sodinokibi | b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb

General

Target

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
Size

212KB
MD5

c283e5ec517605b6226c29f96f6d1d28
SHA1

43caef6a20ab9e045d76f8bf3e4e96d622f2a6eb
SHA256

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb
SHA512

8a72a611925f7e504ebde23dba0f23f1cb30613bc1c3f6e36dfa3c8e954e152054a154ad3cc5eaeb4861e776135daa77ce19ebc0b00813d83298fd01ca579955

Score

10^/10

ransomware sodinokibi persistence

Malware Config

Extracted

Path

C:\10wd8kx-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 10wd8kx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5DD7C6CA5594FBE4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5DD7C6CA5594FBE4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +ZoP6C4osx0VS+D1taGMgZyrC/0E+PRJRcbKAPkYzG+yikaFjMxJobTZgVYp3cuR 8lhCUDewVZcraOSSSD7HenBHIccwTTf8MT88jkfLejOEjOhLFHc4ybORRFrHSVyJ 3ZKdGjSv6xF98GQZv0aSulvLvIxh6++waBkHpNn+Qr512d2BPevg4OlW1whdDYeU dfKbrJor9BFubj6PLclTVgaqdpKNVOQ9m6fT8qMmFTjrewXlVi5LKxsDiprRS/yB YNbWZQL1SDhQRy1m/0ASeSAf2iDUylnvKHmBEnnXnYoZ81546jU4srmH42V4cwDG WwppxBDZHYQI2Ik6mAAIQtEFANaZ1oJEYgE5GzSzwFG5utBJ6P5QPOBzYCpHNU5q HPwvXe7HlGZYuPWRzDQA507BsCHCDbIGZYsvFhOzD3V5XvKzuEs/LiZLdycFVM1w 5GFIU6Sy4uPbEMf30unIgCRxd20zsp2H3h1lb/TBchC3mQMhI1LTGrFDltMQ6eko W4ik7kQnjrvsxL7wlUtr0E2IGQAoCAyP22LRMbT56trCV4qr0iXtIZGsjVxYeuzK epzN0h/i+OPC4k/BCyEFTozUFS28meBsD83tu+9yt1lbm8EgYE4/mwZGJYycl8TD CkkPhKgln+L5tV0IrI0l4rt1ctVFQsb0FX8GdMu/pHZsPCUBwNdmpY7v87cCTX7J 8MMibAoikyKFHTO5kKvny0LEQuYUrDGs+Q2W+nT3EMw0SVCVV3/7DfjVXRnNS4Un JbobpITcZOe2V1HGewgD7HJWqt2VvexXC83J3B5hxRkgpXPWaa7d/14uWoce92CG Ke4eGvwxI+lOx8s9LslcG2cx+P8EfHh2+ZvrrE70RYxliS8KjwKIKRSZFQBsrj3l 1ESweU9zKlcGgj4IjiyoUQAo3gUpfCTDRb7VaHeEPXMmbBxury9QxrrxCPW5WXeq X3q+rk+PBx6Y1vwjKYNTS10vi4MMHl9dhgiEE2UXoom6tX7z35imW8r50C72lq2C LNqF24W8Jgcl8r6BATUtNQHebYL1tCXzgTk8uGxT/z68hDRI8hIobfsJ5qwS5V2n bNvCBqCSn0peP82D797c9DCeOs2NkjQkics54AqIMiP4LwZ+5naLKdIUF8tiqe/k BfeO5z+Df8IJgiNvAQ6i0DshQJO/YenpfxNCiRdR4qJ8NIV1JqrUHUp943GFa3rZ bn+o9SeU3Mw2ZrZDGXZpDLlGkTmIvCIXhqvbY1W/qooG8BZL2EcrABfYsRAqoMGo JJ+pbj+3l+A/RX1/x09/Lu7fsrn6F6w6kovpHoUVKO1IVw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5DD7C6CA5594FBE4

http://decryptor.cc/5DD7C6CA5594FBE4

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

description	pid	process	target process
PID 1304 wrote to memory of 360	1304	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe	powershell.exe
PID 1304 wrote to memory of 360	1304	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe	powershell.exe
PID 1304 wrote to memory of 360	1304	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe	powershell.exe
PID 1304 wrote to memory of 360	1304	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\omv3371f5mx.bmp"	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tQZ5HNPIrG = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe"	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1304	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
Token: SeDebugPrivilege	360	powershell.exe
Token: SeBackupPrivilege	1828	vssvc.exe
Token: SeRestorePrivilege	1828	vssvc.exe
Token: SeAuditPrivilege	1828	vssvc.exe
Token: SeTakeOwnershipPrivilege	1304	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exepowershell.exe

pid process

1304 b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
360 powershell.exe
360 powershell.exe

pid	process
1304	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
360	powershell.exe
360	powershell.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe

Drops file in Program Files directory 25 IoCs

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

description	ioc	process
File opened for modification	\??\c:\program files\EnterSearch.dib	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\LockOut.wmv	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\RegisterSwitch.3gp	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\SaveEdit.wmv	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ShowUse.wmv	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File created	\??\c:\program files\10wd8kx-readme.txt	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\CompressRegister.M2TS	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\DisableInitialize.nfo	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File created	\??\c:\program files\microsoft sql server compact edition\10wd8kx-readme.txt	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ResizeOut.m4a	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\BlockSet.M2T	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\EnableUnregister.wmf	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\InstallImport.ppsm	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\StepRequest.DVR	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\WriteClear.emf	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\10wd8kx-readme.txt	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File created	\??\c:\program files (x86)\10wd8kx-readme.txt	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\CompressSplit.pptm	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ConnectFind.dotm	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\DismountJoin.ADT	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\OutOptimize.ini	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\RepairResolve.xhtml	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ResizeTrace.wma	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\10wd8kx-readme.txt	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\CloseUpdate.wm	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

C:\Users\Admin\AppData\Local\Temp\b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
"C:\Users\Admin\AppData\Local\Temp\b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Sets desktop wallpaper using registry
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
PID:1304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:360