Analysis
-
max time kernel
124s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
29-11-2023 13:29
Behavioral task
behavioral1
Sample
sodinokibi.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
sodinokibi.exe
Resource
win10v2004-20231127-en
General
-
Target
sodinokibi.exe
-
Size
143KB
-
MD5
a3749c66f65d247d8a6fae1be26d3ef9
-
SHA1
c394464bba56e62ddfe2c9073932fb656fb78b6c
-
SHA256
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c
-
SHA512
65bc1dba7e4de098e6b27b13b1e0723f703f645e4a4c6e53b7b03ec096a70d48ec2aca7e8bcd911ced61bab35e95983510604421ef35a593278414bfbb1cb01c
-
SSDEEP
3072:3Bh3AiRWWozLbi4eTMlwDCnu/9GB96W/y1cuJ:R6i4W8bnWJ/oB9wcu
Malware Config
Extracted
sodinokibi
5
367
craftingalegacy.com
g2mediainc.com
brinkdoepke.eu
vipcarrental.ae
autoteamlast.de
hostastay.com
gavelmasters.com
ronaldhendriks.nl
successcolony.com.ng
medicalsupportco.com
kompresory-opravy.com
sveneulberg.de
oththukaruva.com
voetbalhoogeveen.nl
selected-minds.de
log-barn.co.uk
fsbforsale.com
jobkiwi.com.ng
ivancacu.com
11.in.ua
irizar.com
colored-shelves.com
soundseeing.net
scotlandsroute66.co.uk
hawaiisteelbuilding.com
mindfuelers.com
dentourage.com
hekecrm.com
finsahome.co.uk
cormanmarketing.com
morgansconsult.com
dnqa.co.uk
frimec-international.es
worldproskitour.com
csaballoons.com
krishnabrawijaya.com
tatyanakopieva.ru
silkeight.com
publicompserver.de
letsstopsmoking.co.uk
anleggsregisteret.no
arearugcleaningnyc.com
diverfiestas.com.es
lovcase.com
alltagsrassismus-entknoten.de
lassocrm.com
boyfriendsgoal.site
mbuildinghomes.com
santastoy.store
citiscapes-art.com
unislaw-narty.pl
envomask.com
patassociation.com
luvbec.com
keuken-prijs.nl
therapybusinessacademy.com
baikalflot.ru
piestar.com
diakonie-weitramsdorf-sesslach.de
klapanvent.ru
fysiotherapierijnmond.nl
avis.mantova.it
fla.se
sjtpo.org
kroophold-sjaelland.dk
alharsunindo.com
tothebackofthemoon.com
chainofhopeeurope.eu
smartmind.net
akcadagofis.com
bundan.com
graygreenbiomedservices.com
dogsunlimitedguide.com
rvside.com
davedavisphotos.com
johnstonmingmanning.com
mangimirossana.it
welovecustomers.fr
kenmccallum.com
glas-kuck.de
theboardroomafrica.com
slideevents.be
omegamarbella.com
zdrowieszczecin.pl
fotoslubna.com
mursall.de
forextimes.ru
hiddensee-buhne11.de
girlish.ae
motocrosshideout.com
billyoart.com
eafx.pro
patriotcleaning.net
renehartman.nl
xn--80addfr4ahr.dp.ua
speakaudible.com
magrinya.net
der-stempelking.de
trivselsguide.dk
mondolandscapes.com
nginx.com
voice2biz.com
hoteltantra.com
casinodepositors.com
wallflowersandrakes.com
bakingismyyoga.com
traitware.com
avtoboss163.ru:443
hvitfeldt.dk
natturestaurante.com.br
onlinemarketingsurgery.co.uk
brownswoodblog.com
reizenmetkinderen.be
mneti.ru
linkbuilding.life
levencovka.ru
bilius.dk
p-ride.live
tecleados.com
cl0nazepamblog.com
atelierkomon.com
oexebusiness.com
miscbo.it
kickittickets.com
rivermusic.nl
airserviceunlimited.com
pureelements.nl
subyard.com
pinkxgayvideoawards.com
eos-horlogerie.com
craftron.com
nationnewsroom.com
alaskaremote.com
askstaffing.com
springfieldplumbermo.com
ziliak.com
berdonllp.com
citydogslife.com
tradenavigator.ch
witraz.pl
jlwilsonbooks.com
nvisionsigns.com
espaciopolitica.com
singletonfinancial.com
ideamode.com
clinic-beethovenstrasse-ag.ch
precisetemp.com
kellengatton.com
bruut.online
matteoruzzaofficial.com
pourlabretagne.bzh
goeppinger-teppichreinigung.de
rhino-storage.co.uk
xtensifi.com
hm-com.com
vvego.com
startuplive.org
easydental.ae
alisodentalcare.com
weddingceremonieswithtim.com
tutvracks.com
harleystreetspineclinic.com
dantreranch.com
docarefoundation.org
lexced.com
palmecophilippines.com
louiedager.com
digitale-elite.de
sber-biznes.com
stabilisateur.fr
logosindustries.com
azloans.com
customroasts.com
mikegoodfellow.co.uk
annenymus.com
larchwoodmarketing.com
wineandgo.hu
smartspeak.com
nepal-pictures.com
aslog.fr
aceroprime.com
zorgboerderijravensbosch.nl
solutionshosting.co.uk
elex.is
mike.matthies.de
coachpreneuracademy.com
efficiencyconsulting.es
livelai.com
victorvictoria.com
signamedia.de
min-virksomhed.dk
sycamoregreenapts.com
ultimatelifesource.com
purepreprod4.com
kausette.com
luvinsburger.fr
mariamalmahdi.com
acornishstudio.co.uk
nepressurecleaning.com
malevannye.ru
banukumbak.com
metallbau-hartmann.eu
globalskills.pt
denhaagfoodie.nl
cxcompany.com
wordpress.idium.no
bcmets.info
koncept-m.ru
xn--80abehgab4ak0ddz.xn--p1ai
