Overview

overview

10

Static

static

10

2024-12-26...bi.exe

windows7-x64

10

2024-12-26...bi.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2024 09:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-26_ea5d24b9bdfb7ea892b4ff16bc2c9d42_revil_sodinokibi.exe

  • Size

    561KB

  • MD5

    ea5d24b9bdfb7ea892b4ff16bc2c9d42

  • SHA1

    40717d8266cf429ddc7df3a29248ef3bc8678a44

  • SHA256

    6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a

  • SHA512

    fef1c194135b4341da580de14d66d1cfb5b0207f5c57aa8bedb5f2f677c1dc913fb450a89de424d093da8a60c422af4aa4f189a95aa825e6e7c84e28b859f547

  • SSDEEP

    12288:PIUykkZ3UdvReTV6dtXyLkzjF+4AYdvReTV6dtXyLkzjF+4AWLkzjF+4Ay:PIUWOZcLkzjF+4XZcLkzjF+4LLkzjF+s

Score
10/10
sodinokibidiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Default\0ho590d37-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 0ho590d37. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DB7F3659722B2F3E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/DB7F3659722B2F3E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3dEu4RQUy38AjxP4K2Gnqnr599tBa5JZZzvPCMH0HvrrZKR5Tfzy+PfXcl5/QJ0p kO8xYAAjb772/7KDMQnIUTByqiKrxrFYdYmjXpO2nNKceUZiJYEsdz6o0Hw4pOrB NlRFcIy8P4OIPvWxw1sgSArlr3lpB9s4A4mrkap7SZFXNFanBeEP1m+FMA8eO3hB vZ8ER45DQGYXAsLNGinCfV/N2hnJXfAAjFpYWBSdVMew63lOFpgyFnBMGkbtP2z7 dzjyfBMOPcz0OSe73I2ezUQhklHYZ1prPY73TUnJ/bKj1CbKdE8C6lfRHP3hA909 6ujoNWkykRLb98jYoToTZQUpT59qD+XEUDgn2jH8pArrfo8cJmuqcOglBup/seyG yyRvyoR8Ei2I/tyQjAqxZDTHG8934P/AefaOWavT7FQOy7DguPanDkDa3Xucow76 5XcA8XY2myICc6/lkZ+FgKMCaUD6Fj5LsZLJRezuvnZBjlndiFCFaQ4oAriK2WGf tsVHQzb4Ew9xefPFm+RqApOgay5fx/s+HmxS0UW5BuURbrESiM92ozwPPaQFBAlX 4xJhnhOYN4bEfXA3olrZXiULVVun/d224EJCBZDyHAlb79lw0ZtaWsxJlhMYlyjc F1HQKtBttP0exPTDKjGh4p2MDp6YZHk9BK5fiZKy2QPC+tlEel7BAG8pOtJUJQMb K/9Ak0dvrk7+GCw9OaXjuhSi4YpGG3ExdRinvvE6XJ8tqYsqxQlKVx8CrYwWkGoN qBYj3WjTK0qZYr8hMf70dbHtsXxR9THQlqNDqVJVuVhWggtAD3e/NG7hGxl/WrEr gBWrDryA2buOI6LMnAnTqd/is4R9mNmXATD/xnZA/yqYUZHdFIeyFP2a483ghMaC eILD3B67CRPtgWjdLPPnSK6XBg6zfK6/dlXGlB9i2dafGpJ2gKLJMudMdBSbSP6/ ATlipY1mTApiGZ8Ng1WJdJqXAsGVFYKgArMXAPXEq9Oqcgi2RC6EI7xdNdDUFyJz j9rn8BrapgMSLVBIGDgQls6vf4CifzsFIUgrjg3qoPgEqhWzqCNPbeG3epZNVTeO 4lvZNePbBcyKn2ZLGS6YG7j+hDjCfM8vmTR97fUMXn6yFkcXy5/u5zRr665xnCRv he/pV4VM8Xghai5VF+woZ6THRJ4QI/IQFoVywKM8FZs= Extension name: 0ho590d37 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DB7F3659722B2F3E

http://decryptor.top/DB7F3659722B2F3E

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Sodinokibi family
    sodinokibi
  • Renames multiple (170) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-26_ea5d24b9bdfb7ea892b4ff16bc2c9d42_revil_sodinokibi.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-26_ea5d24b9bdfb7ea892b4ff16bc2c9d42_revil_sodinokibi.exe"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Default\0ho590d37-readme.txt
    Filesize

    6KB

    MD5

    1b9a59d63d1a8be3beae418a1b4c6922

    SHA1

    2a9bff4c2c5ec3493e2b56c100af8982740ea346

    SHA256

    7fb3b1780213cf7ce14ce1b43f2f147c3dac02f090b2398543101d74fcb66613

    SHA512

    11814ae2af4784c50541d697ede603de9a084fa6f15ac95ce42da2ec13596e2c7203b9c1b283551956a11ba904807d8d66b10af41f6da7b28450f26e168407ed

    Download Submit