sodinokibi | 715e3ffc49539ad3a91994508eb7e02f8d1c3daa8961fd8562943f7276747786

General

Target

JaffaCakes118_715e3ffc49539ad3a91994508eb7e02f8d1c3daa8961fd8562943f7276747786.dll
Size

504KB
MD5

ec5c2abe250018cab19867940fad5404
SHA1

9b34e93cb8d6c8ef97495c6b255dcfed79b66cf6
SHA256

715e3ffc49539ad3a91994508eb7e02f8d1c3daa8961fd8562943f7276747786
SHA512

2daca2852913dfa3b36a52384f6d395aea0c50cda4602e8f57f098d64dbceeccdcc64ff00bf13daa8c60b9321a73993b64764f010cfe7d0d2f9412b08979eb7b
SSDEEP

12288:S06E8H8jnCcGvkGuKhI9roQMlQ3CWkC0:Sd9SnCdsMKpclQ3j

Score

10^/10

sodinokibi 10 472 discovery ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

10

Campaign

472

Decoy

ziliak.com

speakaudible.com

qrs-international.com

testitjavertailut.net

efficiencyconsulting.es

cssp-mediation.org

kerstliedjeszingen.nl

adterium.com

bendel-partner.de

dinecorp.com

barbaramcfadyenjewelry.com

bescomedical.de

hostastay.com

azerbaycanas.com

latableacrepes-meaux.fr

hawaiisteelbuilding.com

mind2muscle.nl

jobkiwi.com.ng

jefersonalessandro.com

penumbuhrambutkeiskei.com

Attributes

net
true
pid
10
prc
mspub.exe

dbsnmp.exe

visio.exe

synctime.exe

steam.exe

infopath.exe

ocomm.exe

winword.exe

mysqld_nt.exe

excel.exe

msaccess.exe

ocssd.exe

mydesktopservice.exe

powerpnt.exe

sqlservr.exe

thebat64.exe

msftesql.exe

firefoxconfig.exe

dbeng50.exe

ocautoupds.exe

sqlwriter.exe

thunderbird.exe

agntsvc.exe

thebat.exe

sqbcoreservice.exe

tbirdconfig.exe

mysqld_opt.exe

encsvc.exe

xfssvccon.exe

mydesktopqos.exe

onenote.exe

mysqld.exe

isqlplussvc.exe

wordpad.exe

oracle.exe

outlook.exe

sqlbrowser.exe

sqlagent.exe
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
472

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2972	3052	rundll32.exe	30
PID 3052 wrote to memory of 2972	3052	rundll32.exe	30
PID 3052 wrote to memory of 2972	3052	rundll32.exe	30
PID 3052 wrote to memory of 2972	3052	rundll32.exe	30
PID 3052 wrote to memory of 2972	3052	rundll32.exe	30
PID 3052 wrote to memory of 2972	3052	rundll32.exe	30
PID 3052 wrote to memory of 2972	3052	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_715e3ffc49539ad3a91994508eb7e02f8d1c3daa8961fd8562943f7276747786.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_715e3ffc49539ad3a91994508eb7e02f8d1c3daa8961fd8562943f7276747786.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-0-0x0000000000410000-0x0000000000491000-memory.dmp

Filesize
516KB

Download
memory/2972-3-0x0000000000130000-0x000000000015C000-memory.dmp

Filesize
176KB

Download
memory/2972-5-0x0000000000130000-0x000000000015C000-memory.dmp

Filesize
176KB

Download
memory/2972-2-0x0000000000130000-0x000000000015C000-memory.dmp

Filesize
176KB

Download
memory/2972-6-0x0000000000410000-0x0000000000491000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing