sodinokibi | 140f831ddd180861481c9531aa6859c56503e77d29d00439c1e71c5b93e01e1a

General

Target

lg.bin.exe
Size

290KB
MD5

5f58902825d15d59528f98faf43b86c3
SHA1

f09e5e72b433d11a32efe2e5d63db0bc7b8def59
SHA256

140f831ddd180861481c9531aa6859c56503e77d29d00439c1e71c5b93e01e1a
SHA512

5aae01c51f026e7382bf20117e81cc06a975f561370e7f9170b02bc83e329cc1737d82cf721f3901cf4c2c9180423bdaf6a375a109d05e9ca164c7c08970a3c6

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Path

C:\88fw8-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 88fw8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9CAEB518F653B061 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9CAEB518F653B061 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tc4DwoJK8jsAkl61nNubdIlUhQxvcnVvRfVweDG2AOUq7F6Q0rZbJhc086h8pRAD GU/k2Q3eKhggFU9PkNWGU77rrcxK9qgOulPsI7UP/Q7kBiPlRULmEiHIYh2A0m3p bwsS0Y/go2Hj8bg21b6zIRS7bYNZb3cdqhcqf4B9etocKxM2bRR3Y4pBbA+Sz4mj oQp1fYa2HjJGM/5FyXxpGKr1LevKD+6a+gYCs8IpIIL0qlLLm2n5NL3oBPJJojek sE0kELThEBzxScVIwkYlQ9ltn0Y3KozAFxZetLS1L0cA4Vf8XCqsDKU1UMSTu78z sM/89QwShJXnY8Y1+SrU3Q/sg+yB4iDjY3teC2ugdpSyJz041aBvyhMlfQlxdSTf ywguesS5/695nin/ZJZh3jx/Jewuv7rgR0ew8PdPDuJctKRXav3xMhvbOCCTAqYT KKpS1ixwz0KZWTDjSBT2KdRR5p72/AA4MnF7Ou4oFCE7Jm3h8IlHmkl4d59TawAI O0DT6L1oMypiIdiUmNYvfldz5L5RTi1md5CkKDw1UwtDZzuEPQlRoa3KPZMSRBXN U8cpH6zLNJ2Pm3yHsOg/PpJ7aoWmCtddcjOvM5r7A5oAhkO9XzSsbrrdYrtJ5oTV /Oem34+riRHSqtHBPHdVL2rZ51Vsj5yMKuFjsA7k6vdVqi+vnI2qoJvdrChkKMQ+ byvykX7IdBskI0yr4lRc07oUBWIoRoemzo584yuT9/tFD4i9HvsznfRfS2p7Syjh SLGBOfgIx/D6mVf00gcI+BXOr41+d3/JwG5F7H2T4JvMauL7Ni+hdVNGP2iwTw2I SEJOw1btjLRyJX6aJMOLO/kUgQexj4g4qrTHV0m1Ol/9PcLsd/4CFQahG+ruAxRj QYgTTwYrofuYYxbGy5LpM93SC/yx3V3JvH1YEAVV8gTQfwIyP/MDcZXIQZJm3jdN Mslreof4463JQ6mfNV0tC2PgphsB/KXSC6fxHJcGmwZJSrlugv2GGGT6ZgsTritm mQaNYOMHzBhemnjmzDTniM7VB+3nDWZAzujlx8FNt2C6aGrDAw82T73a2VWEwEqt b5Cw6tGRK66wHJOzomTBAHH6au+gZx7LCF170eUGXZolCCi62NISqTrB9JedqKBp ISmz3xmKd+Xdps1TC8URrRg0KcU5Gzwpf5irQjdXEbinrxSdSjvrfF6CFWX7MhWb KRplOJOQdDr1YlRnS/do5yaXahf3kntKjMmRi2CdnsOSxef8TL7qjP0h29NClGTs 34ofUT/3D8Offm4C7KY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9CAEB518F653B061

