sodinokibi | 9b183afcfccc12af90f82c5f5b8a077bd8c77cf815c62e946a0dfdb4bc78847f

General

Target

9b183afcfccc12af90f82c5f5b8a077bd8c77cf815c62e946a0dfdb4bc78847f.dll
Size

116KB
MD5

e464e53eb7a4f84aa2fd0a540b2a3840
SHA1

bdc8d31dcd1f56a9ab2abf79bba817fb75b3859b
SHA256

9b183afcfccc12af90f82c5f5b8a077bd8c77cf815c62e946a0dfdb4bc78847f
SHA512

5ce4c7bd667c361fc1afeb752e59de9f29d7ed5c0252af3b6cb7e78e9ebd2ab237a454daea4474640e35fdc8b6d4be47a60cb8926a4801469f0570c64d2ad110

Score

10^/10

ransomware sodinokibi persistence

Malware Config

Extracted

Path

C:\k2fiyf-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension k2fiyf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6DA09EC49B5AA070 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6DA09EC49B5AA070 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3ybnWNk7yFj47zK+84VS+3OU2IZHv/EpSL6izstjfPxsQgSSrZc+4Tc02oM8HCnV xi2XbEMccUt19eYb6ZlOl6DkqqlOvpf2ITtb1u7YTvns+HKHpJnb+3D8RxYf0EPA CSBZ931c2eXpIyy0p9jNqttv4FWL5flNJyyIoBKVPVym8xPrFc6BvQoSSvmTi/zp +ELl3uWgzd68f1ZU4waci8KV2JKbfvmAKb88RHT0ZL4T+FdZCR47lcfZWr/atgIT hFs5KTs8Ok2JbPbNmgnoCrnCvwSO8KYRBiAmQvtLbw0moKsiD1Jg95QCMDvUorYx GHMxMf5++m4pn8zKTcBcPdA0yBiiT9ZrjIqaCr8dzntqFTAHaM2dm582gsZF+tIb 9lPGJIlDs+DLFnfSzfDFle3kTx5zulZbV5ewz5YhAuAlPVzAax4MBWkukBe8tXDr tEXqH7SsLxds4tZvCd3iLjL6enpb3JFDfwcQypWRN8iYOzmhi/iHQGr72LSsHs7y 920xjpaZWnWeh56vwM9uKmY4xkKegdhUBqYmVA0SNeXtP9z5BTx+1LRIXvynDAGc RHp+jjEWU02YhcEiz2xEnRc555DLah2PRg/gAcI2ioXZFZWtE1JvX3EmQ+s9MSeN qUtDrag7t33SZrirOv28g6cF0VtS7xxkWGgSv4ZFz8A3SO+e7e2eow1YcT6k8fQ1 5fXSshcFKWUtyOGETvNlC/18fsS3cGaq249IlncRobjxLbb5SXTpJRtcVbVTlM0k 0uzUlVG6DnP0rktoBAplUK3/MpJVXcPPgUKE/RAPTvpP7s1TDwtwsvTKTcPIEh89 yKNZ7fzokKNHO030dbxQltXp7oaL02lKLuPvle4aV8/xiUBovZzo45Rr0R4CQ1/A 06kpybdMntVmwcGTo/d5Yxh5Pnhad3MfNz/j3s79JwGUcqSHHxF4FViwxyRm9cnu GE8f5FBHQzdECbeMSpKbcC1hTgrWBVGDRbbgjUy2GDGAEMjUwVmTusOlZQfopAfh ZJCNqcKTHBcar0n0A5X7WlIL4jW9oqPQR3AQPbdxLwOKLATmalALj1pSslAkU+St ntvICeRcg8npk/Pc0e45qHDyEFcrBOrxy4kIQR3p+8CVKwdvD+SslEq9WYWLnzIN DPlC12m4xt4XNZvOwqB9FdDx50OU/JL4VBoNVLmeKjV+9/eWss3JuK/owtYJMGz2 qXToZAzqCi3B1DH9Hzm1ojZ51whOp9CDBJLgNZQYqZ7NWGxI0twMID/Bxm96Mwh5 2glO4FlUuc2G39B0g09+pw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6DA09EC49B5AA070

http://decryptor.cc/6DA09EC49B5AA070

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Blacklisted process makes network request 49 IoCs