altitudeboise.com
bd2fly.com
foerderverein-vatterschule.de
rhino-turf.com
suitesartemis.gr
thiagoperez.com
kvetymichalovce.sk
netadultere.fr
sololibrerie.it
global-migrate.com
indiebizadvocates.org
juergenblaetz.de
signededenroth.dk
onlinetvgroup.com
fazagostar.co
stagefxinc.com
drbrianhweeks.com
ketomealprep.academy
saberconcrete.com
entdoctor-durban.com
oscommunity.de
chomiksy.net
latteswithleslie.com
annida.it
edrickennedymacfoy.com
midwestschool.org
michal-s.co.il
kartuindonesia.com
claudiakilian.de
thegetawaycollective.com
matthieupetel.fr
condormobile.fr
astrographic.com
marmarabasin.com
kelsigordon.com
forskolinslimeffect.net
cardsandloyalty.com
electricianul.com
buffdaddyblog.com
jandhpest.com
albcleaner.fr
concontactodirecto.com
heuvelland-oaze.nl
fixx-repair.com
awaisghauri.com
kiraribeaute-nani.com
fridakids.com
cascinarosa33.it
3daywebs.com
boloria.de
endstarvation.com
switch-made.com
aoyama.ac
universelle.fr
bodet150ans.com
mazift.dk
aciscomputers.com
mariannelemenestrel.com
explora.nl
haus-landliebe.de
geoweb.software
pansionatblago.ru
1deals.com
stralsund-ansichten.de
projektparkiet.pl
gsconcretecoatings.com
banksrl.co.za
bourchier.org
livedeveloper.com
stressreliefadvice.com
lagschools.ng
m2graph.fr
look.academy
turing.academy
daveystownhouse.com
myfbateam.com
penumbuhrambutkeiskei.com
imaginekithomes.co.nz
devplus.be
ruggestar.ch
proffteplo.com
oro.ae
paprikapod.com
drnelsonpediatrics.com
tramadolhealth.com
thehovecounsellingpractice.co.uk
speiserei-hannover.de
arthakapitalforvaltning.dk
skoczynski.eu
hotjapaneselesbian.com
cssp-mediation.org
cp-bap.de
ygallerysalonsoho.com:443
atma.nl
metcalfe.ca
insane.agency
sochi-okna23.ru
carolynfriedlander.com
liverpoolabudhabi.ae
hartofurniture.com
boomerslivinglively.com
moira-cristescu.com
texanscan.org
bohrlochversicherung.info
birthplacemag.com
primemarineengineering.com
angelsmirrorus.com
qandmmusiccenter.com
die-immo-agentur.de
the-beauty-guides.com
levelseven.be
catalyseurdetransformation.com
mollymccarthydesign.com
hutchstyle.co.uk
oportowebdesign.com
phoenixcrane.com
olry-cloisons.fr
alnectus.com
testitjavertailut.net
monstarrsoccer.com
sellthewrightway.com
cotton-avenue.co.il
lifeinbreaths.com
alwaysdc.com
rsidesigns.com
leadforensics.com
premiumweb.com.ua:443
rozmata.com
opticahubertruiz.com
ntinasfiloxenia.gr
so-sage.fr
polynine.com
k-zubki.ru
pisofare.co
tages-geldvergleich.de
funworx.de
smarttourism.academy
theater-lueneburg.de
bajova.sk
yvesdoin-aquarelles.fr
leatherjees.com
sarahspics.co.uk
yourcosmicbeing.com
rs-danmark.dk
simpleitsolutions.ch
makingmillionaires.net
epsondriversforwindows.com
ayudaespiritualtamara.com
trevi-vl.ru
vapiano.fr
antesacademy.it
rarefoods.ro
belinda.af
dennisverschuur.com
sprintcoach.com
martinipstudios.com
ddmgen.com
block-optic.com
almamidwifery.com
ncn.nl
alpesiberie.com
palmenhaus-erfurt.de
bcabattoirs.org
circlecitydj.com
slotenmakerszwijndrecht.nl
innersurrection.com
aheadloftladders.co.uk
angelika-schwarz.com
lapponiasafaris.com
jonnyhooley.com
oraweb.net
donau-guides.eu
istantidigitali.com
optigas.com
asiaartgallery.jp
limounie.com
rishigangoly.com
taulunkartano.fi
osn.ro
marcandy.com
jacquesgarcianoto.com
thepixelfairy.com
mariajosediazdemera.com
leopoldineroux.com
goodboyscustom.com
energosbit-rp.ru
eatyoveges.com
mac-computer-support-hamburg.de
tilldeeke.de
aberdeenartwalk.org
encounter-p.net
andreaskildegaard.dk
tweedekansenloket.nl
amorbellezaysalud.com
palema.gr
9nar.com
lunoluno.com
betterce.com
beauty-traveller.com
alattekniksipil.com
craftstone.co.nz
alene.co
jollity.hu
chorusconsulting.net
motocrossplace.co.uk
mieleshopping.it
mundo-pieces-auto.fr
richardkershawwines.co.za
salonlamar.nl
fotoeditores.com
axisoflove.org:443
ledyoucan.com
metroton.ru
apiarista.de
cmascd.com
karelinjames.com
gosouldeep.com
nieuwsindeklas.be
mediogiro.com.ar
jax-interim-and-projectmanagement.com
elliemaccreative.wordpress.com
eshop.design
billscars.net
verbouwingsdouche.nl
test-teleachat.fr
mazzaropi.com.br
finnergo.eu
jobscore.com
pedmanson.com
belofloripa.be
littlesaints.academy
eastgrinsteadwingchun.com
pharmeko-group.com
bridalcave.com
georgemuncey.com
glennverschueren.be
jag.me
groovedealers.ru
internalresults.com
wyreforest.net
uncensoredhentaigif.com
centuryvisionglobal.com
skyboundnutrition.co.uk
adedesign.com
thesilkroadny.com
fluzfluzrewards.com