http://decryptor.cc/9CAEB518F653B061

Signatures

Drops file in Program Files directory 21 IoCs

Processes:

lg.bin.exe

description	ioc	process
File opened for modification	\??\c:\program files\ReadOptimize.ADT	lg.bin.exe
File opened for modification	\??\c:\program files\SkipPublish.TS	lg.bin.exe
File opened for modification	\??\c:\program files\SuspendSkip.reg	lg.bin.exe
File created	\??\c:\program files (x86)\88fw8-readme.txt	lg.bin.exe
File opened for modification	\??\c:\program files\EditUnprotect.midi	lg.bin.exe
File opened for modification	\??\c:\program files\GroupProtect.mpp	lg.bin.exe
File opened for modification	\??\c:\program files\LockReset.docx	lg.bin.exe
File opened for modification	\??\c:\program files\OpenTrace.png	lg.bin.exe
File opened for modification	\??\c:\program files\UnregisterSave.m1v	lg.bin.exe
File opened for modification	\??\c:\program files\ConnectExpand.odt	lg.bin.exe
File opened for modification	\??\c:\program files\InstallInvoke.odt	lg.bin.exe
File opened for modification	\??\c:\program files\SyncStep.mht	lg.bin.exe
File opened for modification	\??\c:\program files\UndoRedo.M2T	lg.bin.exe
File opened for modification	\??\c:\program files\UnpublishDisable.mpeg2	lg.bin.exe
File created	\??\c:\program files\88fw8-readme.txt	lg.bin.exe
File opened for modification	\??\c:\program files\MountRestart.mpeg3	lg.bin.exe
File opened for modification	\??\c:\program files\TestTrace.aifc	lg.bin.exe
File opened for modification	\??\c:\program files\FormatWatch.tif	lg.bin.exe
File opened for modification	\??\c:\program files\InitializeGet.ods	lg.bin.exe
File opened for modification	\??\c:\program files\LimitSubmit.pptx	lg.bin.exe
File opened for modification	\??\c:\program files\UpdateRepair.js	lg.bin.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

lg.bin.exepowershell.exe

pid process

3100 lg.bin.exe
3100 lg.bin.exe
3324 powershell.exe
3324 powershell.exe
3324 powershell.exe

pid	process
3100	lg.bin.exe
3100	lg.bin.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

lg.bin.exe

description	pid	process	target process
PID 3100 wrote to memory of 3324	3100	lg.bin.exe	powershell.exe
PID 3100 wrote to memory of 3324	3100	lg.bin.exe	powershell.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

lg.bin.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\NewTrace.tiff	lg.bin.exe
File renamed	C:\Users\Admin\Pictures\ApproveSplit.tif => \??\c:\users\admin\pictures\ApproveSplit.tif.88fw8	lg.bin.exe
File renamed	C:\Users\Admin\Pictures\EditSync.tif => \??\c:\users\admin\pictures\EditSync.tif.88fw8	lg.bin.exe
File renamed	C:\Users\Admin\Pictures\NewTrace.tiff => \??\c:\users\admin\pictures\NewTrace.tiff.88fw8	lg.bin.exe
File renamed	C:\Users\Admin\Pictures\ResumeGrant.raw => \??\c:\users\admin\pictures\ResumeGrant.raw.88fw8	lg.bin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

lg.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2a14x.bmp"	lg.bin.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

lg.bin.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3100	lg.bin.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeBackupPrivilege	2268	vssvc.exe
Token: SeRestorePrivilege	2268	vssvc.exe
Token: SeAuditPrivilege	2268	vssvc.exe
Token: SeTakeOwnershipPrivilege	3100	lg.bin.exe

C:\Users\Admin\AppData\Local\Temp\lg.bin.exe
"C:\Users\Admin\AppData\Local\Temp\lg.bin.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-0-0x0000000000653000-0x0000000000654000-memory.dmp

Filesize
4KB

Download
memory/3100-1-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/3324-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads