Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2024 22:41
Behavioral task
behavioral1
Sample
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe
-
Size
123KB
-
MD5
e005b6ad501cd8f855c07f47c1946d4b
-
SHA1
bdfc6d78830076b8943d87e6c4bd8abbe84d8a5a
-
SHA256
9edc2b6ebf65577aa777c9f7cbe93562d4100698780772d6926e8d4827eb418f
-
SHA512
b449ca493475c27961b032dd0c4dddc5608bd2656a801f75aca370aaf3522687d99e9890a93fcd1d7eb5f7e3d67dc644c2a738cb006ec0b29b61e991a7758ee8
-
SSDEEP
1536:7DvcP3LThpshwVs5OE8yNcCQp+2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOxU:y4SVhaNcCM8gnBR5uiV1UvQFOxU
Malware Config
Extracted
sodinokibi
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
4085
sandd.nl
digivod.de
southeasternacademyofprosthodontics.org
resortmtn.com
mdk-mediadesign.de
tetinfo.in
fayrecreations.com
ecpmedia.vn
physiofischer.de
highlinesouthasc.com
antenanavi.com
blog.solutionsarchitect.guru
deepsouthclothingcompany.com
coursio.com
quickyfunds.com
atmos-show.com
pawsuppetlovers.com
hokagestore.com
midmohandyman.com
mmgdouai.fr
stingraybeach.com
tandartspraktijkhartjegroningen.nl
leoben.at
licor43.de
xlarge.at
maasreusel.nl
lmtprovisions.com
destinationclients.fr
vannesteconstruct.be
ausbeverage.com.au
iyahayki.nl
goodgirlrecovery.com
aarvorg.com
wien-mitte.co.at
iviaggisonciliegie.it
mylolis.com
parks-nuernberg.de
gastsicht.de
iwr.nl
theshungiteexperience.com.au
katiekerr.co.uk
tuuliautio.fi
jeanlouissibomana.com
rosavalamedahr.com
teknoz.net
dekkinngay.com
abitur-undwieweiter.de
boisehosting.net
centrospgolega.com
tomoiyuma.com
tastewilliamsburg.com
creative-waves.co.uk
stoneys.ch
sweering.fr
maxadams.london
lascuola.nl
naturavetal.hr
nosuchthingasgovernment.com
worldhealthbasicinfo.com
digi-talents.com
thedad.com
teresianmedia.org
enovos.de
visiativ-industry.fr
hushavefritid.dk
helikoptervluchtnewyork.nl
hrabritelefon.hr
autopfand24.de
shadebarandgrillorlando.com
x-ray.ca
nmiec.com
modestmanagement.com
birnam-wood.com
farhaani.com
freie-baugutachterpraxis.de
klimt2012.info
xltyu.com
purposeadvisorsolutions.com
spinheal.ru
fitnessingbyjessica.com
geekwork.pl
igrealestate.com
solerluethi-allart.ch
tenacitytenfold.com
crosspointefellowship.church
koken-voor-baby.nl
caribbeansunpoker.com
wmiadmin.com
markelbroch.com
schlafsack-test.net
filmvideoweb.com
drfoyle.com
bsaship.com
bowengroup.com.au
ncuccr.org
ecopro-kanto.com
waynela.com
fitnessbazaar.com
global-kids.info
promesapuertorico.com
finediningweek.pl
qualitus.com
pferdebiester.de
c-a.co.in
vanswigchemdesign.com
mymoneyforex.com
basisschooldezonnewijzer.nl
denifl-consulting.at
mezhdu-delom.ru
homesdollar.com
stemplusacademy.com
naswrrg.org
myhostcloud.com
bauertree.com
365questions.org
bridgeloanslenders.com
marietteaernoudts.nl
caribdoctor.org
offroadbeasts.com
vitalyscenter.es
dutchbrewingcoffee.com
charlesreger.com
milltimber.aberdeen.sch.uk
simpliza.com
pasvenska.se
ateliergamila.com
ino-professional.ru
pier40forall.org
faizanullah.com
chaotrang.com
whittier5k.com
transportesycementoshidalgo.es
krlosdavid.com
colorofhorses.com
skiltogprint.no
sauschneider.info
hexcreatives.co
americafirstcommittee.org
blogdecachorros.com
sportsmassoren.com
celeclub.org
rushhourappliances.com
baptisttabernacle.com
rehabilitationcentersinhouston.net
falcou.fr
mooshine.com
longislandelderlaw.com
figura.team
yassir.pro
renergysolution.com
christ-michael.net
executiveairllc.com
ctrler.cn
cityorchardhtx.com
leather-factory.co.jp
kenhnoithatgo.com
mbxvii.com
ccpbroadband.com