hotelturbo.de
skidpiping.de
gurutechnologies.net
nxtstg.org
chris-anne.com
billigeflybilletter.dk
vitormmcosta.com
newonestop.com
adterium.com
janellrardon.com
crestgood.com
chatterchatterchatter.com
skooppi.fi
sealgrinderpt.com
towelroot.co
janasfokus.com
zuerich-umzug.ch
biketruck.de
iactechnologies.net
artcase.pl
otpusk.zp.ua
lookandseen.com
kristianboennelykke.dk
mahikuchen.com
kryptos72.com
supercarhire.co.uk
acb-gruppe.ch
stathmoulis.gr
globalcompliancenews.com
malzomattalar.com
peninggibadan.co.id
slotspinner.com
galaniuklaw.com
deziplan.ru
toranjtuition.org
loysonbryan.com
physio-lang.de
husetsanitas.dk
ced-elec.com
bescomedical.de
omnicademy.com
angeleyezstripclub.com
sppdstats.com
the3-week-diet.net
furland.ru
carmel-york.com
schlagbohrmaschinetests.com
golfclublandgoednieuwkerk.nl
maryairbnb.wordpress.com
legundschiess.de
schroederschoembs.com
subquercy.fr
chatberlin.de
happylublog.wordpress.com
fitnessblenderstory.com
schulz-moelln.de
justaroundthecornerpetsit.com
clemenfoto.dk
tanatek.com
rino-gmbh.com
soncini.ch
anchelor.com
shortysspices.com
charlottelhanna.com
avisioninthedesert.com
spartamovers.com
cmeow.com
transifer.fr
futurenetworking.com
theatre-embellie.fr
plbinsurance.com
adabible.org
zwemofficial.nl
triplettagaite.fr
fidelitytitleoregon.com
racefietsenblog.nl
keyboardjournal.com
a-zpaperwork.eu
relevantonline.eu
secrets-clubs.co.uk
utilisacteur.fr
ya-elka.ru
paardcentraal.nl
charlesfrancis.photos
floweringsun.org
b3b.ch
photographycreativity.co.uk
pro-gamer.pl
dentallabor-luenen.de
modamarfil.com
alabamaroofingllc.com
noda.com.ua
pajagus.fr
cincinnatiphotocompany.org
nevadaruralhousingstudies.org
eksperdanismanlik.com
kombi-dress.com
gardenpartner.pl
lesyeuxbleus.net
broccolisoep.nl
putzen-reinigen.com
nykfdyrehospital.dk
bringmehope.org
tetameble.pl
k-v-f.de
pinthelook.com
epicjapanart.com
apmollerpension.com
laaisterplakky.nl
protoplay.ca
gatlinburgcottage.com
tchernia-conseil.fr
biblica.com
prodentalblue.com
from02pro.com
brighthillgroup.com
mediabolmong.com
galatee-couture.com
humanviruses.org
katherinealy.com
cookinn.nl
sshomme.com
innovationgames-brabant.nl
limmortelyouth.com
theintellect.edu.pk
triplettabordeaux.fr
tbalp.co.uk
thisprettyhair.com
webforsites.com
parisschool.ru
mind2muscle.nl
laylavalentine.com
allinonecampaign.com
spirello.nl
heimdalbygg.no
kosten-vochtbestrijding.be
brisbaneosteopathic.com.au
margaretmcshane.com
adaduga.info
jayfurnitureco.com
agrifarm.dk
neolaiamedispa.com
redpebblephotography.com
poems-for-the-soul.ch
phukienbepthanhdat.com
forumsittard.nl
hnkns.com
dentalcircle.com
elitkeramika-shop.com.ua
rossomattonecase.it
direitapernambuco.com
catchup-mag.com
pubcon.com
cainlaw-okc.com
napisat-pismo-gubernatoru.ru:443
line-x.co.uk
riffenmattgarage.ch
liveyourheartout.co
yayasanprimaunggul.org
itheroes.dk
babysitting-hk.helpergo.co
skolaprome.eu
hepishopping.com
sytzedevries.com
xn--billigafrgpatroner-stb.se
stoneridgemontessori.com
buerocenter-butzbach-werbemittel.de
topvijesti.net
bluemarinefoundation.com
akwaba-safaris.com
studionumerik.fr
hawthornsretirement.co.uk
mamajenedesigns.com
grancanariaregional.com
campinglaforetdetesse.com
molade.nl
jeanmonti.com
valiant-voice.com
dr-vita.de
altocontatto.net
nicksrock.com
profibersan.com
agenceassemble.fr
c-sprop.com
jalkapuu.net
walterman.es
nrgvalue.com
web865.com
haard-totaal.nl
buzzneakers.com
5pointpt.com
dieetuniversiteit.nl
parksideseniorliving.net
teamsegeln.ch
ciga-france.fr
tellthebell.website
zealcon.ae
ramirezprono.com
ronielyn.com
jimprattmediations.com
mrmac.com
eventosvirtualesexitosos.com
egpu.fr
ikadomus.com
t3brothers.com
masecologicos.com
initconf.com
jlgraphisme.fr
ykobbqchicken.ca
dierenambulancealkmaar.nl
business-basic.de
leansupremegarcinia.net
uci-france.fr
leloupblanc.gr
saint-malo-developpement.fr
lmmont.sk
outstandingminialbums.com
advanced-removals.co.uk
bumbipdeco.site
augen-praxisklinik-rostock.de
vdolg24.online
circuit-diagramz.com
specialtyhomeservicesllc.com
onesynergyinternational.com
fi-institutionalfunds.com
apogeeconseils.fr
yournextshoes.com
campusescalade.com
mrcar.nl
kafkacare.com
metriplica.academy
narca.net
ikzoekgod.be
pvandambv.nl
auto-opel.ro
bellesiniacademy.org
yuanshenghotel.com
sweetz.fr
bonitabeachassociation.com
sambaglow.com
druktemakersheerenveen.nl
renderbox.ch
latableacrepes-meaux.fr
neonodi.be
lovetzuchia.com
cc-experts.de
awaitspain.com
schluesseldienste-hannover.de
cap29010.it
alcye.com
kookooo.com
richardmaybury.co.uk
cesep2019.com
rubyaudiology.com
smartercashsystem.com
bagaholics.in
loparnille.se
cuadc.org
mensemetgesigte.co.za
terraflair.de
triavlete.com
baita.ac
rtc24.com
pixelhealth.net
molinum.pt
randyabrown.com
imajyuku-sozoku.com
rattanwarehouse.co.uk
imagine-entertainment.com
brannbornfastigheter.se
chinowarehousespace.com
go.labibini.ch
tesisatonarim.com
enews-qca.com
ahgarage.com
reygroup.pt
artvark.nl
production-stills.co.uk
directique.com
skinkeeper.li
pankiss.ru
silverbird.dk
raeoflightmusic.com
computer-place.de
nbva.co.uk
volta.plus
jefersonalessandro.com
rename.kz
myplaywin3.com
rentingwell.com
muller.nl
operativadigital.com
perceptdecor.com
greatofficespaces.net
stanleyqualitysystems.com
yourhappyevents.fr
perfectgrin.com
wasnederland.nl
inewsstar.com
arazi.eus
xn--ziinoapte-6ld.ro
gazelle-du-web.com
lumturo.academy
innervisions-id.com
memphishealthandwellness.com
90nguyentuan.com
andermattswisswatches.ch
promus.ca
bayshoreelite.com
mesajjongeren.nl
agencewho-aixenprovence.fr
qwikcoach.com
pazarspor.org.tr
creohn.de
kamin-somnium.de
kuriero.pro
maxcube24.com.ua
expohomes.com
mayprogulka.ru
mgimalta.com
spectamarketingdigital.com.br
alexwenzel.de
fskhjalmar.se
oncarrot.com
pokemonturkiye.com
bg.szczecin.pl
werkzeugtrolley.net
5thactors.com
geitoniatonaggelon.gr
muni.pe
aktivfriskcenter.se
dmlcpa.com
frankgoll.com
devus.de
landgoedspica.nl
handyman-silkeborg.dk
queertube.net
gratiocafeblog.wordpress.com
techybash.com
karmeliterviertel.com
parentsandkids.com
grupoexin10.com
shrinkingplanet.com
hom-frisor.dk
bluelakevision.com
grafikstudio-visuell.de
pxsrl.it
mindsparkescape.com
iexpert99.com
lyricalduniya.com
animation-pro.co.uk
site.markkit.com.br
bluetenreich-brilon.de
mslp.org
licensed-public-adjuster.com
vedsegaard.dk
drvoip.com
satoblog.org
flossmoordental.com
bmw-i-pure-impulse.com
biodentify.ai
iron-mine.ru
redctei.co
bjornvanvulpen.nl
breakluckrecords.com
fta-media.com
domaine-des-pothiers.com
invela.dk
cymru.futbol
hinotruckwreckers.com.au
profiz.com
auberives-sur-vareze.fr
glende-pflanzenparadies.de
advancedeyecare.com
fanuli.com.au
bychowo.pl
catering.com
111firstdelray.com
mercadodelrio.com
interlinkone.com
greeneyetattoo.com
rapid5kloan.org
hensleymarketing.com
stage-infirmier.fr
ebible.co
lashandbrowenvy.com
sharonalbrightdds.com
collegetennis.info
photonag.com
ravage-webzine.nl
spacebel.be
johnkoen.com
unexplored.gr
thegrinningmanmusical.com
martha-frets-ceramics.nl
basindentistry.com
scietech.academy
wademurray.com
tzn.nu
bratek-immobilien.de
letterscan.de
n-newmedia.de
gta-jjb.fr
bodymindchallenger.com
veggienessa.com
suonenjoen.fi
dinedrinkdetroit.com
acumenconsultingcompany.com
hameghlim.com
quitescorting.com
dcc-eu.com
solidhosting.nl
ceocenters.com
hospitalitytrainingsolutions.co.uk
amyandzac.com
radishallgood.com
lgiwines.com
factorywizuk.com
dibli.store
lollachiro.com
goodherbalhealth.com
dinecorp.com
stitch-n-bitch.com
kdbrh.com
wribrazil.com
bubbalucious.com
rechtenplicht.be
aquacheck.co.za
buonabitare.com
framemyballs.com
campusce.com
datatri.be
eyedoctordallas.com
holocine.de
lisa-poncon.fr
designimage.ae
descargandoprogramas.com
jdscenter.com
blucamp.com
liepertgrafikweb.at
beandrivingschool.com.au
ludoil.it
acibademmobil.com.tr
brunoimmobilier.com
jglconsultancy.com
ingresosextras.online
wirmuessenreden.com
sachainchiuk.com
airvapourbarrier.com
lattalvor.com
powershell.su
advance-refle.com
housesofwa.com
blueridgeheritage.com
advesa.com
jaaphoekzema.nl
ox-home.com
sunsolutions.es
ufovidmag.com
markseymourphotography.co.uk
wrinstitute.org
focuskontur.com
comoserescritor.com
blavait.fr
evsynthacademy.org
pilotgreen.com
leijstrom.com
janmorgenstern.com
gaearoyals.com
nalliasmali.net
2020hindsight.info
scentedlair.com
greenrider.nl
lsngroupe.com
orchardbrickwork.com
rokthetalk.com
prometeyagro.com.ua
ijsselbeton.nl
kryddersnapsen.dk
baumfinancialservices.com
mjk.digital
corporacionrr.com
o2o-academy.com
manzel.tn
smartworkplaza.com
christopherhannan.com
carsten.sparen-it.de
peppergreenfarmcatering.com.au
reputation-medical.online
christianscholz.de
delegationhub.com
hostingbangladesh.net
nauticmarine.dk
ocduiblog.com
jakubrybak.com
teutoradio.de
zaczytana.com
zumrutkuyutemel.com
duthler.nl
dayenne-styling.nl
cleanroomequipment.ie
