sodinokibi | b10d9a62edb6081aa9f7fc865554064bb212555392b1181dc40040e12927f988

General

Target

as.exe
Size

192KB
MD5

beed14bc183ad523b94ef6ac2b270b08
SHA1

4ea45e0d8a4d50182063cc97c8a86d579f3adf05
SHA256

b10d9a62edb6081aa9f7fc865554064bb212555392b1181dc40040e12927f988
SHA512

da74c44e21e120af26074fb6493a35067f037cc633e630b415d9b6947c9dc58e354fbb33afc87f733da8cd4d1f8ca66081df0e96d249ffb1c2ba8142c9317196

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\z8670ejqk3-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension z8670ejqk3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0228824883A2F7E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E0228824883A2F7E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hhghYvWFLFzOXyFRga8DeMqQ7N9cx7Nj7qhg/q4RHGtCDEaXhegeFjj3nQ1vQERJ 5Xx305mAtWpFZXmwl4ehISObLiRa9vnHm4jUnZnVTMgNZsh1mJaDaYMriGK1ZBg0 bHPFUo+wexsW2gjfiezZGjP1HIv30YrYP01c8qNECsYVK12tCz2htj2jyjUIn15X n8c86cvUMCS2d7HZOu4cc30D9z1PvM4eNn+GegT7O1rdk3JuRWE428H+jNqelVPe kMpoWuWKYbT7s9Y/25yCHBX0peKS68gri69QcOT5NY1isf8NaWzsQHDKToZuA9ba HhyXeErwbBHkx+ay+54PCg03RtSGkKcV/BcNYsc3Lgxq8f4ZbZ8OR1YwgpjL3IYU B6/bvdI37OMiee4Dr+gtQZieQcb0tpLvyKXnFLWsxaAxfzZAOy2uYe9sRrqsjwhG MgG9aw4Yy1Gu5Fp4lU4C8n0s8eA+Uq/511Sz1F/JHnO553GT9hIO1W5Dy7rh5Tp6 jybt1Tk1aM4odESHIHjFu73LgMT+/TEoUqxVplCNuDXGKmZHDuZzG46DrSzxT60l YX+3jIhRL+SLJFXkjyA3RaGlZYVMxbxjxFzOfNTFiIFaNmlDG4kvWy7fiqlHUqqh 08pQvLou61npqj34knaMPO4oKwkCwPOVGNRfbRIO8QtJe12MdLV/Z9+LFXgE/wey EiI8ml1yCTLyLH3QiWtPmAibjw72gA4C3Bhh8Z7/NxpFGzavASe9xNzFh7g4KThS RMnJ8vtq5ERqLMHKdJCzJ3Ws9C2HxwPcLhwghPTeXb5OljCWlEGMSF1zxdnsIzuV oE+5NfYqZQEmC0N5ywR7JVxZlk7ZaKEqiXa5kibT8fhVEUOysANPxD100BhvCLcA p8HUzadKPVyYcQCs5YrlL+gkQqvX1pyapsEcT8ae61DZioN3KmHNFs2XvTGbgruo O2JnamxjEEUpkOqt2trBpHimaHq5gJiOEcMbTuh6zs+n9F5X3uxCCp/d4MBaUZLn DP3IVHjwUOrcnoYy87N8pbubCjwVK3JTSOLwcTAtTBky13YrnjnfxzNBAsW5ctsj q2/oqDL9OGPGTHgXRzE2lTZ4RQKrI9GsbAE+m5Dgkdg2+iojEvIccQcIrQSwqI8s HM81dfuSgJpJbgcV1wD1kamErza3/wogXi2LWUn4tyRSe/fwuYUMngS/WfJ5Lki1 WaG06P2XB3LdjkIdVO8V9UGSFr4QAdf4MAuRKo2kZGHngQXUtKmn0TWIXwbM6NCW L9Cf2Be/KWQZU0yObQ044BgkWxnOFHpqcfptjYx+hPj81zIArNJWyw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0228824883A2F7E

