sodinokibi | 6361413fd0b01dd9bee8c2d942c78a0550eff7292c2ec5bd5bc840413fea1d7e

General

Target

svchost.exe
Size

166KB
MD5

cfd0e9822b75398979cf876a752ef248
SHA1

2ed7e7697375b73dd10a62934a3d29192a993f4e
SHA256

6361413fd0b01dd9bee8c2d942c78a0550eff7292c2ec5bd5bc840413fea1d7e
SHA512

f0d9a9b2dcbbfb832337672769d4ee1814f3034fab9775c02ad752e949c1ca8dddb45586ef635389328d8c9597b036948ff6b6b3c8a7886b4fb7058d0546762a

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Path

C:\ynzi30-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ynzi30. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A53D520FEDDA4258 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A53D520FEDDA4258 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: MGgxaBM5yzvDRwmigesw5md7/i3AjPOEwkU7VJCGnbq3B/iiy9qAy7fINOgCitUh RRrtObY8d4ZM4M0NSvx1dNrACzLRL6jNpUDjPgUaztiF7GHecqLWlSNKl1RAAdDK uYscbKWYbQqM1p833+GAhOX2qGF5elimV72fCfEngp8vontA/jIJgINXrtrnjcDe 0G4wpgMa55E/s9/74uaNgcNROCEHEHRwBUAq+AuTVzNQ5HaRlbO20O+dcxA/omK1 hazaix2WZpvHlW3S0pVCy+7ZDQma2Vo/cE7EP0RH/L9vRZ8eFbzD/+1wuLpv79Lx j0gaykCNxCUp33a0B6BWdS6i3kVgKbDruvo/rWOqnpZ2P8LIiHjfOQ/I2BngETsX D9bnbbz+voJqSiHrg0JGg1acV5EMuNKUrMzt+SIem2yjSUmBaMYh6WhmgZGEKHKS QrFdjhNmQPgf1/FdndPJK8S5CCr5vKmpZ9IzcNzzXUfDpydmGWOMBjjLzlTjYGrt vNlP4D51C7s6K2m7kA9gURcRtD+dT4AH7Zi8KOfH7Fv1J/Px5LVGgkDrJgn1I76y +nLFu9fVPINQc9Op0TB1P+aewYLIP/03p3KyaOlqBI7ETJdz9YbTwyg/I6gtkCr0 lBDl/uA6hRtkL/VCsBEa0pRA7wopY7m3S9bp5jXx0jcxqGTXoZsfD9DeiZoflHjr 3P4po9oYthigt2VoVTLFRJaUpu/SB6Yc9E9J/XnZiK1yiMHi+1pEPnaDrVTNgMUn CPDi34+qQbQGuKdM8AwCeoBTeXQcEpj+8wMpgIZ7NqM5X4/YpctApRGggvuHiQrt Lue5IaVxNJBpjVTPp7mxRw+ae2UbRB8/Bf4KEt0fvTTiR34UZdxd2Ts/oVFaKHzN nkpp1BUd1gmKunxIIh/t9YTG+hR42vVTlWobtYkIlwmyisevS/FION20v/VhK2Vf KEm4yixpA3wVNiZDq15UFKSIwAUMqeiyIUAS/+9R5PhHZjv9zvtj793jxybWG5Ue X/y2iDE3dNgLN03B217sOZCSIkkmp8NW/+CiKutxkjzEJUSns111HJPoNSjVU+B6 C5WSQnLmNqje4Qeae1ORK6SrXyVJXov33Wv2PxjZnxCqCHz1Fim/z7eTdhK7DenH 1E4Gq4Sy0LTs82okhWtAkR9bRUHbRas2C9BIO8+tdPbCT+hFby3DzonJv3oCS4wq Aa2/xw2JXOwYPVPc+Vi8QRSt1PTPRSjkDNo5aVZFpI8EwSz0C2yt+vIwjw/qg0QO mVkL30dMJYHoRUnvinqIxA== Extension name: ynzi30 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A53D520FEDDA4258

http://decryptor.cc/A53D520FEDDA4258

Signatures

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oXnEn2JlQT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	svchost.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 3748 wrote to memory of 428	3748	svchost.exe	powershell.exe
PID 3748 wrote to memory of 428	3748	svchost.exe	powershell.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Drops file in Program Files directory 19 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	\??\c:\program files\LockRedo.kix	svchost.exe
File opened for modification	\??\c:\program files\WaitExit.MTS	svchost.exe
File created	\??\c:\program files\ynzi30-readme.txt	svchost.exe
File opened for modification	\??\c:\program files\CompressGet.wps	svchost.exe
File opened for modification	\??\c:\program files\SetPush.ex_	svchost.exe
File opened for modification	\??\c:\program files\SyncConvert.dotm	svchost.exe
File opened for modification	\??\c:\program files\UnprotectDismount.crw	svchost.exe
File created	\??\c:\program files (x86)\ynzi30-readme.txt	svchost.exe
File opened for modification	\??\c:\program files\SearchReceive.tiff	svchost.exe
File opened for modification	\??\c:\program files\SuspendRead.rtf	svchost.exe
File opened for modification	\??\c:\program files\SwitchOptimize.wm	svchost.exe
File opened for modification	\??\c:\program files\UnlockGet.mpe	svchost.exe
File opened for modification	\??\c:\program files\MeasureSearch.pdf	svchost.exe
File opened for modification	\??\c:\program files\RepairRead.nfo	svchost.exe
File opened for modification	\??\c:\program files\SplitMerge.ini	svchost.exe
File opened for modification	\??\c:\program files\SubmitResolve.dotx	svchost.exe
File opened for modification	\??\c:\program files\UpdateConnect.odt	svchost.exe
File opened for modification	\??\c:\program files\WaitJoin.xls	svchost.exe
File opened for modification	\??\c:\program files\ConvertFromBackup.pps	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u42p2.bmp"	svchost.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3748	svchost.exe
Token: SeDebugPrivilege	428	powershell.exe
Token: SeBackupPrivilege	1692	vssvc.exe
Token: SeRestorePrivilege	1692	vssvc.exe
Token: SeAuditPrivilege	1692	vssvc.exe
Token: SeTakeOwnershipPrivilege	3748	svchost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

svchost.exepowershell.exe

pid process

3748 svchost.exe
3748 svchost.exe
428 powershell.exe
428 powershell.exe
428 powershell.exe

pid	process
3748	svchost.exe
3748	svchost.exe
428	powershell.exe
428	powershell.exe
428	powershell.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:428