naukaip.ru
activeterroristwarningcompany.com
breathebettertolivebetter.com
tastevirginia.com
awag-blog.de
watchsale.biz
whoopingcrane.com
ilovefullcircle.com
bulyginnikitav.000webhostapp.com
saboboxtel.uk
zinnystar.com
factoriareloj.com
internestdigital.com
cops4causes.org
affligemsehondenschool.be
achetrabalhos.com
curtsdiscountguns.com
lidkopingsnytt.nu
cac2040.com
khtrx.com
barbaramcfadyenjewelry.com
agora-collectivites.com
nuohous.com
agendatwentytwenty.com
goddardleadership.org
fascaonline.com
opt4cdi.com
domilivefurniture.com
amelielecompte.wordpress.com
burg-zelem.de
mustangmarketinggroup.com
strauchs-wanderlust.info
aidanpublishing.co.uk
johnsonweekly.com
bavovrienden.nl
skyscanner.ro
jobstomoveamerica.org
etgdogz.de
abulanov.com
nourella.com
ncjc.ca
mrkluttz.com
ilveshistoria.com
frameshift.it
eurethicsport.eu
paradigmlandscape.com
jmmartinezilustrador.com
ninjaki.com
unboxtherapy.site
enactusnhlstenden.com
afbudsrejserallinclusive.dk
deduktia.fi
endlessrealms.net
fire-space.com
qrs-international.com
tieronechic.com
nutriwell.com.sg
trainiumacademy.com
kerstliedjeszingen.nl
bendel-partner.de
placermonticello.com
andrealuchesi.it
professionetata.com
happycatering.de
rolleepollee.com
thestudio.academy
linearete.com
magnetvisual.com
richardiv.com
baptistdistinctives.org
stringnosis.academy
vitoriaecoturismo.com.br
fbmagazine.ru
agriturismocastagneto.it
xrresources.com
atrgroup.it
premier-iowa.com
pays-saint-flour.fr
o90.dk
four-ways.com
scholarquotes.com
the5thquestion.com
shortsalemap.com
hostaletdelsindians.es
michaelfiegel.com
drbenveniste.com
arabianmice.com
the-cupboard.co.uk
benchbiz.com
cyberpromote.de
edvestors.org
rentsportsequip.com
fann.ru
nexstagefinancial.com
bookingwheel.com
dreamvoiceclub.org
jameswilliamspainting.com
ownidentity.com
thenalpa.com
denverwynkoopdentist.com
gbk-tp1.de
animalfood-online.de
hypogenforensic.com
parseport.com
azerbaycanas.com
mediahub.co.nz
julielusktherapy.com
topautoinsurers.net
bertbutter.nl
distrifresh.com
guohedd.com
amco.net.au
teethinadaydentalimplants.com
kemtron.fr
sbit.ag
wg-heiligenstadt.de
rizplakatjaya.com
-
net
true
-
pid
5
-
prc
wordpad.exe
outlook.exe
tbirdconfig.exe
agntsvc.exe
thebat.exe
mydesktopservice.exe
sqbcoreservice.exe
thunderbird.exe
ocomm.exe
excel.exe
thebat64.exe
steam.exe
xfssvccon.exe
firefoxconfig.exe
sqlagent.exe
ocssd.exe
mydesktopqos.exe
msaccess.exe
isqlplussvc.exe
mspub.exe
winword.exe
sqlbrowser.exe
dbeng50.exe
sqlservr.exe
oracle.exe
encsvc.exe
powerpnt.exe
dbsnmp.exe
infopath.exe
ocautoupds.exe
mysqld_opt.exe
visio.exe
msftesql.exe
mysqld_nt.exe
synctime.exe
sqlwriter.exe
mysqld.exe
onenote.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
367
Extracted
C:\Users\1i6w04lw1-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1EF510E36FA382CA
http://decryptor.top/1EF510E36FA382CA
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
sodinokibi.exedescription ioc process File opened (read-only) \??\L: sodinokibi.exe File opened (read-only) \??\M: sodinokibi.exe File opened (read-only) \??\V: sodinokibi.exe File opened (read-only) \??\G: sodinokibi.exe File opened (read-only) \??\J: sodinokibi.exe File opened (read-only) \??\K: sodinokibi.exe File opened (read-only) \??\Q: sodinokibi.exe File opened (read-only) \??\E: sodinokibi.exe File opened (read-only) \??\H: sodinokibi.exe File opened (read-only) \??\T: sodinokibi.exe File opened (read-only) \??\W: sodinokibi.exe File opened (read-only) \??\X: sodinokibi.exe File opened (read-only) \??\Y: sodinokibi.exe File opened (read-only) \??\A: sodinokibi.exe File opened (read-only) \??\N: sodinokibi.exe File opened (read-only) \??\R: sodinokibi.exe File opened (read-only) \??\F: sodinokibi.exe File opened (read-only) \??\I: sodinokibi.exe File opened (read-only) \??\P: sodinokibi.exe File opened (read-only) \??\D: sodinokibi.exe File opened (read-only) \??\S: sodinokibi.exe File opened (read-only) \??\U: sodinokibi.exe File opened (read-only) \??\B: sodinokibi.exe File opened (read-only) \??\O: sodinokibi.exe File opened (read-only) \??\Z: sodinokibi.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
sodinokibi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1ldc0ngj7.bmp" sodinokibi.exe -
Drops file in Program Files directory 23 IoCs
Processes:
sodinokibi.exedescription ioc process File created \??\c:\program files (x86)\microsoft sql server compact edition\d60dff40.lock sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\1i6w04lw1-readme.txt sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\1i6w04lw1-readme.txt sodinokibi.exe File created \??\c:\program files\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\CompleteTrace.mpeg sodinokibi.exe File opened for modification \??\c:\program files\DismountRead.xsl sodinokibi.exe File opened for modification \??\c:\program files\FormatCompress.vdw sodinokibi.exe File opened for modification \??\c:\program files\SelectDisconnect.3gpp sodinokibi.exe File created \??\c:\program files\1i6w04lw1-readme.txt sodinokibi.exe File opened for modification \??\c:\program files\SetStep.odt sodinokibi.exe File opened for modification \??\c:\program files\TraceUpdate.svgz sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\1i6w04lw1-readme.txt sodinokibi.exe File created \??\c:\program files (x86)\1i6w04lw1-readme.txt sodinokibi.exe File opened for modification \??\c:\program files\FormatEnter.vsdx sodinokibi.exe File opened for modification \??\c:\program files\RestartWait.jtx sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\WatchWrite.mhtml sodinokibi.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\d60dff40.lock sodinokibi.exe File created \??\c:\program files (x86)\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\CheckpointSync.aiff sodinokibi.exe File opened for modification \??\c:\program files\ImportRequest.xps sodinokibi.exe File opened for modification \??\c:\program files\PublishSelect.html sodinokibi.exe File opened for modification \??\c:\program files\WatchStep.inf sodinokibi.exe -
Drops file in Windows directory 64 IoCs
Processes:
sodinokibi.exedescription ioc process File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4748bb972be4cdaa.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mscat32-dll_31bf3856ad364e35_6.1.7600.16385_none_dcd9059e393675cd.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase_31bf3856ad364e35_6.1.7601.17514_none_6c066d50910ecf5a_kmddsp.tsp_c999e400 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-linkinfo_31bf3856ad364e35_6.1.7600.16385_none_9eaece15f365da54_linkinfo.dll_2c1d3b5a sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgr.efi.mui_be5d0075 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-truetype-gulim_31bf3856ad364e35_6.1.7600.16385_none_a1815c1476403b50.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mprmsg.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_83579b73da6c0c21_mprmsg.dll.mui_210d8c31 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-msxml60.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c887b7719f9790a1_msxml6r.dll.mui_4516d602 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_en-us_919783112bf8b64b_serialui.dll.mui_7d29d2a3 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76_base_altgr.xml_da14b41b sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-e..gine-isam.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9a802c5593c58745_esent.dll.mui_e30e3b90 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c9f12eb68eff5150_newdev.exe.mui_6ce4084e sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d2590890fddbcebf_winload.efi.mui_35ee487d sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a11f76f021849262_oleres.dll.mui_ff00d4cb sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b25735420d36e896_iscsidsc.dll.mui_6acb64a6 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-t..rk-msimtf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e4d46cbfc094f384.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f_winmm.dll.mui_224f6445 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-imagesp1.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a229a98a77fae0f2.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-ntdll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cede4f0eaa33bc3b.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-rasserver_31bf3856ad364e35_6.1.7601.17514_none_1423e918b2cd2d4b_rasapi-dl.man_1c597019 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b4cd5acb2c49b651_ntmarta.dll.mui_027ef4fc sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5f3874d6c7dfca9f.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_51a9c0732ea27a7c_wudfx.mfl_ed9a43c5 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_53d84073101f061e.