sodinokibi | 9b7cc74fcbfffd50a080590723e27f086d9a23e4c3d0c2292ac60bd2cc792440

General

Target

9b7cc74fcbfffd50a080590723e27f086d9a23e4c3d0c2292ac60bd2cc792440.dll
Size

223KB
MD5

9b018a9440a9334aeda9213fa4371e64
SHA1

ffc9fc56d82635b6e670486d83a5d226a61fab97
SHA256

9b7cc74fcbfffd50a080590723e27f086d9a23e4c3d0c2292ac60bd2cc792440
SHA512

95f84391098e7815390d7ef6f885fd5fe056930a6c7cdc78dd98a84113f517a2c4c6ab9bd8b1e1e9ce27f47079261da251930b540651f082cc008a12533ccbfe
SSDEEP

3072:P4Rcps1J/uBWxQ3aZKK3zeQYi83baZa+07APyzj/fuKvYsAM:P4RcpEm4JKK6Q/5DHA/fln

Score

10^/10

sodinokibi $2a$10$bqxuxhq/klnbsjwnllagn.9hwa2bun7ie9kyxyva7n6dm66qoybqm 6772 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$BqxuXHQ/KLnbsjWnllagN.9hwa2Bun7ie9KYXYVa7n6dm66QOYBqm

Campaign

6772

Decoy

sachnendoc.com

adultgamezone.com

rumahminangberdaya.com

gratispresent.se

schoellhammer.com

ctrler.cn

exenberger.at

fatfreezingmachines.com

admos-gleitlager.de

fiscalsort.com

acomprarseguidores.com

urclan.net

streamerzradio1.site

oncarrot.com

plantag.de

bouncingbonanza.com

eglectonk.online

cleliaekiko.online

renergysolution.com

kaminscy.com

Attributes

net
false
pid
$2a$10$BqxuXHQ/KLnbsjWnllagN.9hwa2Bun7ie9KYXYVa7n6dm66QOYBqm
prc
NSCTOP
dlomaintsvcu
Smc
encsvc
powerpnt
kavfsscs
kavfswp
AmitiAvSrv
lmibackupvssservice
outlook
oracle
Microsoft.exchange.store.worker.exe
avgadmsv
dbeng50
Rtvscan
thunderbird
wordpad
mspub
synctime
sqbcoreservice
xfssvccon
BackupUpdater
kavfs
steam
Sage.NA.AT_AU.SysTray
ccSetMgr
ccSvcHst
onenote
thebat
SPBBCSvc
dbsnmp
ocssd
tbirdconfig
ocomm
sql
ShadowProtectSvc
mydesktopqos
msaccess
visio
mydesktopservice
agntsvc
LogmeInBackupService
firefox
isqlplussvc
ocautoupds
BackupExtender
BackupMaint
TSSchBkpService
klnagent
infopath
BackupAgent
DLOAdminSvcu
CarboniteUI
winword
excel
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
6772
svc
msseces
DsSvc
sppsvc
macmnsvc
ViprePPLSvc
TMBMServer
Microsoft.exchange.store.worker.exe
VeeamMountSvc
"Sage 100c Advanced 2017 (9917)"
"Sophos Endpoint Defense Service"
Altaro.SubAgent.N2.exe
"Sophos System Protection Service"
"Sophos Clean Service"
ds_notifier
AzureADConnectAuthenticationAgent
VeeamTransportSvc
AzureADConnectHealthSyncMonitor
masvc
"StorageCraft Raw Agent"
MSSQLFDLauncher$TESTBACKUP02DEV
AltiBack
svcGenericHost
ADSync
"ofcservice"
HuntressAgent
AltiPhoneServ
"SQLServer Reporting Services (MSSQLSERVER)"
mfemms
psqlWGE
AzureADConnectHealthSyncInsights
ReportServer
MSSQLFDLauncher
"Sophos Web Control Service"
Code42Service
"Sophos Safestore Service"
"TeamViewer"
ThreadLocker
"Sophos File Scanner Service"
"SQLServer Integration Services 12.0"
SQLTELEMETRY$MSGPMR
SQLSERVERAGENT
"ds_notifier"
MsDtsServer120
Telemetryserver
sqlservr
KaseyaAgent
Amsp
MSSQLFDLauncher$SQLEXPRESS
SQLTELEMETRY
KaseyaAgentEndpoint
AltiCTProxy
ds_agent
LTSvcMon
SQLWriter
AUService
MSSQLSERVER
ofcservice
Altaro.UI.Service.exe
"Amsp"
SQLTELEMETRY$SQLEXPRESS
MSSQLServerADHelper100
klnagent
SSISTELEMETRY130
KAENDCHIPS906995744173948
VeeamNFSSvc
MSSQLLaunchpad$SQLEXPRESS
HuntressUpdater
LTService
"ds_agent"
Altaro.Agent.exe
"ProtectedStorage"
KACHIPS906995744173948
MySQL
VeeamHvIntegrationSvc
"StorageCraft Shadow Copy Provider"
MSSQLServerOLAPService
SBAMSvc
"SophosFIM"
MSSQL$QM
"Sophos AutoUpdate Service"
"SAVService"
McAfeeFramework
SQLBrowser
MSSQL$SQLEXPRESS
BackupExecAgentAccelerator
"swi_service"
SQLEXPRESSADV
"Sophos MCS Client"
MSSQL$HPWJA
MSSQL$MSGPMR
AltiFTPUploader
AzureADConnectAgentUpdater
"SAVAdminService"
mfevtp
VeeamDeploySvc
MBAMService
ProtectedStorage
"SntpService"
SSASTELEMETRY
Altaro.OffsiteServer.UI.Service.exe
VeeamDeploymentService
MsDtsServer130
sophossps
tmlisten
mfewc
KAVFS
Altaro.SubAgent.exe
mysqld
"Sophos MCS Agent"
"Sophos Health Service"
VipreAAPSvc
SQLAgent$MSGPMR
"Sage.NA.AT_AU.Service"
"Sage 100cloud Advanced 2020 (9920)"
VSS
Altaro.OffsiteServer.Service.exe
TeamViewer
TmCCSF
"ThreadLocker"
bedbg
ALTIVRM
ntrtscan
VeeamEndpointBackupSvc
Altaro.DedupService.exe
"SQLServer Analysis Services (MSSQLSERVER)"
"StorageCraft ImageReady"
ds_monitor
"ds_monitor"
kavfsscs
Altaro.HyperV.WAN.RemoteService.exe
MsDtsServer110
"swi_filter"
MSSQLTESTBACKUP02DEV
MSSQL$SQLEXPRESSADV
"Sophos Device Control Service"
SQLAgent$SQLEXPRESS

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1116 wrote to memory of 1068	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1068	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1068	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1068	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1068	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1068	1116	regsvr32.exe	regsvr32.exe
PID 1116 wrote to memory of 1068	1116	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9b7cc74fcbfffd50a080590723e27f086d9a23e4c3d0c2292ac60bd2cc792440.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\9b7cc74fcbfffd50a080590723e27f086d9a23e4c3d0c2292ac60bd2cc792440.dll
2⤵
PID:1068

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-55-0x0000000000000000-mapping.dmp

Download
memory/1068-56-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/1068-57-0x0000000010000000-0x0000000014036000-memory.dmp

Filesize
64.2MB

Download
memory/1068-58-0x0000000002220000-0x000000000624D000-memory.dmp

Filesize
64.2MB

Download
memory/1116-54-0x000007FEFBDD1000-0x000007FEFBDD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing