sodinokibi | 361ee9bd4ece74cf4500849f006ffa9a3236540618145efd28178f1ae047dec1

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 09:58

Target

2024-06-13_d9a85a06daf532fc4343ad20185825b7_revil.exe
Size

123KB
MD5

d9a85a06daf532fc4343ad20185825b7
SHA1

ff0149c5197bd729c5e7f97dba9746d741a39e55
SHA256

361ee9bd4ece74cf4500849f006ffa9a3236540618145efd28178f1ae047dec1
SHA512

bce61834b75a265260447b061c9c9c6abaaad045897e1a41f04ed3029b2ce7fbb4692db5926829d72666bf30d0b337a55cbbe5b40edf29eb6fbf89a06fc4eb94
SSDEEP

1536:2DvcP3LThpshwVs5OE8KNcYQp+2ZZICS4AnjnBR561lQVMr3IgmffEbjQFOxU:B4SVhiNcYM81nBR5uiV1UvQFOxU

Score

10^/10

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	2972	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2968	2972	2024-06-13_d9a85a06daf532fc4343ad20185825b7_revil.exe	28
PID 2972 wrote to memory of 2968	2972	2024-06-13_d9a85a06daf532fc4343ad20185825b7_revil.exe	28
PID 2972 wrote to memory of 2968	2972	2024-06-13_d9a85a06daf532fc4343ad20185825b7_revil.exe	28
PID 2972 wrote to memory of 2968	2972	2024-06-13_d9a85a06daf532fc4343ad20185825b7_revil.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-13_d9a85a06daf532fc4343ad20185825b7_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_d9a85a06daf532fc4343ad20185825b7_revil.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 36
  2⤵
  - Program crash
  PID:2968

memory/2972-0-0x0000000000160000-0x0000000000182000-memory.dmp

Filesize
136KB

Download
memory/2972-1-0x0000000000160000-0x0000000000182000-memory.dmp

Filesize
136KB

Download