schmalhorst.de
icpcnj.org
troegs.com
dirittosanitario.biz
lukeshepley.wordpress.com
aglend.com.au
wraithco.com
conasmanagement.de
sagadc.com
pomodori-pizzeria.de
darrenkeslerministries.com
kisplanning.com.au
wsoil.com.sg
embracinghiscall.com
makeitcount.at
odiclinic.org
bigasgrup.com
ihr-news.jp
blossombeyond50.com
boosthybrid.com.au
hotelzentral.at
operaslovakia.sk
caffeinternet.it
amerikansktgodis.se
onlybacklink.com
otsu-bon.com
rhinosfootballacademy.com
rota-installations.co.uk
dr-tremel-rednitzhembach.de
polychromelabs.com
saxtec.com
facettenreich27.de
bordercollie-nim.nl
4net.guru
navyfederalautooverseas.com
dubscollective.com
pay4essays.net
ymca-cw.org.uk
corola.es
gopackapp.com
kirkepartner.dk
unim.su
henricekupper.com
praxis-foerderdiagnostik.de
smale-opticiens.nl
eadsmurraypugh.com
qualitaetstag.de
bargningavesta.se
lenreactiv-shop.ru
fiscalsort.com
expandet.dk
oncarrot.com
manifestinglab.com
citymax-cr.com
accountancywijchen.nl
nativeformulas.com
gymnasedumanagement.com
tomaso.gr
tanciu.com
plastidip.com.ar
symphonyenvironmental.com
galleryartfair.com
commonground-stories.com
qlog.de
www1.proresult.no
antiaginghealthbenefits.com
insp.bi
saka.gr
steampluscarpetandfloors.com
alfa-stroy72.com
paymybill.guru
petnest.ir
maryloutaylor.com
memaag.com
directwindowco.com
ecoledansemulhouse.fr
stefanpasch.me
dlc.berlin
artotelamsterdam.com
vyhino-zhulebino-24.ru
whyinterestingly.ru
dareckleyministries.com
otto-bollmann.de
milsing.hr
kao.at
thefixhut.com
artige.com
groupe-frayssinet.fr
thailandholic.com
plv.media
edelman.jp
vetapharma.fr
judithjansen.com
candyhouseusa.com
tophumanservicescourses.com
forskolorna.org
maineemploymentlawyerblog.com
beautychance.se
amylendscrestview.com
portoesdofarrobo.com
zenderthelender.com
higadograsoweb.com
4youbeautysalon.com
buymedical.biz
socstrp.org
linnankellari.fi
frontierweldingllc.com
sevenadvertising.com
eglectonk.online
platformier.com
analiticapublica.es
zewatchers.com
gemeentehetkompas.nl
liikelataamo.fi
exenberger.at
garage-lecompte-rouen.fr
prochain-voyage.net
mir-na-iznanku.com
senson.fi
bouldercafe-wuppertal.de
withahmed.com
degroenetunnel.com
ouryoungminds.wordpress.com
echtveilig.nl
nijaplay.com
marchand-sloboda.com
besttechie.com
ontrailsandboulevards.com
smhydro.com.pl
ahouseforlease.com
zso-mannheim.de
ikads.org
puertamatic.es
logopaedie-blomberg.de
hellohope.com
jbbjw.com
celularity.com
thaysa.com
mediaplayertest.net
parebrise-tla.fr
stoeberstuuv.de
sarbatkhalsafoundation.org
dutchcoder.nl
boldcitydowntown.com
harveybp.com
trapiantofue.it
mikeramirezcpa.com
advokathuset.dk
jsfg.com
cafemattmeera.com
ncid.bc.ca
porno-gringo.com
ventti.com.ar
oemands.dk
you-bysia.com.au
rimborsobancario.net
associationanalytics.com
maureenbreezedancetheater.org
simpkinsedwards.co.uk
malychanieruchomoscipremium.com
gw2guilds.org
ora-it.de
walter-lemm.de
tsklogistik.eu
jameskibbie.com
1kbk.com.ua
friendsandbrgrs.com
victoriousfestival.co.uk
familypark40.com
fotoscondron.com
ceres.org.au
galserwis.pl
latribuessentielle.com
coastalbridgeadvisors.com
innote.fi
cirugiauretra.es
vox-surveys.com
charlottepoudroux-photographie.fr
real-estate-experts.com
bingonearme.org
ftf.or.at
iwelt.de
waveneyrivercentre.co.uk
sla-paris.com
courteney-cox.net
almosthomedogrescue.dog
zzyjtsgls.com
tulsawaterheaterinstallation.com
roygolden.com
satyayoga.de
muamuadolls.com
igorbarbosa.com
all-turtles.com
onlyresultsmarketing.com
jiloc.com
geoffreymeuli.com
greenpark.ch
i-trust.dk
kindersitze-vergleich.de
