sodinokibi | af7a14a249990479f187b3d2d0897118eeca857482ccb0215dc3c77bc908213f

General

Target

file.dll
Size

164KB
MD5

d1d0cf18956a20a8fea65f26c57ff221
SHA1

cbc693b7ffd3271335d8fe77ea4822d469296516
SHA256

af7a14a249990479f187b3d2d0897118eeca857482ccb0215dc3c77bc908213f
SHA512

ddaac901d24efe39dc1588e235ca25c1f65fb9990f5ab8c0f494121e4706baf8c6a57428d39378408ead354d3176abc700f2b74186ab364785bb24b0ccc8d333

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\cxc04ur7rt-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension cxc04ur7rt. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/43AC9AFDF2F7785A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/43AC9AFDF2F7785A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LDSQYav3d5m9hzzEOc6OzKdilhC/XRUVgJ0WiolFBe9+6seactx0Mn2Ij6h2QNk3 nuwbg0xBOuumA7DAXq3dcH3GAJ4Lt0FIn0qnSCdTWBRYgsC5/dS7TOapH3pp755k edCij5a3rcHNB3OH7UKQIZMGlB+Kiv0ld5mvNhc5kOqo99WY+g+r57Xh/tX8628s r+rnus8AfelPvneoO89jl8n7OH2s2L9WcaEw4SbgwWjt9E/t9GT69YFNE9faqB2I a0VxzcfrYBgoJgHzgwNPuC2qiUtKQ4wtaxV2D9pCAhu34E6yMhZRzxDxEQHnegb7 n/o/cMJ2VHwcTeRvEcgELBREMO/6cKtDBmZJVAJCiSYF2vfR7/NESPmqiWr2VBLc e2Qj+yCf+PASQAUDZWpvFOVFv4C2BqQEIbOK6s/JlOACAaGxnXdQYrW7ebaWH0OI ctjYNys/wbEkYWwYTXaGxJLAUexmvLIwEbPspJVsu2Cq9GPsuhSvnD9V7g63BGm3 MNcEXmINZrSFZc86F59h1TIjamvJcQO67TMShQO9m+Yejcqkywdj50Zuk/kf/gGJ Q8WVZml9iJpz63/vWiqd0TNHNjnd4euuAXxs6ySqD1PgACLBwwYe9UXf4amznBJ+ 6p0q6MSD0C5mSJ596hW/4UEAr+6Mib8eTxOuASmObahPxqAQqhxiplke/KAZYJwO iB40KVOz3rs790BgAByfvsrKbkgDX1hlORr86lAd2us0mOrKlrd7Bk3ywIHFpKi3 HyiBVcOvSl+rgAeKqkFgd1oTNjZYDGrvJdw+4/60O38ME0zOhmJtPFpcTUVEfuVO c6iqMqYcMT9IMTyhCXRllhPN9HChkYSY+aGAk7pCFNM77hypdcQ3kTqIRXJV5gXt QN5pKyEXhMJirKOHO2DTpo4eQyDrUZ4bFyqPYQ4gGDrsHq5iV9zhnaieiX0W3mEx +5V5NQtAJ0FAWSD3j0wvWIox6Ek6j5Ghlm1I0Q2RRq5VjcvfMR6SkY+eJypOdTI6 FyXxvtSw6JfBFNNj+YON85tZF2Vlu95Kfee7M87LDKuRfK+SZerBUy7l573wTlgS rD3cKwQwUlyVvXMea6pyv/ktWSE82GK0+UhGNZfbyjsUN3AL7aLMyD0ZOdgwXcay 6VXJ4g== Extension name: cxc04ur7rt -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/43AC9AFDF2F7785A

http://decryptor.top/43AC9AFDF2F7785A

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Blacklisted process makes network request 108 IoCs