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_6.1.7600.16385_de-de_099b02651e31eb2c_iscsidsc.dll.mui_6acb64a6 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-shell32.resources_31bf3856ad364e35_6.1.7601.17514_es-es_5b7c8d693744aea4.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_lv-lv_359174e350f0ded0.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..truetype-couriernew_31bf3856ad364e35_6.1.7600.16385_none_32383eb7c6ebfd9b_couri.ttf_21733c5a sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_90f8da5e5f4ad243_comctl32.dll.mui_0da4e682 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_de-de_16322155c9df9531_wshtcpip.dll.mui_042165f9 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-msxml30.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_428b50a187d8119e_msxml3r.dll.mui_cd6e1e8f sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..cture-bsp.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cd82ef8cc53045c3_mswsock.dll.mui_d7c2a730 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5f087cbd507d8e79_wer.dll.mui_e68ddae7 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_6.1.7600.16385_none_63dee2821fc69fce_brdgcfg.dll_9efdd2e3 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_347a450f0c8bd52d_compstui.dll_a5f72f50 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_6.1.7600.16385_it-it_bc44a4374a4eacc6.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..ionengine.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_17eeca5539272d2f_scesrv.dll.mui_c6e979b7 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-winsock-legacy_31bf3856ad364e35_6.1.7600.16385_none_e33b8ccc72da5441.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_82ed82846d97d873_sdbinst.exe.mui_258ad624 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-htmlhelp.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_c04bc94bbf0132ec_hh.exe.mui_2744e397 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_61e865cf65610452.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-irdacoreprotocol_31bf3856ad364e35_6.1.7601.17514_none_ea0c02c127ba16bc_wshirda.dll_1775ca24 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_6.1.7601.17514_none_f4bf1aae2c981ecf_ws2_32.dll_89b90cb6 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d_bootmgr.efi.mui_be5d0075 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c067cb47e93eb5ab_modemui.dll.mui_a710bc71 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-shell32.resources_31bf3856ad364e35_6.1.7601.17514_es-es_5b7c8d693744aea4_shell32.dll.mui_19f538b4 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ef8490c876cbbf3a_certcli.dll.mui_1b6822cf sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7075301659287d94_samsrv.dll.mui_32250491 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-homegroup-listsvc_31bf3856ad364e35_6.1.7601.17514_none_cccd5bf59125cedc_listsvc.dll_c76b1498 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-lddmcore_31bf3856ad364e35_6.1.7601.17514_none_09ee9e0dfa2c4fbd.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1820774de6bd4d16.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-legacyhwui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_dd96457f653b542b.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-s..temclient.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2923fe40760e3420_winscard.dll.mui_4a82d97e sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-w..ck-legacy.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ee14e4b1ee589487_wsock32.dll.mui_18b23987 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_tr-tr_d745801abd777b10_comdlg32.dll.mui_ac8e62f4 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-e..orerframe.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3c186b53d67e9899_explorerframe.dll.mui_074caeb5 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-explorerframe_31bf3856ad364e35_6.1.7601.17514_none_20a30ed28a70711b.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4cbc6858ab8583f8.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\x86_microsoft-windows-irdacoreprotocol_31bf3856ad364e35_6.1.7601.17514_none_ea0c02c127ba16bc.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..lient-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_08eb1c04e4e36155_dhcpcore6.dll.mui_27872349 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-mlang_31bf3856ad364e35_6.1.7600.16385_none_b2d43d1ffdaf54e6_mlang.dll_211e02a3 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-u..em-config.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7a60e7beae811506.manifest sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-webio.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_002271384242c2c1_webio.dll.mui_e805c4b7 sodinokibi.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-ntdll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5b891838745ea9c0_ntdll.dll.mui_d908d391 sodinokibi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2804 vssadmin.exe -
Processes:
sodinokibi.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 sodinokibi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 sodinokibi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 sodinokibi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sodinokibi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sodinokibi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sodinokibi.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
sodinokibi.exepid process 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe 2484 sodinokibi.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2708 vssvc.exe Token: SeRestorePrivilege 2708 vssvc.exe Token: SeAuditPrivilege 2708 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
sodinokibi.execmd.exedescription pid process target process PID 2484 wrote to memory of 2692 2484 sodinokibi.exe cmd.exe PID 2484 wrote to memory of 2692 2484 sodinokibi.exe cmd.exe PID 2484 wrote to memory of 2692 2484 sodinokibi.exe cmd.exe PID 2484 wrote to memory of 2692 2484 sodinokibi.exe cmd.exe PID 2692 wrote to memory of 2804 2692 cmd.exe vssadmin.exe PID 2692 wrote to memory of 2804 2692 cmd.exe vssadmin.exe PID 2692 wrote to memory of 2804 2692 cmd.exe vssadmin.exe PID 2692 wrote to memory of 2804 2692 cmd.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe"C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\1i6w04lw1-readme.txtFilesize
6KB
MD50e725ba6f53d91bcd8cc85cfffc3e6c1
SHA1308333f67eba1f51199a5765c803b4468b6cc93c
SHA256601efddf29e83889748f7e5f9464c5f98cd4a03af89eafd97ca7f49446d968f3
SHA512f26fdd55a23c22cb800f3fb197799ac50414f4f20c66d2dee6a7d9394591b5089b69ccda6f8fca39234058d20fee0f7a60b6cb39989d118f482eb625af89a20d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b50de5836dab55c963f87460cc2682ba
SHA12197f372b5f9ee2feffe0dfdd9e773d05aafd849
SHA256918d85adc7285979a72a585565a28fe449c39ef8aada7b6c8a6698033a7e0efa
SHA512fb18390ef6968960f069d2a012b7fa3e2db658a8afd060d1b6cece06885c118307e5be21681883fde12e7ca9b8dd75858c74fe572e1aaf30529a308f0ffad01d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e848cc96686136c6c2d66db03dca65e2
SHA17b9b33220d99615be2959b710bd365c89ec255d4
SHA256c4b50726a964e511bfdaba0d5ac05aa6d9803f74b1bde1f262327dfece872740
SHA512889c884046dcbc1d170e1460d86b68bc85bc14fa32531c3ae2b53189eefabb2911befeb349e711d2f631ba89e53b2ebfd3d606134c8aa9d7de26a6fef379631a
-
C:\Users\Admin\AppData\Local\Temp\TarDBF4.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
memory/2484-4-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2484-13-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/2484-10-0x00000000002E0000-0x00000000002E6000-memory.dmpFilesize
24KB
-
memory/2484-8-0x0000000001190000-0x0000000001299000-memory.dmpFilesize
1.0MB
-
memory/2484-6-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2484-0-0x00000000012C0000-0x00000000012EE000-memory.dmpFilesize
184KB
-
memory/2484-11-0x00000000002E0000-0x00000000002E6000-memory.dmpFilesize
24KB
-
memory/2484-9-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2484-14-0x00000000012C0000-0x00000000012EE000-memory.dmpFilesize
184KB
-
memory/2484-15-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2484-16-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB
-
memory/2484-7-0x0000000000410000-0x000000000042F000-memory.dmpFilesize
124KB
-
memory/2484-5-0x0000000000DE0000-0x0000000000F0D000-memory.dmpFilesize
1.2MB
-
memory/2484-3-0x0000000000D40000-0x0000000000DDF000-memory.dmpFilesize
636KB
-
memory/2484-2-0x0000000000B20000-0x0000000000BE9000-memory.dmpFilesize
804KB
-
memory/2484-1-0x0000000000070000-0x000000000007A000-memory.dmpFilesize
40KB