stemenstilte.nl
bastutunnan.se
daniel-akermann-architektur-und-planung.ch
bundabergeyeclinic.com.au
adultgamezone.com
greenfieldoptimaldentalcare.com
stacyloeb.com
bestbet.com
tigsltd.com
ledmes.ru
personalenhancementcenter.com
body-armour.online
hhcourier.com
bodyforwife.com
alysonhoward.com
luckypatcher-apkz.com
fannmedias.com
villa-marrakesch.de
vesinhnha.com.vn
bradynursery.com
bildungsunderlebnis.haus
nvwoodwerks.com
dramagickcom.wordpress.com
zimmerei-deboer.de
systemate.dk
crediacces.com
tinyagency.com
launchhubl.com
videomarketing.pro
shiftinspiration.com
bouquet-de-roses.com
retroearthstudio.com
teczowadolina.bytom.pl
xn--vrftet-pua.biz
alvinschwartz.wordpress.com
bouncingbonanza.com
dezatec.es
kedak.de
campus2day.de
proudground.org
mountaintoptinyhomes.com
zervicethai.co.th
herbstfeststaefa.ch
mindpackstudios.com
kidbucketlist.com.au
liveottelut.com
vickiegrayimages.com
serce.info.pl
humancondition.com
calabasasdigest.com
schoellhammer.com
kalkulator-oszczednosci.pl
newstap.com.ng
cite4me.org
lusak.at
interactcenter.org
nancy-informatique.fr
behavioralmedicinespecialists.com
takeflat.com
houseofplus.com
hihaho.com
kadesignandbuild.co.uk
eraorastudio.com
creamery201.com
tecnojobsnet.com
sotsioloogia.ee
femxarxa.cat
collaborativeclassroom.org
1team.es
smart-light.co.uk
12starhd.online
slashdb.com
unetica.fr
noesis.tech
oneheartwarriors.at
strategicstatements.com
gporf.fr
selfoutlet.com
wacochamber.com
pridoxmaterieel.nl
tux-espacios.com
tongdaifpthaiphong.net
hairstylesnow.site
pointos.com
sanaia.com
hugoversichert.de
mardenherefordshire-pc.gov.uk
geisterradler.de
sanyue119.com
ravensnesthomegoods.com
daklesa.de
seitzdruck.com
globedivers.wordpress.com
mank.de
bierensgebakkramen.nl
jorgobe.at
brigitte-erler.com
shiresresidential.com
blood-sports.net
asiluxury.com
fatfreezingmachines.com
pasivect.co.uk
kaotikkustomz.com
ai-spt.jp
webmaster-peloton.com
work2live.de
coffreo.biz
id-vet.com
cranleighscoutgroup.org
conexa4papers.trade
kunze-immobilien.de
simplyblessedbykeepingitreal.com
slimidealherbal.com
fitovitaforum.com
deschl.net
actecfoundation.org
edgewoodestates.org
milanonotai.it
botanicinnovations.com
despedidascostablanca.es
krcove-zily.eu
samnewbyjax.com
danholzmann.com
aselbermachen.com
funjose.org.gt
restaurantesszimmer.de
julis-lsa.de
smalltownideamill.wordpress.com
35-40konkatsu.net
better.town
lange.host
mepavex.nl
thomasvicino.com
saarland-thermen-resort.com
blgr.be
quizzingbee.com
chandlerpd.com
morawe-krueger.de
bimnapratica.com
jacquin-maquettes.com
manijaipur.com
smejump.co.th
edv-live.de
mrxermon.de
michaelsmeriglioracing.com
kissit.ca
waywithwords.net
monark.com
truenyc.co
socialonemedia.com
alhashem.net
slupetzky.at
faronics.com
foryourhealth.live
biapi-coaching.fr
ki-lowroermond.nl
zflas.com
centromarysalud.com
spectrmash.ru
pt-arnold.de
andersongilmour.co.uk
xtptrack.com
fotoideaymedia.es
rostoncastings.co.uk
kikedeoliveira.com
nsec.se
grupocarvalhoerodrigues.com.br
epwritescom.wordpress.com
huissier-creteil.com
bptdmaluku.com
gasbarre.com
durganews.com
smessier.com
psnacademy.in
strandcampingdoonbeg.com
chrissieperry.com
nakupunafoundation.org
bigbaguettes.eu
nhadatcanho247.com
argos.wityu.fund
makeurvoiceheard.com
architekturbuero-wagner.net
devlaur.com
transliminaltribe.wordpress.com
antonmack.de
tandartspraktijkheesch.nl
jvanvlietdichter.nl
devstyle.org
zweerscreatives.nl
camsadviser.com
tips.technology
stupbratt.no
partnertaxi.sk
philippedebroca.com
ladelirante.fr
gmto.fr
dw-css.de
