sodinokibi | f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27

General

Target

f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27.dll
Size

116KB
MD5

4a23ba5e733f132b8fae5c9f0219d32a
SHA1

3a12b89cbf552b440fe167b91462db17d294d56f
SHA256

f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27
SHA512

b08af5e1fd466e6aba204789985538de8c0eea90be058d4e8e2243bb783a96a4e63087558a4993b54ce0f6c7ddaaf887134820fd14dcebe287d0ca035081241c

Score

10^/10

ransomware sodinokibi persistence

Malware Config

Extracted

Path

C:\m2n9346-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension m2n9346. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EEAC9A004D1EEC18 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EEAC9A004D1EEC18 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gaWxILEKdlCliXrlj9AQYYyfOFTwrOxN7MigtaiSSJBKO6SgAM12lvv9o5mDISBf mkEvZ/GPIwaqU/CY9CQ4Jy4eI63snjTFgtBYHNGZzqKn0lGWwvX4YATb9Npx44xC NjCpuKldSgEX2iPu+dpkKElNxrrm5ohJ0e91vbm7TmyK+AAUUqq6fVpcwGALmasl l6EKjn4qHVeM4LTnBx7uRmrPaxQryC3hP8CcJ7q3rjLrbDYSm+zbmWdJvaB8fbYq LZQPKYe9AQANukQZ09PYDzliZ+HuVN2/YqEZrPgJrunxS7OpIOC0Ro4EFJQ+Amlz tqdccV+ebu/P4Hq4wPM94FKqdPNdaC9gmR+qVMzDCjeVuYM+SbURGuoDXfyAXnn0 VB6xa5c6c/sYnoPiPfz6COA+CL2wZO8AIs6rgIdNsWI926rwA6w+MCeTQAUMYxq+ JW06DYU5dttShUfuAMQXOhQLi9JSwi2z1aQqg4h0H5dJLsCz5Qo1qHxYEC46HG3t N3XMbxILPsYP/WhuRiDvf1qxHcqeJZzNd6sDxU99RkrOrimTFRCCXk416SftzESE REEiDalAJXii62l8BpfiSdA5qTmyQKUYPu2uPHfhwLUYdPDxMCWekzUGnIh2PqUO Wp90F2TDDEdOtZchNTOlZIqxAaqUbFBvilKwVcMhg54BbbgVWKKDeuopdFoKxZJZ BfyQjCYDnz3mouRt88aQM8CUWajFvZXB6I0nUX4uWDN81W3nBhngMC4y6Z7BQxzX JOmRMtNikDBQssYy738gKhIohQ2kCU40T5G87M4b9LdUjmbOwMkWAmYRJcC/4dal ZzKoDV0P9CKhLRsLZbiwQqAmMK7DllC5D3l6LUKkZb4WY5Xg0v8WRuWd9+M9kVOJ IAfBT6FCiHRC1qVwl0ftwbGSdemh8PKFsBYQvyFqew9/TtAdp9lM4thKAU60Nt4L 8rGhBxPYgMC4ZRWELyBh+hroWAWEmzhUvnE6DIV992lUZNCyuUMejNq+P1NIVRBo pKJzV3BFGt1755UgyrHN2VmMfok+uR5uRG9gyATEgoft0SIXJJTjUaONuFZmLM+F aB4EQ85wSCvXUQ2FIlw7ifSTTkptGCa7IT9EQmpG9v3nYDO8SMvqoXd8Sw9nEFNl jTQ7+BtbY/RtTmkUPmk59Auf+8AKqMRLIaHfriMO6WejzLSraFrITaqfoiHOqlC3 sz9IDyjd949nDZKuc0h9PSmcEmkuk9b25/YxUeT0+ModKVQj+txZ0BVQv0AKTwS1 ousUhYkXitI6KdqIQWkFUiS6 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EEAC9A004D1EEC18

http://decryptor.cc/EEAC9A004D1EEC18

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\AddUnpublish.tiff	rundll32.exe
File renamed	C:\Users\Admin\Pictures\AddUnpublish.tiff => \??\c:\users\admin\pictures\AddUnpublish.tiff.m2n9346	rundll32.exe
File opened for modification	\??\c:\users\admin\pictures\SaveAssert.tiff	rundll32.exe
File renamed	C:\Users\Admin\Pictures\MountStart.raw => \??\c:\users\admin\pictures\MountStart.raw.m2n9346	rundll32.exe
File renamed	C:\Users\Admin\Pictures\SaveAssert.tiff => \??\c:\users\admin\pictures\SaveAssert.tiff.m2n9346	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnblockShow.tif => \??\c:\users\admin\pictures\UnblockShow.tif.m2n9346	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnblockEnable.raw => \??\c:\users\admin\pictures\UnblockEnable.raw.m2n9346	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UpdateUnprotect.png => \??\c:\users\admin\pictures\UpdateUnprotect.png.m2n9346	rundll32.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4rqs5rgky15b.bmp"	rundll32.exe

Drops file in Program Files directory 17 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\program files\RepairConvert.aifc	rundll32.exe
File created	\??\c:\program files (x86)\m2n9346-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ClearReceive.3gpp	rundll32.exe
File opened for modification	\??\c:\program files\DisableConvertTo.3gp	rundll32.exe
File opened for modification	\??\c:\program files\EditAssert.pptm	rundll32.exe
File opened for modification	\??\c:\program files\BlockWatch.docx	rundll32.exe
File opened for modification	\??\c:\program files\ConnectGet.vb	rundll32.exe
File opened for modification	\??\c:\program files\SearchSelect.zip	rundll32.exe
File opened for modification	\??\c:\program files\SetAdd.asf	rundll32.exe
File opened for modification	\??\c:\program files\AssertResume.vbs	rundll32.exe
File opened for modification	\??\c:\program files\ConvertFromUpdate.midi	rundll32.exe
File opened for modification	\??\c:\program files\ResetDeny.docx	rundll32.exe
File opened for modification	\??\c:\program files\ResizeSkip.MTS	rundll32.exe
File created	\??\c:\program files\m2n9346-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\CompareClose.avi	rundll32.exe
File opened for modification	\??\c:\program files\ConvertFromBlock.vstx	rundll32.exe
File opened for modification	\??\c:\program files\ExportConvertFrom.docx	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1016 rundll32.exe
1016 rundll32.exe

pid	process
1016	rundll32.exe
1016	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1016	rundll32.exe
Token: SeTakeOwnershipPrivilege	1016	rundll32.exe
Token: SeBackupPrivilege	2112	vssvc.exe
Token: SeRestorePrivilege	2112	vssvc.exe
Token: SeAuditPrivilege	2112	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 908 wrote to memory of 1016	908	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1016	908	rundll32.exe	rundll32.exe
PID 908 wrote to memory of 1016	908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1662bfebf68d8da9879fd50b41536078c0c06ed4616dc388ee78a30ce8ccd27.dll,#1
2⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016