sodinokibi | f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27

General

Target

f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27.dll
Size

116KB
MD5

4a23ba5e733f132b8fae5c9f0219d32a
SHA1

3a12b89cbf552b440fe167b91462db17d294d56f
SHA256

f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27
SHA512

b08af5e1fd466e6aba204789985538de8c0eea90be058d4e8e2243bb783a96a4e63087558a4993b54ce0f6c7ddaaf887134820fd14dcebe287d0ca035081241c

Score

10^/10

ransomware persistence sodinokibi

Malware Config

Extracted

Path

C:\7zyo1iyv1-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7zyo1iyv1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/760AD4C9552E164F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/760AD4C9552E164F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mfSdtKM86b1hF+X+TSufyXSKRhPmGYLRaIp5kehcylSTQrUxw1vhbdk96YnYWtID k5ltGskzsc9As4CqK3TSyBZ3WaQ2W7yQK/ScoMMYiGukzi4jgPHqevzXwXpRax4a 8P5DdAhf3hTAsDo6m0I/jf6KooZV/Y/o11T79hNhVR2Vx6CvgNA1APoDJCwNrjNz oK5Qp5zYVxzYAKwT3XPvAKqgPEKIv6LHJk9vSBt1uC748BcvYFZHzwxh9uiPYmA8 UG/ATO7AJmtm57gxeVDyfhq2s4nIIBhCVojieWWUU/JP/fFMTc9vdL/XnJjH4tk6 B+YCxqnpLN+PrpvjYUUmSS+In0OYGFIf0axpjhO84t6LO8B6Fc1ixPlsUuicGl40 HHivSGkEuC8h43hLu4iexJlTUoauKGdBgaWtHNXQMsEMUVvKnRveRPJo7SdKIbhA SUlKCCILjFHBiUS3csv68ewVNHbO1yZZwY/+pl6KkV1ov3LOPkUlsWp6mosOXjMt zIlxG7hQ7fNL8DFxNIEKU/BlNJrD7pzRALLt8JQJcULx/XARVOYGE/lEQoPdP+nP DY4sZL5uqdnW5+Tq2yc/po/5AmfdTM/Sb/4Kke7R/xKLIprwKQgEVx8c69USXldd RrRl3WmQP59AGjxcPxkBdyOygIu1aUzpAuuH1Vv6QtiWiGngz7+m9wGL8vBBjXOp 2wsOBe6vsFl3bZjGz42jrGc1U/SM4PBw3XMYU9uxPi8ZMOOEgFjAoNajNemCKGGu tntx7eKLgWdUqrviesmzrKw1NTKrCWvIpjV7Hx1uIxCNJOmdj6rfSDVQCtU5WJN2 x82LpaUf/7NwKY7tceOmKM0H65Tcu3q5q6RHIg3UfV7Vum9yfkttJ/z7U6ufip3b LcCzslOND516Pk67DdsvYQJXPda2Kt4vcPZQ1gXvuZBR1Bv8C3aiv8g1iQYu1lND YDB6mk6GUktlEi8a+RH+RTAGv7twp+aY7QxK5hA8Af+B5g4YQx1oFxuu0t49c4I5 nurcQP4hHXF7WCOMdxu/izMy1aIu8i73Eeboh1XCFbw7tOcG2KwWIXBQ4XLVlUxG LO7MnDzGQUMZAxhuZAlr85h4Pd+ZirqPmZu05Cdvts5M11JJyQ0bo3//Fr/jQZGX ebAXZSXGNF+fBV6uRQO9JLH+L8QiGplXqZqeomdv3cxYpNNpSKDA6RX4Tl7CNO85 8Q8OXlUiYFKaKyxsgSOYrZvfeSHnqMjWssCRe8xznzhNWs8nyFT5v0ZawfwEkLnD 85OSIcwTlMY+BcZjg2u/Xz90/lucs7zhy80P9pvrq8NJ4BYjIuI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/760AD4C9552E164F

http://decryptor.cc/760AD4C9552E164F

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Drops file in Program Files directory 24 IoCs

Processes:

rundll32.exe

description	ioc	process
File created	\??\c:\program files\7zyo1iyv1-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ExportTest.mpg	rundll32.exe
File opened for modification	\??\c:\program files\GroupPublish.M2V	rundll32.exe
File opened for modification	\??\c:\program files\RequestSearch.mpg	rundll32.exe
File opened for modification	\??\c:\program files\StepEnter.php	rundll32.exe
File opened for modification	\??\c:\program files\TestShow.rtf	rundll32.exe
File created	\??\c:\program files\microsoft sql server compact edition\v3.5\7zyo1iyv1-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\WatchUnblock.inf	rundll32.exe
File opened for modification	\??\c:\program files\DisconnectExit.ppt	rundll32.exe
File opened for modification	\??\c:\program files\EnterUse.3gp	rundll32.exe
File created	\??\c:\program files\microsoft sql server compact edition\7zyo1iyv1-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\PingEdit.ppsx	rundll32.exe
File opened for modification	\??\c:\program files\SetJoin.avi	rundll32.exe
File opened for modification	\??\c:\program files\StopSwitch.i64	rundll32.exe
File opened for modification	\??\c:\program files\UseSelect.ttf	rundll32.exe
File created	\??\c:\program files (x86)\7zyo1iyv1-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ConvertToSet.M2V	rundll32.exe
File opened for modification	\??\c:\program files\EnterInitialize.mpeg2	rundll32.exe
File opened for modification	\??\c:\program files\TraceComplete.css	rundll32.exe
File opened for modification	\??\c:\program files\ConnectConvertFrom.wmf	rundll32.exe
File opened for modification	\??\c:\program files\ExportImport.wma	rundll32.exe
File opened for modification	\??\c:\program files\MountRestart.mpv2	rundll32.exe
File opened for modification	\??\c:\program files\UnlockSet.mpp	rundll32.exe
File opened for modification	\??\c:\program files\UnpublishSubmit.ogg	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1396 rundll32.exe

pid	process
1396	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1396	rundll32.exe
Token: SeTakeOwnershipPrivilege	1396	rundll32.exe
Token: SeBackupPrivilege	1368	vssvc.exe
Token: SeRestorePrivilege	1368	vssvc.exe
Token: SeAuditPrivilege	1368	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1296 wrote to memory of 1396	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1396	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1396	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1396	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1396	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1396	1296	rundll32.exe	rundll32.exe
PID 1296 wrote to memory of 1396	1296	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27.dll,#1
2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1396