verifort-capital.de
dubnew.com
newyou.at
paradicepacks.com
shhealthlaw.com
evergreen-fishing.com
naturstein-hotte.de
cactusthebrand.com
mirjamholleman.nl
autodujos.lt
spd-ehningen.de
liliesandbeauties.org
aniblinova.wordpress.com
div-vertriebsforschung.de
mylovelybluesky.com
nuzech.com
outcomeisincome.com
abogadoengijon.es
projetlyonturin.fr
myteamgenius.com
stampagrafica.es
cuppacap.com
fundaciongregal.org
mdacares.com
summitmarketingstrategies.com
vitavia.lt
ogdenvision.com
fransespiegels.nl
cwsitservices.co.uk
dinslips.se
lloydconstruction.com
turkcaparbariatrics.com
calxplus.eu
ra-staudte.de
sojamindbody.com
knowledgemuseumbd.com
pivoineetc.fr
reddysbakery.com
kampotpepper.gives
softsproductkey.com
abogados-en-alicante.es
extraordinaryoutdoors.com
pcprofessor.com
ausair.com.au
xn--logopdie-leverkusen-kwb.de
labobit.it
cerebralforce.net
naturalrapids.com
pv-design.de
bigler-hrconsulting.ch
space.ua
aunexis.ch
answerstest.ru
effortlesspromo.com
piajeppesen.dk
carriagehousesalonvt.com
airconditioning-waalwijk.nl
kojinsaisei.info
simoneblum.de
solhaug.tk
tarotdeseidel.com
herbayupro.com
poultrypartners.nl
homng.net
lillegrandpalais.com
euro-trend.pl
marathonerpaolo.com
simulatebrain.com
hmsdanmark.dk
first-2-aid-u.com
rollingrockcolumbia.com
beyondmarcomdotcom.wordpress.com
ulyssemarketing.com
carlosja.com
sinal.org
crowd-patch.co.uk
ralister.co.uk
tonelektro.nl
xn--fnsterputssollentuna-39b.se
leda-ukraine.com.ua
jyzdesign.com
miraclediet.fun
madinblack.com
notsilentmd.org
thedresserie.com
musictreehouse.net
roadwarrior.app
homecomingstudio.com
xn--rumung-bua.online
backstreetpub.com
themadbotter.com
stoeferlehalle.de
thewellnessmimi.com
lynsayshepherd.co.uk
podsosnami.ru
mrtour.site
bloggyboulga.net
tanzprojekt.com
commercialboatbuilding.com
testzandbakmetmening.online
mastertechengineering.com
grelot-home.com
shonacox.com
filmstreamingvfcomplet.be
kostenlose-webcams.com
sipstroysochi.ru
international-sound-awards.com
hkr-reise.de
321play.com.hk
bodyfulls.com
punchbaby.com
officehymy.com
arteservicefabbro.com
sw1m.ru
kingfamily.construction
assurancesalextrespaille.fr
siliconbeach-realestate.com
tennisclubetten.nl
jobcenterkenya.com
chavesdoareeiro.com
mirkoreisser.de
latestmodsapks.com
gantungankunciakrilikbandung.com
groupe-cets.com
clos-galant.com
mercantedifiori.com
corendonhotels.com
gaiam.nl
pocket-opera.de
oldschoolfun.net
lykkeliv.net
haar-spange.com
vdberg-autoimport.nl
dr-seleznev.com
lescomtesdemean.be
werkkring.nl
theclubms.com
modamilyon.com
pogypneu.sk
happyeasterimages.org
binder-buerotechnik.at
kojima-shihou.com
yousay.site
huehnerauge-entfernen.de
sterlingessay.com
pmc-services.de
klusbeter.nl
greenko.pl
polymedia.dk
streamerzradio1.site
chatizel-paysage.fr
readberserk.com
joseconstela.com
dr-pipi.de
promalaga.es
biortaggivaldelsa.com
croftprecision.co.uk
cheminpsy.fr
christinarebuffetcourses.com
joyeriaorindia.com
iqbalscientific.com
diversiapsicologia.es
abl1.net
modelmaking.nl
shsthepapercut.com
i-arslan.de
loprus.pl
blumenhof-wegleitner.at
datacenters-in-europe.com
aminaboutique247.com
aakritpatel.com
parkstreetauto.net
glennroberts.co.nz
centuryrs.com
smokeysstoves.com
syndikat-asphaltfieber.de
acomprarseguidores.com
love30-chanko.com
theduke.de
mediaacademy-iraq.org
wurmpower.at
verbisonline.com
uranus.nl
tradiematepro.com.au
lefumetdesdombes.com
easytrans.com.au
jenniferandersonwriter.com
controldekk.com
vloeren-nu.nl
gonzalezfornes.es
tampaallen.com
hotelsolbh.com.br
slwgs.org
live-your-life.jp
