top title background image
flash

jXz2ukrd2P.exe

Status: finished
Submission Time: 2023-11-17 00:46:05 +01:00
Malicious
Ransomware
Trojan
Evader
Sodinokibi, Chaos, Conti, Netwalker, Pyt

Comments

Tags

  • exe
  • Sodinokibi

Details

  • Analysis ID:
    1343916
  • API (Web) ID:
    1343916
  • Original Filename:
    3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe
  • Analysis Started:
    2023-11-17 00:46:05 +01:00
  • Analysis Finished:
    2023-11-17 00:52:30 +01:00
  • MD5:
    422f5cdf619404563b0c3e249bd121d4
  • SHA1:
    1a364144342602074a8140ec4da5eb4f0be26274
  • SHA256:
    3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 35/38
malicious
malicious

IPs

IP Country Detection
84.16.66.164
Switzerland
78.47.210.44
Germany
156.250.15.176
Seychelles
Click to see the 17 hidden entries
92.53.96.169
Russian Federation
93.191.156.76
Denmark
23.185.0.4
United States
23.185.0.2
United States
195.182.210.190
Italy
23.82.12.35
United States
185.84.28.33
Sweden
167.86.98.177
Germany
146.59.209.152
Norway
46.30.215.63
Denmark
91.184.0.31
Netherlands
23.106.236.212
United Kingdom
85.10.159.45
France
192.0.78.13
United States
34.105.52.37
United States
104.18.24.153
United States
145.239.37.162
France

Domains

Name IP Detection
fanuli.com.au
23.185.0.2
zaczytana.com
0.0.0.0
khtrx.com
0.0.0.0
Click to see the 27 hidden entries
oththukaruva.com
0.0.0.0
ya-elka.ru
0.0.0.0
www.suitesartemis.gr
0.0.0.0
redctei.co
0.0.0.0
pureelements.nl
91.184.0.31
condormobile.fr
167.86.98.177
factorywizuk.com
46.30.215.63
julielusktherapy.com
162.241.225.231
nourella.com
93.191.156.76
wrinstitute.org
23.185.0.4
suitesartemis.gr
78.47.210.44
pxsrl.it
195.182.210.190
energosbit-rp.ru
92.53.96.169
triplettagaite.fr
84.16.66.164
salonlamar.nl
85.10.159.45
citiscapes-art.com
23.82.12.35
brannbornfastigheter.se
185.84.28.33
neonodi.be
146.59.209.152
geitoniatonaggelon.gr
23.106.236.212
leijstrom.com
156.250.15.176
production-stills.co.uk
34.105.52.37
maryairbnb.wordpress.com
0.0.0.0
biblica.com
104.18.24.153
lb.wordpress.com
192.0.78.13
triplettapizza.com
145.239.37.162
www.fanuli.com.au
23.185.0.2
www.brannbornfastigheter.se
185.84.28.33

