sodinokibi | 7295707af6aaac77d6dea7d30c96077045fb623645fb493fcb419bc80d4f57db

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 09:48

Target

2024-06-13_284b4e74f0f243790550b6a20084cff5_revil.exe
Size

123KB
MD5

284b4e74f0f243790550b6a20084cff5
SHA1

c1d87ee231516181ca6ca3921cf6578f2cf872d4
SHA256

7295707af6aaac77d6dea7d30c96077045fb623645fb493fcb419bc80d4f57db
SHA512

b9d83b25b74ca0316901f3cb83ebf9ce37256af0e798756cb12b0dff7ad6174594e062ba09920f23bc28d91e8f0c3830b777916e0ba3707b6c15389c4d94d052
SSDEEP

1536:2DvcP3LThpshwVs5OE8yNcY/p+2ZZICS4AnjnBR561lQVMr3IgmffEbjQFOxw:B4SVhaNcYh81nBR5uiV1UvQFOxw

Score

10^/10

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	2960	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2376	2960	2024-06-13_284b4e74f0f243790550b6a20084cff5_revil.exe	28
PID 2960 wrote to memory of 2376	2960	2024-06-13_284b4e74f0f243790550b6a20084cff5_revil.exe	28
PID 2960 wrote to memory of 2376	2960	2024-06-13_284b4e74f0f243790550b6a20084cff5_revil.exe	28
PID 2960 wrote to memory of 2376	2960	2024-06-13_284b4e74f0f243790550b6a20084cff5_revil.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-13_284b4e74f0f243790550b6a20084cff5_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_284b4e74f0f243790550b6a20084cff5_revil.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 36
  2⤵
  - Program crash
  PID:2376

memory/2960-0-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download