abogadosadomicilio.es
vihannesporssi.fi
jadwalbolanet.info
evangelische-pfarrgemeinde-tuniberg.de
ditog.fr
gasolspecialisten.se
gratispresent.se
securityfmm.com
irinaverwer.com
baumkuchenexpo.jp
katketytaanet.fi
psc.de
myzk.site
aprepol.com
levdittliv.se
milestoneshows.com
hvccfloorcare.com
atozdistribution.co.uk
jasonbaileystudio.com
lucidinvestbank.com
kaminscy.com
ftlc.es
narcert.com
ilcdover.com
balticdermatology.lt
parkcf.nl
advizewealth.com
completeweddingkansas.com
web.ion.ag
siluet-decor.ru
noixdecocom.fr
mooreslawngarden.com
live-con-arte.de
smithmediastrategies.com
burkert-ideenreich.de
drugdevice.org
appsformacpc.com
nachhilfe-unterricht.com
berlin-bamboo-bikes.org
coding-machine.com
dublikator.com
lebellevue.fr
art2gointerieurprojecten.nl
spargel-kochen.de
mousepad-direkt.de
hypozentrum.com
lorenacarnero.com
consultaractadenacimiento.com
zonamovie21.net
penco.ie
norpol-yachting.com
imadarchid.com
olejack.ru
compliancesolutionsstrategies.com
y-archive.com
ruralarcoiris.com
notmissingout.com
babcockchurch.org
entopic.com
spacecitysisters.org
campusoutreach.org
xoabigail.com
drnice.de
oneplusresource.org
wasmachtmeinfonds.at
101gowrie.com
bhwlawfirm.com
gamesboard.info
ligiercenter-sachsen.de
testcoreprohealthuk.com
solinegraphic.com
pcp-nc.com
tstaffing.nl
irishmachineryauctions.com
plotlinecreative.com
cnoia.org
xn--fn-kka.no
montrium.com
devok.info
mapawood.com
evologic-technologies.com
ostheimer.at
bristolaeroclub.co.uk
elimchan.com
csgospeltips.se
lightair.com
lubetkinmediacompanies.com
rumahminangberdaya.com
theapifactory.com
flexicloud.hk
micro-automation.de
htchorst.nl
profectis.de
wellplast.se
zimmerei-fl.de
cursosgratuitosnainternet.com
stopilhan.com
haremnick.com
walkingdeadnj.com
yourobgyn.net
oslomf.no
hairnetty.wordpress.com
mountsoul.de
baronloan.org
associacioesportivapolitg.cat
sachnendoc.com
bee4win.com
insigniapmg.com
perbudget.com
carolinepenn.com
miriamgrimm.de
romeguidedvisit.com
mooglee.com
connectedace.com
mrsplans.net
ussmontanacommittee.us
sabel-bf.com
wolf-glas-und-kunst.de
insidegarage.pl
thomas-hospital.de
journeybacktolife.com
bbsmobler.se
drinkseed.com
comarenterprises.com
kariokids.com
fensterbau-ziegler.de
intecwi.com
westdeptfordbuyrite.com
tanzschule-kieber.de
sexandfessenjoon.wordpress.com
fax-payday-loans.com
schraven.de
crowcanyon.com
imperfectstore.com
comparatif-lave-linge.fr
allure-cosmetics.at
erstatningsadvokaterne.dk
levihotelspa.fi
firstpaymentservices.com
microcirc.net
rocketccw.com
8449nohate.org
classycurtainsltd.co.uk
kaliber.co.jp
schoolofpassivewealth.com
chefdays.de
lecantou-coworking.com
asgestion.com
uimaan.fi
lionware.de
buroludo.nl
eco-southafrica.com
darnallwellbeing.org.uk
sportverein-tambach.de
layrshift.eu
koko-nora.dk
juneauopioidworkgroup.org
seevilla-dr-sturm.at
wychowanieprzedszkolne.pl
bookspeopleplaces.com
people-biz.com
berliner-versicherungsvergleich.de
forestlakeuca.org.au
refluxreducer.com
jandaonline.com
kuntokeskusrok.fi
webhostingsrbija.rs
nacktfalter.de
elpa.se
aco-media.nl
esope-formation.fr
pierrehale.com
importardechina.info
pixelarttees.com
cimanchesterescorts.co.uk
baylegacy.com
boompinoy.com
cuspdental.com
nurturingwisdom.com
kevinjodea.com
mediaclan.info
cortec-neuro.com
supportsumba.nl
heurigen-bauer.at
triggi.de
delchacay.com.ar
heidelbergartstudio.gallery
fibrofolliculoma.info
mariposapropaneaz.com
autodemontagenijmegen.nl
craftleathermnl.com
2ekeus.nl
heliomotion.com
verytycs.com
dpo-as-a-service.com
parking.netgateway.eu