URLs

Name Detection
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/
http://html5shiv.googlecode.com/svn/trunk/html5.js
https://triplettapizza.com/w0
Click to see the 97 hidden entries
https://www.brannbornfastigheter.se/wp-content/uploads/2018/03/img4.jpg
https://geitoniatonaggelon.gr/a0
https://www.brannbornfastigheter.se/wp-content/uploads/2017/06/fastigheter-start-300x201.jpg
https://triplettapizza.com/wp-content/themes/popsushi-corporate/img/video_tripletta.mp4
https://zaczytana.com/n
https://www.brannbornfastigheter.se/wp-content/themes/brannborn-fastigheter/style.css?ver=v1.3
https://triplettapizza.com
https://biblica.com/data/pics/uckykynk.jpg
http://decryptor.top/9CF9B91772D1B618
https://salonlamar.nl/data/game/lenongoyydjl.pngF
https://pureelements.nl/wp-content/temp/fzdevasruxbd.jpgI:
https://citiscapes-art.com/V
https://triplettapizza.com/wp-content/themes/popsushi-corporate/fav/apple-icon-72x72.png
https://condormobile.fr/d
https://scontent-lhr8-1.cdninstagram.com/v/t51.2885-15/396179174_1274762833209048_893956488623982690
http://gmpg.org/xfn/11
https://triplettapizza.com/wp-content/uploads/2021/03/PINSATTA.png.webp
https://condormobile.fr/data/images/hyoipf.gif
https://triplettapizza.com/wp-content/uploads/2021/04/Resto.jpg
https://triplettapizza.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
https://citiscapes-art.com/r
https://www.geitoniatonaggelon.gr/wp-json/
https://oththukaruva.com:443/admin/image/lb.pngvasruxbd.jpgsalonlamar.nlsalonlamar.n
https://triplettagaite.fr/wp-content/pictures/agpwho.jpgE0
https://maps.google.com/maps/api/js?key=AIzaSyAzuZL3egBiW7JxoTvyp_jwk-7G0j4wDPU&libraries=places
https://fidelite.triplettapizza.com/
https://cdn-cookieyes.com/client_data/0ec7105b822fea2c0e0a7eb8/script.js
https://wrinstitute.org/data/game/nfvnzs.jpg
https://www.suitesartemis.gr/?0
https://triplettapizza.com/commander-a-emporter-tripletta-st-michel/
https://nourella.com/content/temp/mvulqo.png
https://vimeo.com/258813566
https://triplettapizza.com/wp-content/themes/popsushi-corporate/fav/apple-icon-60x60.png
https://www.fanuli.com.au/
https://triplettapizza.com/wp-content/themes/popsushi-corporate/img/bouton-deliveroo.png
https://triplettapizza.com/
https://brannbornfastigheter.se/s
https://fanuli.com.au/static/tmp/efuyvn.jpgO
https://ya-elka.ru/
https://energosbit-rp.ru/wp-includes/css/dist/block-library/style.min.css?ver=6.2.3
https://www.brannbornfastigheter.se/?s=
https://ocedille.com/
https://energosbit-rp.ru/include/images/auaing.jpge
https://triplettapizza.com/wp-content/uploads/2021/03/NONNA.png
https://triplettapizza.com/wp-content/themes/popsushi-corporate/fav/apple-icon-144x144.png
https://yoast.com/wordpress/plugins/seo/
https://fanuli.com.au/static/tmp/efuyvn.jpgngS
https://salonlamar.nl/data/game/lenongoyydjl.pngr
https://www.suitesartemis.gr/content/temp/qdsdqx.png
https://www.brannbornfastigheter.se/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.1
https://www.brannbornfastigheter.se/wp-json/
https://www.brannbornfastigheter.se/wp-content/uploads/2017/06/fastigheter-start.jpg
https://nourella.com/bS
https://triplettapizza.com/wp-content/themes/popsushi-corporate/img/bouton-cmd.png
https://triplettapizza.com/wp-content/uploads/2021/04/restaurant-preview.jpg
https://triplettapizza.com/wp-content/themes/popsushi-corporate/fav/favicon-16x16.png
https://www.brannbornfastigheter.se/wp-content/themes/brannborn-fastigheter/assets/bundle.js?ver=v1.
https://triplettapizza.com/mentions-legales-2/
https://oththukaruva.com/admin/image/lb.png
https://www.suitesartemis.gr:443/content/temp/qdsdqx.pngs
https://triplettapizza.com/wp-content/themes/popsushi-corporate/fav/apple-icon-76x76.png
https://zaczytana.com/t
https://maryairbnb.wordpress.com:443/wp-content/pics/szvo.jpgource0
https://vimeo.com/261873517
https://triplettapizza.com/recrutement/
https://pxsrl.it/wp-content/uploads/2017/10/mt-sample-background.jpg
https://pureelements.nl/wp-content/temp/fzdevasruxbd.jpgi:
https://www.monsterinsights.com/
https://energosbit-rp.ru/wp-includes/css/classic-themes.min.css?ve
https://triplettapizza.com/wp-content/plugins/wp-simple-firewall/resources/js/shield/notbot.js?ver=1
https://fonts.bunny.net/css?family=Open%20Sans:300
https://triplettapizza.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftriplettapizza.com%2F
https://www.brannbornfastigheter.se/ds/temp/rccvduqn.jpg
https://www.brannbornfastigheter.se/om-oss/
https://schema.org
https://neonodi.be/
https://vimeo.com/258813341
https://www.suitesartemis.gr/content/temp/qdsdqx.pngv
https://ya-elka.ru/news/pics/qenwcitlrd.jpg
https://maryairbnb.wordpress.com/wp-content/pics/szvo.jpg
https://leijstrom.com:443/include/tmp/ewte.gifebResources
https://triplettapizza.com/wp-content/themes/popsushi-corporate/style.css?ver=1.0
https://energosbit-rp.ru/include/images/auaing.jpg
https://triplettapizza.com/nos-adresses-tripletta/
https://www.brannbornfastigheter.se/wp-content/plugins/google-analytics-for-wordpress/assets/js/fron
https://triplettapizza.com/wp-content/plugins/rocket-lazy-load/assets/img/youtube.png)
https://www.brannbornfastigheter.se/hyresgaster/
https://triplettagaite.fr/wp-content/pictures/agpwho.jpgW
https://triplettapizza.com/wp-content/uploads/2021/03/NONNA.png.webp
https://triplettapizza.com/?s=
https://triplettapizza.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.7
https://deliveroo.fr/fr/marques/peplum
https://energosbit-rp.ru:443/include/images/auaing.jpga811-000d3aa4692b
https://www.brannbornfastigheter.se/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver
https://khtrx.com/
https://cimer.ovh/prod-encours/tracking/controler.php
https://pxsrl.it/l

Dropped files

Name File Type Hashes Detection
C:\$WinREAgent\Scratch\b2d31od-readme.txt
data
#
C:\Program Files (x86)\b2d31od-readme.txt
data
#
C:\Recovery\b2d31od-readme.txt
data
#
Click to see the 10 hidden entries
C:\Users\b2d31od-readme.txt
data
#
C:\Users\user\Desktop\GLTYDMDUST.docx
data
#
C:\Users\user\Desktop\GLTYDMDUST.xlsx
data
#
C:\Users\user\Desktop\HQJBRDYKDE.pdf
data
#
C:\Users\user\Desktop\ZUYYDJDFVF\b2d31od-readme.txt
data
#
C:\Users\user\Documents\AQRFEVRTGL\b2d31od-readme.txt
data
#
C:\Users\user\Documents\BWDRWEEARI\b2d31od-readme.txt
data
#
C:\Users\user\Documents\CZQKSDDMWR\b2d31od-readme.txt
data
#
C:\Users\user\Documents\FAAGWHBVUU\b2d31od-readme.txt
data
#
C:\Users\user\Documents\GJBHWQDROJ\b2d31od-readme.txt
data
#