http://decryptor.cc/E0228824883A2F7E

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

as.exe

description	ioc	process
File opened (read-only)	\??\N:	as.exe
File opened (read-only)	\??\T:	as.exe
File opened (read-only)	\??\V:	as.exe
File opened (read-only)	\??\B:	as.exe
File opened (read-only)	\??\E:	as.exe
File opened (read-only)	\??\G:	as.exe
File opened (read-only)	\??\H:	as.exe
File opened (read-only)	\??\K:	as.exe
File opened (read-only)	\??\L:	as.exe
File opened (read-only)	\??\O:	as.exe
File opened (read-only)	\??\S:	as.exe
File opened (read-only)	\??\W:	as.exe
File opened (read-only)	\??\Z:	as.exe
File opened (read-only)	\??\F:	as.exe
File opened (read-only)	\??\J:	as.exe
File opened (read-only)	\??\R:	as.exe
File opened (read-only)	\??\X:	as.exe
File opened (read-only)	\??\Y:	as.exe
File opened (read-only)	\??\U:	as.exe
File opened (read-only)	\??\A:	as.exe
File opened (read-only)	\??\I:	as.exe
File opened (read-only)	\??\M:	as.exe
File opened (read-only)	\??\P:	as.exe
File opened (read-only)	\??\Q:	as.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Drops file in Program Files directory 35 IoCs

Processes:

as.exe

description	ioc	process
File opened for modification	\??\c:\program files\LimitPush.css	as.exe
File opened for modification	\??\c:\program files\WriteRequest.WTV	as.exe
File opened for modification	\??\c:\program files\CloseSend.xla	as.exe
File opened for modification	\??\c:\program files\InstallSelect.au	as.exe
File opened for modification	\??\c:\program files\MergeInitialize.xls	as.exe
File opened for modification	\??\c:\program files\StopCheckpoint.pps	as.exe
File opened for modification	\??\c:\program files\UnregisterReset.DVR-MS	as.exe
File opened for modification	\??\c:\program files\ProtectStop.mp4	as.exe
File opened for modification	\??\c:\program files\ResolveUnlock.easmx	as.exe
File opened for modification	\??\c:\program files\WatchStep.eprtx	as.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\z8670ejqk3-readme.txt	as.exe
File created	\??\c:\program files (x86)\z8670ejqk3-readme.txt	as.exe
File opened for modification	\??\c:\program files\SetExport.raw	as.exe
File opened for modification	\??\c:\program files\GroupShow.mov	as.exe
File opened for modification	\??\c:\program files\PingSplit.xml	as.exe
File opened for modification	\??\c:\program files\RestoreInvoke.html	as.exe
File opened for modification	\??\c:\program files\UndoApprove.xml	as.exe
File opened for modification	\??\c:\program files\WriteClear.odp	as.exe
File created	\??\c:\program files\z8670ejqk3-readme.txt	as.exe
File opened for modification	\??\c:\program files\TraceImport.xsl	as.exe
File opened for modification	\??\c:\program files\UnpublishConvertTo.rmi	as.exe
File opened for modification	\??\c:\program files\UpdateEnable.otf	as.exe
File opened for modification	\??\c:\program files\ConfirmPing.js	as.exe
File opened for modification	\??\c:\program files\ExitNew.ADTS	as.exe
File opened for modification	\??\c:\program files\MeasureSearch.mpe	as.exe
File opened for modification	\??\c:\program files\RestartStep.tif	as.exe
File opened for modification	\??\c:\program files\UndoExpand.temp	as.exe
File opened for modification	\??\c:\program files\ResolveGroup.mhtml	as.exe
File opened for modification	\??\c:\program files\SearchInitialize.wax	as.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\z8670ejqk3-readme.txt	as.exe
File opened for modification	\??\c:\program files\CloseSuspend.emf	as.exe
File opened for modification	\??\c:\program files\ConvertCheckpoint.mp4	as.exe
File opened for modification	\??\c:\program files\CopyConvertFrom.html	as.exe
File opened for modification	\??\c:\program files\InitializeMerge.wmv	as.exe
File opened for modification	\??\c:\program files\RegisterStart.emf	as.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

as.exe

pid process

744 as.exe

pid	process
744	as.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

as.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	744	as.exe
Token: SeTakeOwnershipPrivilege	744	as.exe
Token: SeBackupPrivilege	1796	vssvc.exe
Token: SeRestorePrivilege	1796	vssvc.exe
Token: SeAuditPrivilege	1796	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\as.exe
"C:\Users\Admin\AppData\Local\Temp\as.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1796

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-0-0x0000000000AB8000-0x0000000000AC9000-memory.dmp

Filesize
68KB

Download
memory/744-1-0x0000000000DB0000-0x0000000000DC1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads