Overview

overview

10

Static

static

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

7

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

9

Ransomware...KB.exe

windows10-ltsc_2021-x64

9

Ransomware...KB.ps1

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Ransomware...KB.msi

windows10-ltsc_2021-x64

10

Ransomware...KB.exe

windows10-ltsc_2021-x64

10

Resubmissions

31/03/2025, 00:22

250331-apdw1ssjs8 10

28/03/2025, 22:52

250328-2tfd7avl15 10

25/03/2025, 14:57

250325-sb3mbsxxht 10

Analysis

  • max time kernel
    596s
  • max time network
    610s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    28/03/2025, 22:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RansomwareSamples/REvil_07_04_2021_121KB.exe

  • Size

    120KB

  • MD5

    726d948d365cb9db1dfd84a30203a642

  • SHA1

    78ed4bcf9c0aca8d14b25da2e679a91c48dd6797

  • SHA256

    d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6

  • SHA512

    bd17f2b265c30f0d9ddc60e01026f21ad6b6355f68b762b14b3e8882a90de0a20970f77105a2515a7cb4a0d1429f3a70cdf40d4247384592d36da6f2907a690a

  • SSDEEP

    1536:bjxXC9jVwbhEW8z3w1R+KjJLRiOQJo0SoLCdpuOk2ICS4Ang6lUkdq0tK3CmZ6+n:mmV1wKdLoLC/OemUkdq4WCmA0qG9

Score
10/10
sodinokibicredential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files (x86)\0488rye97f-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0488rye97f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 70 GB archived data from your file server and SQL server Example of data: - Accounting - Finance - Personal Data - Banking data - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DBC24AA3EB0C5CC9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/DBC24AA3EB0C5CC9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rdB5T2ULu4JfWI4i2IYUpItBG4CcmpNXY6Cr9Iu1JzrRXk9+sAVLz3WIGhLFGIma cPgduvOrh4WOk1NonBlQk075Sg+OaAaMIEFchPzEeLjXYx0qVztumccxtOr7Wd6v VR8WUMzkSkyMKKaAz7kKssvTFx5f7zXX9hdE20u7lOhFGOZp9OrGQvIGDt9QiZlX JpnevcZ2fCJXrV/WlBVhq9sL2JaOvjbzapepAk8OonwgGlbSV/Ip8XofBgxcQLC9 WxIlA9sjS8DsL90LJjiJ1MZrTPt4/nyiuU/9zE0mC9X+0cUkdAtP5PASBRycBNQA 0KKtKd/7r0Yes8eZ5Z18OKM2fe5vYnXc03J8VhCPlxSxWc6CSR0V+S5fwAvztvNI St40ruxqswBUhbUD5OczoZynfCE+ovRd01p5X350V09/KbPsxue150ym6vtKAre1 x8EXM7ei2EVDKivH1e0+J365fAjo2KcM+DXWg65HDUdEjlDSl/bCC9nJxP8rWEnL 5H32Mn5Q13QS9JMePiA2J2kvDT09Z/zfk+mU5TSz/xTsU4K0JxOykVOjAvugWHoT BosCqLtGJX1o/AkPXlgLJJwaQHtksInViUZzzd8Jf2B7lRW8ciBUxxo37L80RmlC 8RyQ+hi29Ho/SqDyO5JR9Jaru6BpyQj0OwdJWwfSpkkxrbh+uYB5p2pS0FO5iuZa sXEGOkVVMSuxsWukUcx77rFJJP7pTjhYZXniVIjhgryUDB9zT4OeC908DW+4oAxf k0Sy6yQ5PGrxfJFuSLo885u6cMLEeup+r284fWPCfJ6CNtvX0wMN/r9GdzF+iZyL BlEL2219w6AhDf3TXQLEql7A2G3WiQhSxlJke1hl7N00w1J6hiVedv6aSrbhxmhz 60uYkr+0km34LKprjmOf/Wr0H/vjNfWTV1iRSRBAb35MwouuLYAC664FooLg2Ut2 iH2V3016nLnWccBP6UnTVq5xIwvs7pdYvKp3uxeU1hodxPNIWHzYtUXPTikuh0Nf U0sX+48DGTqla/puGF8stU2hmXx3ErhXmf5OyN4LQl/tBwTL080r1hI4qOsfchib ZC3Ws0OrSvsrrwcoCgh+8OdBmLfr+ZskdzXMmsMf5ELRiRrRqfq4B67L6KnvB5vi k1b4++AZ/Gx2++puXNbutVZ2jnKokZhYkbylX+WivlF/Le8GMc8JpmANYmTx6s+G 0MJ495nTnuWHnhx8+OV2obIWCEZcg2SP+KhSxKHLL0eD/HNo1NUOn1E9xAcrTe1t MZAwHNLNElG5nBePjznDmtjBLysYSi9rdQ0/GZyLpwC1YuMpf0n0jDD+3ZhOl4wf Nys1UJ8iEybf46w2BOwZzQ8CGLm4ithIKCJJYd90/130et0ntFVV5Hpe6llMCjwq Ygp9vLVRboA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DBC24AA3EB0C5CC9

http://decoder.re/DBC24AA3EB0C5CC9

Signatures

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Sodinokibi family
    sodinokibi
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 36 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 16 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\REvil_07_04_2021_121KB.exe
    "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\REvil_07_04_2021_121KB.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5056
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4752
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4716

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\0488rye97f-readme.txt
      Filesize

      8KB

      MD5

      02f242ecea12d813f4beb6c4e30c7ded

      SHA1

      0907e28c45026d054fec790b68b2f1bf6e2f8aa0

      SHA256

      a515537edf2a50f34eeb3d46fd9c2828f53e39f8ef23d2dbbbdecf6efdac611e

      SHA512

      9f3b0efffd45442a88aa45dea857d395343a279953f12c9c92aaedce6bad4ce1e13ef78168ff37ea735f73a5fd352566090ab4f6d11d5672e565ddef9f03e59a

      Download Submit