talentwunder.com
craigmccabe.fun
broseller.com
lachofikschiet.nl
desert-trails.com
ceid.info.tr
deltacleta.cat
highimpactoutdoors.net
iphoneszervizbudapest.hu
helenekowalsky.com
marketingsulweb.com
ampisolabergeggi.it
maratonaclubedeportugal.com
baustb.de
theletter.company
toreria.es
nandistribution.nl
asteriag.com
spylista.com
surespark.org.uk
admos-gleitlager.de
financescorecard.com
wari.com.pe
c2e-poitiers.com
run4study.com
rozemondcoaching.nl
dnepr-beskid.com.ua
blewback.com
ivfminiua.com
bayoga.co.uk
twohourswithlena.wordpress.com
new.devon.gov.uk
vancouver-print.ca
sobreholanda.com
vietlawconsultancy.com
anteniti.com
marcuswhitten.site
humanityplus.org
meusharklinithome.wordpress.com
corelifenutrition.com
xn--singlebrsen-vergleich-nec.com
cursoporcelanatoliquido.online
psa-sec.de
catholicmusicfest.com
bafuncs.org
jobmap.at
seminoc.com
itelagen.com
slimani.net
jolly-events.com
stallbyggen.se
vibethink.net
n1-headache.com
limassoldriving.com
artallnightdc.com
argenblogs.com.ar
ilive.lt
ivivo.es
anybookreader.de
trackyourconstruction.com
dsl-ip.de
allfortheloveofyou.com
mrsfieldskc.com
jakekozmor.com
nicoleaeschbachorg.wordpress.com
sportiomsportfondsen.nl
upplandsspar.se
aodaichandung.com
extensionmaison.info
precisionbevel.com
agence-referencement-naturel-geneve.net
pickanose.com
polzine.net
suncrestcabinets.ca
hashkasolutindo.com
woodleyacademy.org
manutouchmassage.com
nestor-swiss.ch
schutting-info.nl
micahkoleoso.de
abuelos.com
quemargrasa.net
handi-jack-llc.com
austinlchurch.com
employeesurveys.com
waermetauscher-berechnen.de
lapmangfpt.info.vn
triactis.com
norovirus-ratgeber.de
balticdentists.com
toponlinecasinosuk.co.uk
castillobalduz.es
jerling.de
rebeccarisher.com
no-plans.com
body-guards.it
imaginado.de
songunceliptv.com
educar.org
sairaku.net
bxdf.info
urist-bogatyr.ru
luxurytv.jp
yamalevents.com
mytechnoway.com
vorotauu.ru
travelffeine.com
agence-chocolat-noir.com
allentownpapershow.com
mbfagency.com
d1franchise.com
littlebird.salon
brevitempore.net
danielblum.info
harpershologram.wordpress.com
hardinggroup.com
augenta.com
kath-kirche-gera.de
seproc.hn
aurum-juweliere.de
stormwall.se
sahalstore.com
smartypractice.com
xn--thucmctc-13a1357egba.com
justinvieira.com
DupontSellsHomes.com
the-virtualizer.com
thenewrejuveme.com
urmasiimariiuniri.ro
rerekatu.com
rieed.de
delawarecorporatelaw.com
finde-deine-marke.de
team-montage.dk
huesges-gruppe.de
izzi360.com
bricotienda.com
hoteledenpadova.it
edrcreditservices.nl
abogadosaccidentetraficosevilla.es
noskierrenteria.com
havecamerawilltravel2017.wordpress.com
cleliaekiko.online
radaradvies.nl
skanah.com
fairfriends18.de
seagatesthreecharters.com
rksbusiness.com
patrickfoundation.net
presseclub-magdeburg.de
copystar.co.uk
pelorus.group
hebkft.hu
kamahouse.net
opatrovanie-ako.sk
nokesvilledentistry.com
kosterra.com
danubecloud.com
foretprivee.ca
ohidesign.com
minipara.com
hiddencitysecrets.com.au
deoudedorpskernnoordwijk.nl
healthyyworkout.com
winrace.no
iyengaryogacharlotte.com
dushka.ua
servicegsm.net
moveonnews.com
richard-felix.co.uk
deko4you.at
anthonystreetrimming.com
apprendrelaudit.com
tinkoff-mobayl.ru
carrybrands.nl
em-gmbh.ch
plantag.de
faroairporttransfers.net
lichencafe.com
ncs-graphic-studio.com
starsarecircular.org
ungsvenskarna.se
braffinjurylawfirm.com
merzi.info
gadgetedges.com
fizzl.ru
hannah-fink.de
atalent.fi
rafaut.com
kmbshipping.co.uk
panelsandwichmadrid.es
planchaavapor.net
kafu.ch
girlillamarketing.com
sporthamper.com
123vrachi.ru
