Overview

overview

10

Static

static

ad0ce2e8bb...80.dll

windows7-x64

10

ad0ce2e8bb...80.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    37s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2023 16:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ad0ce2e8bb206cf3395fcc719622fa062af4d420065296139f35e87f42e86180.dll

  • Size

    516KB

  • MD5

    9acaeeacb9933d4fc0047df1721b9c7d

  • SHA1

    a8fa75537c14c918c819255ae8e8cb44ece47b8f

  • SHA256

    ad0ce2e8bb206cf3395fcc719622fa062af4d420065296139f35e87f42e86180

  • SHA512

    0920490afa6758ed991827fdcb56959ba7506fbed3ecafac4fa70fff1dc0ed619db282e97d060afac5265f4621675b3670456c8e5dcbaab0c098c56852ef1ade

  • SSDEEP

    6144:1dy/ujpqLaUIkF+6R0dpFHfmU8KAJnj2jQjYGvDfRr3toAnE1ohduyMaKG8Hs:1sujpq19RoFgJjQ0V3nnEOhduyMN5Hs

Score
10/10
sodinokibi$2a$10$bqxuxhq/klnbsjwnllagn.9hwa2bun7ie9kyxyva7n6dm66qoybqm6772ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$BqxuXHQ/KLnbsjWnllagN.9hwa2Bun7ie9KYXYVa7n6dm66QOYBqm

Campaign

6772

Decoy

sachnendoc.com

adultgamezone.com

rumahminangberdaya.com

gratispresent.se

schoellhammer.com

ctrler.cn

exenberger.at

fatfreezingmachines.com

admos-gleitlager.de

fiscalsort.com

acomprarseguidores.com

urclan.net

streamerzradio1.site

oncarrot.com

plantag.de

bouncingbonanza.com

eglectonk.online

cleliaekiko.online

renergysolution.com

kaminscy.com
Attributes
  • net

    false

  • pid

    $2a$10$BqxuXHQ/KLnbsjWnllagN.9hwa2Bun7ie9KYXYVa7n6dm66QOYBqm

  • prc

    NSCTOP

    dlomaintsvcu

    Smc

    encsvc

    powerpnt

    kavfsscs

    kavfswp

    AmitiAvSrv

    lmibackupvssservice

    outlook

    oracle

    Microsoft.exchange.store.worker.exe

    avgadmsv

    dbeng50

    Rtvscan

    thunderbird

    wordpad

    mspub

    synctime

    sqbcoreservice

    xfssvccon

    BackupUpdater

    kavfs

    steam

    Sage.NA.AT_AU.SysTray

    ccSetMgr

    ccSvcHst

    onenote

    thebat

    SPBBCSvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    6772

  • svc

    msseces

    DsSvc

    sppsvc

    macmnsvc

    ViprePPLSvc

    TMBMServer

    Microsoft.exchange.store.worker.exe

    VeeamMountSvc

    "Sage 100c Advanced 2017 (9917)"

    "Sophos Endpoint Defense Service"

    Altaro.SubAgent.N2.exe

    "Sophos System Protection Service"

    "Sophos Clean Service"

    ds_notifier

    AzureADConnectAuthenticationAgent

    VeeamTransportSvc

    AzureADConnectHealthSyncMonitor

    masvc

    "StorageCraft Raw Agent"

    MSSQLFDLauncher$TESTBACKUP02DEV

    AltiBack

    svcGenericHost

    ADSync

    "ofcservice"

    HuntressAgent

    AltiPhoneServ

    "SQLServer Reporting Services (MSSQLSERVER)"

    mfemms

    psqlWGE

    AzureADConnectHealthSyncInsights

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad0ce2e8bb206cf3395fcc719622fa062af4d420065296139f35e87f42e86180.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\ad0ce2e8bb206cf3395fcc719622fa062af4d420065296139f35e87f42e86180.dll
      2⤵
        PID:696

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/696-55-0x0000000000000000-mapping.dmp
      Download
    • memory/696-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/696-57-0x0000000002040000-0x0000000002350000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/696-58-0x0000000002040000-0x0000000002350000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/1516-54-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp
      Filesize

      8KB

      Download