Processes:

rundll32.exe

flow	pid	process
10	3752	rundll32.exe
12	3752	rundll32.exe
14	3752	rundll32.exe
17	3752	rundll32.exe
19	3752	rundll32.exe
21	3752	rundll32.exe
23	3752	rundll32.exe
25	3752	rundll32.exe
27	3752	rundll32.exe
30	3752	rundll32.exe
32	3752	rundll32.exe
33	3752	rundll32.exe
35	3752	rundll32.exe
37	3752	rundll32.exe
39	3752	rundll32.exe
41	3752	rundll32.exe
43	3752	rundll32.exe
45	3752	rundll32.exe
47	3752	rundll32.exe
49	3752	rundll32.exe
51	3752	rundll32.exe
53	3752	rundll32.exe
55	3752	rundll32.exe
57	3752	rundll32.exe
59	3752	rundll32.exe
61	3752	rundll32.exe
63	3752	rundll32.exe
65	3752	rundll32.exe
67	3752	rundll32.exe
69	3752	rundll32.exe
72	3752	rundll32.exe
74	3752	rundll32.exe
76	3752	rundll32.exe
78	3752	rundll32.exe
80	3752	rundll32.exe
82	3752	rundll32.exe
83	3752	rundll32.exe
85	3752	rundll32.exe
87	3752	rundll32.exe
89	3752	rundll32.exe
91	3752	rundll32.exe
93	3752	rundll32.exe
95	3752	rundll32.exe
97	3752	rundll32.exe
99	3752	rundll32.exe
101	3752	rundll32.exe
103	3752	rundll32.exe
105	3752	rundll32.exe
107	3752	rundll32.exe

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\DismountPop.tiff	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromRead.png => \??\c:\users\admin\pictures\ConvertFromRead.png.k2fiyf	rundll32.exe
File renamed	C:\Users\Admin\Pictures\DismountPop.tiff => \??\c:\users\admin\pictures\DismountPop.tiff.k2fiyf	rundll32.exe
File renamed	C:\Users\Admin\Pictures\DebugOpen.png => \??\c:\users\admin\pictures\DebugOpen.png.k2fiyf	rundll32.exe
File renamed	C:\Users\Admin\Pictures\FormatDismount.crw => \??\c:\users\admin\pictures\FormatDismount.crw.k2fiyf	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ResizeLock.tiff => \??\c:\users\admin\pictures\ResizeLock.tiff.k2fiyf	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ReceiveEnable.tif => \??\c:\users\admin\pictures\ReceiveEnable.tif.k2fiyf	rundll32.exe
File opened for modification	\??\c:\users\admin\pictures\BlockPop.tiff	rundll32.exe
File opened for modification	\??\c:\users\admin\pictures\ResizeLock.tiff	rundll32.exe
File renamed	C:\Users\Admin\Pictures\BlockPop.tiff => \??\c:\users\admin\pictures\BlockPop.tiff.k2fiyf	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ExpandStep.tif => \??\c:\users\admin\pictures\ExpandStep.tif.k2fiyf	rundll32.exe
File renamed	C:\Users\Admin\Pictures\MoveStart.raw => \??\c:\users\admin\pictures\MoveStart.raw.k2fiyf	rundll32.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\202fp9t7n.bmp"	rundll32.exe

Drops file in Program Files directory 11 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\program files\LockPush.xltx	rundll32.exe
File opened for modification	\??\c:\program files\RedoExpand.dib	rundll32.exe
File created	\??\c:\program files\k2fiyf-readme.txt	rundll32.exe
File created	\??\c:\program files (x86)\k2fiyf-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\CompressBackup.xlsm	rundll32.exe
File opened for modification	\??\c:\program files\DenyPush.vssm	rundll32.exe
File opened for modification	\??\c:\program files\EnterGroup.png	rundll32.exe
File opened for modification	\??\c:\program files\ConfirmJoin.inf	rundll32.exe
File opened for modification	\??\c:\program files\OpenUndo.jtx	rundll32.exe
File opened for modification	\??\c:\program files\ResolveRemove.zip	rundll32.exe
File opened for modification	\??\c:\program files\UnpublishSubmit.dwfx	rundll32.exe

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = c72c76be4781d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3752 rundll32.exe
3752 rundll32.exe

pid	process
3752	rundll32.exe
3752	rundll32.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

svchost.exerundll32.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	1500	svchost.exe
Token: SeCreatePagefilePrivilege	1500	svchost.exe
Token: SeDebugPrivilege	3752	rundll32.exe
Token: SeTakeOwnershipPrivilege	3752	rundll32.exe
Token: SeBackupPrivilege	2532	vssvc.exe
Token: SeRestorePrivilege	2532	vssvc.exe
Token: SeAuditPrivilege	2532	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3984 wrote to memory of 3752	3984	rundll32.exe	rundll32.exe
PID 3984 wrote to memory of 3752	3984	rundll32.exe	rundll32.exe
PID 3984 wrote to memory of 3752	3984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b183afcfccc12af90f82c5f5b8a077bd8c77cf815c62e946a0dfdb4bc78847f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b183afcfccc12af90f82c5f5b8a077bd8c77cf815c62e946a0dfdb4bc78847f.dll,#1
2⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1500