brawnmediany.com
myhealth.net.au
revezlimage.com
zieglerbrothers.de
apolomarcas.com
upmrkt.co
ziegler-praezisionsteile.de
the-domain-trader.com
dontpassthepepper.com
pubweb.carnet.hr
theadventureedge.com
adoptioperheet.fi
pinkexcel.com
sloverse.com
denovofoodsgroup.com
osterberg.fi
d2marketing.co.uk
lapinvihreat.fi
jusibe.com
alsace-first.com
todocaracoles.com
igfap.com
instatron.net
macabaneaupaysflechois.com
danskretursystem.dk
scenepublique.net
idemblogs.com
bogdanpeptine.ro
veybachcenter.de
autofolierung-lu.de
praxis-management-plus.de
hatech.io
smogathon.com
pmcimpact.com
eaglemeetstiger.de
lbcframingelectrical.com
cyntox.com
boulderwelt-muenchen-west.de
blacksirius.de
trystana.com
thee.network
id-et-d.fr
peterstrobos.com
neuschelectrical.co.za
leeuwardenstudentcity.nl
oceanastudios.com
vibehouse.rw
remcakram.com
nataschawessels.com
makeflowers.ru
trulynolen.co.uk
phantastyk.com
bunburyfreightservices.com.au
woodworkersolution.com
coding-marking.com
bargningharnosand.se
synlab.lt
webcodingstudio.com
spsshomeworkhelp.com
beaconhealthsystem.org
raschlosser.de
alten-mebel63.ru
lapinlviasennus.fi
kamienny-dywan24.pl
brandl-blumen.de
corona-handles.com
vermoote.de
karacaoglu.nl
bockamp.com
ianaswanson.com
torgbodenbollnas.se
urclan.net
deprobatehelp.com
allamatberedare.se
freie-gewerkschaften.de
johnsonfamilyfarmblog.wordpress.com
craigvalentineacademy.com
sofavietxinh.com
architecturalfiberglass.org
ilso.net
paulisdogshop.de
-
net
true
-
pid
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
-
prc
sqbcoreservice
dbsnmp
mydesktopservice
outlook
ocomm
excel
mydesktopqos
isqlplussvc
onenote
tbirdconfig
msaccess
encsvc
infopath
steam
thebat
agntsvc
sql
visio
wordpad
winword
dbeng50
powerpnt
firefox
xfssvccon
mspub
oracle
thunderbird
ocssd
synctime
ocautoupds
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4085
-
svc
memtas
mepocs
backup
sophos
sql
svc$
veeam
vss
Extracted
C:\Recovery\4d89kbtn-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/99EBFF70C15AE992
http://decryptor.cc/99EBFF70C15AE992
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DNXeNcyLON = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe" 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exedescription ioc process File opened (read-only) \??\G: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\M: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\P: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\U: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\V: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\A: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\O: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\B: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\R: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\L: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\Q: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\Y: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\D: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\F: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\I: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\K: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\S: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\W: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\E: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\N: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\X: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\Z: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\H: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\J: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened (read-only) \??\T: 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29u6z6.bmp" 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe -
