

bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9
SHA512

dd919e1dace4e1f246552bbb1b55cd13f38bdac8764afb67624d4331341dff1c3cd75616da26d9deb4e05c04163b78a5ff8b9ffec2f73b2c9b82d5a41e216244
SSDEEP

6144:YONNYdX7HkqEHcTY6uoZzFyKAuGnlOOkl8tuGogbOIVmda9J4:YONNoX7HMHcTY6uoZzFyfONlwNB2

Score

10^/10

sodinokibi 5 367 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

5

Campaign

367

Decoy

craftingalegacy.com

g2mediainc.com

brinkdoepke.eu

vipcarrental.ae

autoteamlast.de

hostastay.com

gavelmasters.com

ronaldhendriks.nl

successcolony.com.ng

medicalsupportco.com

kompresory-opravy.com

sveneulberg.de

oththukaruva.com

voetbalhoogeveen.nl

selected-minds.de

log-barn.co.uk

fsbforsale.com

jobkiwi.com.ng

ivancacu.com

11.in.ua

Attributes

net
true
pid
5
prc
wordpad.exe

outlook.exe

tbirdconfig.exe

agntsvc.exe

thebat.exe

mydesktopservice.exe

sqbcoreservice.exe

thunderbird.exe

ocomm.exe

excel.exe

thebat64.exe

steam.exe

xfssvccon.exe

firefoxconfig.exe

sqlagent.exe

ocssd.exe

mydesktopqos.exe

msaccess.exe

isqlplussvc.exe

mspub.exe

winword.exe

sqlbrowser.exe

dbeng50.exe

sqlservr.exe

oracle.exe

encsvc.exe

powerpnt.exe

dbsnmp.exe

infopath.exe

ocautoupds.exe

mysqld_opt.exe

visio.exe

msftesql.exe

mysqld_nt.exe

synctime.exe

sqlwriter.exe

mysqld.exe

onenote.exe
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
367

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9.exe

pid process

1564 bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9.exe

pid	process
1564	bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9.exe

C:\Users\Admin\AppData\Local\Temp\bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9.exe
"C:\Users\Admin\AppData\Local\Temp\bf7114f025fff7dbc6b7aff8e4edb0dd8a7b53c3766429a3c5f10142609968f9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-54-0x000000000092C000-0x0000000000947000-memory.dmp

Filesize
108KB

Download
memory/1564-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1564-56-0x00000000020B1000-0x0000000002133000-memory.dmp

Filesize
520KB

Download
memory/1564-57-0x0000000002180000-0x000000000221F000-memory.dmp

Filesize
636KB

Download
memory/1564-58-0x0000000002220000-0x000000000234D000-memory.dmp

Filesize
1.2MB

Download
memory/1564-59-0x0000000000760000-0x000000000077F000-memory.dmp

Filesize
124KB

Download
memory/1564-60-0x00000000026A0000-0x00000000027A9000-memory.dmp

Filesize
1.0MB

Download
memory/1564-61-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1564-62-0x000000000092C000-0x0000000000947000-memory.dmp

Filesize
108KB

Download
memory/1564-63-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/1564-64-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/1564-65-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1564-66-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing