Overview

overview

10

Static

static

10

2025-03-23...il.exe

windows7-x64

10

2025-03-23...il.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    103s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/03/2025, 03:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil.exe

  • Size

    164KB

  • MD5

    561ab11981e5132b6b1a724762ccf77c

  • SHA1

    320a039b66f1192e4f654fb213afd7c75852a35b

  • SHA256

    1e962caa271bccb44def63a5b037dd867bc87dcad038e5279b8e64a248fda23c

  • SHA512

    8e3e0697bf3e74830c8a283247850097c21e998ccc32ca73471a9d97523fc3e7ceeed40d9417a31b6a46c9bb6ad75b9ed3d738580d5037b039f2dd2235eb70ac

  • SSDEEP

    3072:70XoUeZ/DVS8L7flcMTeYWik3LvFflPE51TkT:7eoUeZRlcYxWVTFf1E3+

Score
10/10
sodinokibidiscoveryransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\rkv4qsvvz-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension rkv4qsvvz. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D037680A85741923 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/D037680A85741923 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: KO8KErqToHNEIJQnDNFBp/H8jXp5OI7xMMZkeL6q0kIHNyUCsyQJG1EbKnoPO/7b 8gAuTlnlgLbgxJizQsVuu3+CL70ICYGyuzAeWN16PwX2ZVHFfPfZThj5IkRrtMj4 vHDsls7KQ8TtarFT58MtLbtA3QPcTlhub2B3ClIJIOAyWl6YAgqY45eG0RwlC4ae FE8PUqdslQ7Bwq2Aw6L/sZz7r6cPvT/Xf3MYHATzjHexLc0aILpiWswusdksdI/B VKkpxo4eZcY/geNiz0SR50XuzHkhYl2mN5BVkDXF9SDqlsJB5jAyOzWJwxOZJRZS ItP+W2yq58uxAg7bmZDhi18Ppyt0Uve0700tiuj3xBp6fdieNXf/FosIxBgkSe8j TaDKrCbhYsst6CrQKbt9t5hzbintW0PRns0o0ZEOXRdn2NS8OFrmeJ97MJKodxts /TYji5GJl5d/jVaq4kuq+Pl7cp48PMZDjL6tRESrnPvgoHkg8DGn79ZEbAxh1kDT Ydb8aRAMLH6U7MEIjBRy5md9PZczv2ASn2fFNc+RBYafnTtnSH9XUDXt4llzsUR/ GV+cN3HpvBYs8GSI+6Ja92gGuTnG8GmNfHZ8KRwEHyYWW7x4mtKaswzJyifq+gV/ 9rRNNbeUJxz1V40wmrDmNcxdhacMqVANwlb2uCQh8o5Zh/zjvTwp/ywXIXOgQvQs 6Es0Pm9cCMTvCtJdnwKyrlB9oqvLG2uXz24iAO5OMX9GggN8YaPuLoQBKC6QPtY9 Fd971dWLKyeB+tkLX6yolgLWRC+pUOFPJpEXhyNoxJMZfVA6Mb5V/iU1Lu4BG0at RfonNSYahTRWMpLF3QSJVTd+YRuHZ28H3+NnRP9dEbDwB9GMH4RQS2fFBoBiH5k/ 1f6i4TmsJLQHt5NrvWBZnAb/Spqz2dafWb6Pb/VrLskA34YxkSsV0BGPAVcKkQuG 03paHcW9QQlTy3hxP1QUVUUu0+zjBZdYRnBARStESg16Z2egykmwUgTMUlbmFu9J 20xoEIYJG+STHKMR7pw7j/7dK1apTWkKQwEFBr0BNa/upLY7HHmEiD9OGWlkHYK5 39eDv4r5l6Z6sITSC5oiuEU8M6oqnjJFNaiW+tGEE3jWu2oEqkOz1joPPVxroGTB aYZIZrf2dszVuazCgKvmGZdDOD/PtkD1wOHv/Rxk33FW26Dc+mTuHXSM5cX/eB8+ AqGLPHyCgWoGhbv/SWUKRbu9G6uD43td Extension name: rkv4qsvvz ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D037680A85741923

http://decryptor.top/D037680A85741923

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Sodinokibi family
    sodinokibi
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 19 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1884
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1816
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2212

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\rkv4qsvvz-readme.txt
      Filesize

      6KB

      MD5

      92d19156c40c3616fc33960104ebd433

      SHA1

      d1116192ca199dadbd763552b769d3b4571af5df

      SHA256

      c9dbe833607fed96b305b9a8e432e2a8a580586f70e77869670f84ff9270cdad

      SHA512

      600cc3546865224403e204648f72a7a50652ff960273ce8c2e571a152457e49d753cab1d482e3e10d7a8124d6912e74ca2676c65fa3ae2e9bdb77ea946a864ef

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_reaqttzn.xvz.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/1884-0-0x00007FFFD5203000-0x00007FFFD5205000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1884-1-0x000001E066230000-0x000001E066252000-memory.dmp

      Filesize

      136KB

      Download

    • memory/1884-11-0x00007FFFD5200000-0x00007FFFD5CC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1884-12-0x00007FFFD5200000-0x00007FFFD5CC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1884-15-0x00007FFFD5200000-0x00007FFFD5CC1000-memory.dmp

      Filesize

      10.8MB

      Download