Drops file in Program Files directory 23 IoCs
Processes:
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exedescription ioc process File opened for modification \??\c:\program files\ResetSwitch.mp3 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\RestoreAdd.xlsb 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File created \??\c:\program files\4d89kbtn-readme.txt 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\CompressAdd.js 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\DenyExpand.aiff 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\RedoSuspend.mid 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\ShowOptimize.mp4 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\ExportBackup.xltm 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\MergeNew.au3 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\NewRemove.potx 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\ResetRemove.htm 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\SetRemove.mp4 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\ShowExpand.mpg 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\StepUnprotect.mp4v 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\UpdateUninstall.odt 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File created \??\c:\program files (x86)\4d89kbtn-readme.txt 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\CheckpointDebug.search-ms 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\DebugOut.zip 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\ResolveImport.midi 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\UseAssert.wma 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\ExpandRead.ADTS 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\MeasureSync.search-ms 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe File opened for modification \??\c:\program files\RepairMerge.7z 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exepowershell.exepid process 2680 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe 2680 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe 4744 powershell.exe 4744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exepowershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 2680 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeBackupPrivilege 2696 vssvc.exe Token: SeRestorePrivilege 2696 vssvc.exe Token: SeAuditPrivilege 2696 vssvc.exe Token: SeTakeOwnershipPrivilege 2680 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exedescription pid process target process PID 2680 wrote to memory of 4744 2680 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe powershell.exe PID 2680 wrote to memory of 4744 2680 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe powershell.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1792
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD56734d8d04b235fe84640f4957c3bd6fb
SHA11a5842365b94b4a3355b43955d6cde15287fdd68
SHA256280c54433e44007308fbef7012b799bd11d9077200f1d3c950e76499a5a6afbe
SHA512284110823e7fa07b3d067557dd77dd5d6d7fb92db8c61ce9a95e5c8695beb57c86e2a58b63cbc6da688bca0435d38162cd2219694e3ab723f5986d4530c23f78
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82