Overview

overview

10

Static

static

10

2024-06-13...bi.exe

windows7-x64

2024-06-13...bi.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 09:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-13_ade8979d58960b5214d80e5a723e2779_revil_sodinokibi.exe

  • Size

    156KB

  • MD5

    ade8979d58960b5214d80e5a723e2779

  • SHA1

    b49e6fa430d3fcc559236a440abbb99b6efd003f

  • SHA256

    388d21a5e711ac53519656a0fce9cbd8d381300c0877b4978bc0792d233bec7f

  • SHA512

    3e76e9fc2048d7d835746d4452f72602c852018fb5db7eb271a74cabf391c3fdfcef3ed8c6ee377c040f1de0ab05021163888598d3a18ecb3832fed3fef55537

  • SSDEEP

    3072:Ui8Iy8EytSLbi4eTMlwDCnuZ3O8VN96b:d8IUykbnWJZ3O8V+b

Score
10/10
sodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Default\jdpr3.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got jdpr3 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7257CF149BCE8973 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/7257CF149BCE8973 Page will ask you for the key, here it is: 0u2UQz7V0h7SEDRW7IYBgSxRiS+9/onhiqMjokGDZo8LKD9G1E+PIuepR+NJ3IHw JVZfWnMb9gi61UqRm02AXny/6pDTYqefOoLeAx9+w/NTpr91IBPGNohqamqUVVlq UUj/Rx/8IxjfxlKeYHqS33pIVLpZMUKndHzvq+VrbF9bFQY2JiJM4nNEjwdTg69I ZRPaV2HBoV0o9LgFpegGh/W37ulbP/LeRxnZxsxDOGbg+PIcJMl2SWv0cyq3IDmg FpLNjTWEJ+yvYmLVdrVzJhJxrBu98lDcE+tKsVEp9TY1P0XOLTYeo0EKJq2mD3ev jsUl9LmOv+i5Aexecaqj2ZLiUfEGXKvrz8giP66aYkMscfPgq0WOG4bHFyZQkaFs e2MbU+P2uAnO/EReMCnx9DunQRTRJGIMmBn5qCu9gtA/aO72eHMIkuLen59bV8kL 08pOf4kuPvsOhytRK0Ce/bxtmbjQVRYmLokwyTScWnew+uIJ7plAhHjWk1ubCG28 44NUgdj7YedEswPb+d7jCAkB8R/UFUO33TRHxI6MfuElBkoyI80pv1JSLTn9xzqA WeD1XSmyxKqANA0vmkpBkXHo/TFITaKb4jWH/DS8R8E66X5ESvL+TSUUZqW/EjkM t9H9WtZVcfAqhztuPzOKjivbU7OezchUvEfUMlQZihp+NEBXJzcrCL+B/cpopSJc Ljuut6elorO8kr9gBd9MO+jmt+GeVAXJzKHRDAzn8ROy+TAnfwNi8zO3n1R04SyT WzL07wi5fWyzlJ2Rt8sJTylOZII8D7kuQ0ZUrTYaiCBzEYCIkSRXxFYI69yv+aP+ QI6IlDtF1kfr9E/JZnHLmpsraM3P7jZq1lC49nYOfE7u/4byPJeax/R3on3B5D1K fkXIefAO8Ye89+s1cfcDZDVMMUDkts7u7zhG+B8Lf02qMWvEVnLWm3llvHU7UA3z Dp/ZBU9anOSNJU5cibdGwZo6CN7APDfavM31TfADEli7+DenHBGatmEM0MSbx3kN 8ng8VgukboWe3mLTOBpEj+9vmLS5HuPZ1Z4V++7ST1KVQotULp8D1vMM0BWZO2Hx KPVD+z/ncmjb1eLRI4UrzUMHVX8UmnJnB/6+RDoN5G/lPsM+nefnL1I4CXqS1veK jJaQixmyTdHlOoUTStLkS/85egUy5qMrGqBWqli+
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7257CF149BCE8973

http://decryptor.top/7257CF149BCE8973

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Renames multiple (148) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-13_ade8979d58960b5214d80e5a723e2779_revil_sodinokibi.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-13_ade8979d58960b5214d80e5a723e2779_revil_sodinokibi.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
        PID:2224
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3908,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=1336 /prefetch:8
      1⤵
        PID:3808

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Default\jdpr3.info.txt
        Filesize

        3KB

        MD5

        288c008865cdc8504a3af077e98131d2

        SHA1

        bca55a63b2481c215022052ba1217c4d1923a48f

        SHA256

        41dff42f72c779ede90a9f7359bf01a5aef381f970d41251c088ee28849510ec

        SHA512

        86a3a979c5613d0dd3c0c4bc87a0241382d8f97d4b7921695dc24274242fa918664fd64ff5298df8985f2041c33cd621b56076ec7f6295c4f3a81f9ebc34075f

        Download Submit