Processes:

rundll32.exe

flow	pid	process
21	992	rundll32.exe
23	992	rundll32.exe
25	992	rundll32.exe
27	992	rundll32.exe
29	992	rundll32.exe
31	992	rundll32.exe
33	992	rundll32.exe
35	992	rundll32.exe
37	992	rundll32.exe
39	992	rundll32.exe
42	992	rundll32.exe
44	992	rundll32.exe
46	992	rundll32.exe
48	992	rundll32.exe
51	992	rundll32.exe
53	992	rundll32.exe
55	992	rundll32.exe
57	992	rundll32.exe
59	992	rundll32.exe
61	992	rundll32.exe
63	992	rundll32.exe
65	992	rundll32.exe
67	992	rundll32.exe
69	992	rundll32.exe
71	992	rundll32.exe
73	992	rundll32.exe
75	992	rundll32.exe
78	992	rundll32.exe
80	992	rundll32.exe
83	992	rundll32.exe
84	992	rundll32.exe
85	992	rundll32.exe
86	992	rundll32.exe
88	992	rundll32.exe
90	992	rundll32.exe
93	992	rundll32.exe
95	992	rundll32.exe
97	992	rundll32.exe
99	992	rundll32.exe
102	992	rundll32.exe
104	992	rundll32.exe
106	992	rundll32.exe
108	992	rundll32.exe
110	992	rundll32.exe
112	992	rundll32.exe
114	992	rundll32.exe
116	992	rundll32.exe
118	992	rundll32.exe
120	992	rundll32.exe
122	992	rundll32.exe
125	992	rundll32.exe
127	992	rundll32.exe
129	992	rundll32.exe
132	992	rundll32.exe
135	992	rundll32.exe
137	992	rundll32.exe
139	992	rundll32.exe
142	992	rundll32.exe
144	992	rundll32.exe
146	992	rundll32.exe
148	992	rundll32.exe
150	992	rundll32.exe
152	992	rundll32.exe
154	992	rundll32.exe

Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

rundll32.exe

description ioc process

File renamed C:\Users\Admin\Pictures\GroupStart.tif => \??\c:\users\admin\pictures\GroupStart.tif.cxc04ur7rt rundll32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\GroupStart.tif => \??\c:\users\admin\pictures\GroupStart.tif.cxc04ur7rt	rundll32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4wo519w0k7v.bmp"	rundll32.exe

Drops file in Program Files directory 39 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\program files\MergeExit.001	rundll32.exe
File opened for modification	\??\c:\program files\RenameWrite.easmx	rundll32.exe
File opened for modification	\??\c:\program files\TraceConvertTo.xps	rundll32.exe
File opened for modification	\??\c:\program files\AssertDisable.vbs	rundll32.exe
File opened for modification	\??\c:\program files\BackupMerge.dib	rundll32.exe
File opened for modification	\??\c:\program files\SelectSplit.fon	rundll32.exe
File opened for modification	\??\c:\program files\WaitConvert.dwfx	rundll32.exe
File opened for modification	\??\c:\program files\FindSet.wmv	rundll32.exe
File opened for modification	\??\c:\program files\InstallSwitch.rmi	rundll32.exe
File opened for modification	\??\c:\program files\SearchUninstall.xlsb	rundll32.exe
File opened for modification	\??\c:\program files\BackupSend.pptx	rundll32.exe
File opened for modification	\??\c:\program files\ClearUse.mp3	rundll32.exe
File opened for modification	\??\c:\program files\InstallSave.wav	rundll32.exe
File opened for modification	\??\c:\program files\SplitSync.png	rundll32.exe
File opened for modification	\??\c:\program files\WriteSwitch.ADT	rundll32.exe
File opened for modification	\??\c:\program files\RestoreOpen.txt	rundll32.exe
File opened for modification	\??\c:\program files\SaveGroup.wav	rundll32.exe
File opened for modification	\??\c:\program files\SuspendShow.wvx	rundll32.exe
File opened for modification	\??\c:\program files\WriteRestore.dotx	rundll32.exe
File opened for modification	\??\c:\program files\EnableClear.wmv	rundll32.exe
File created	\??\c:\program files\cxc04ur7rt-readme.txt	rundll32.exe
File created	\??\c:\program files (x86)\cxc04ur7rt-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ConvertFromDisable.vstm	rundll32.exe
File opened for modification	\??\c:\program files\DisconnectCheckpoint.mp3	rundll32.exe
File opened for modification	\??\c:\program files\HideInvoke.pub	rundll32.exe
File opened for modification	\??\c:\program files\PublishMove.tif	rundll32.exe
File opened for modification	\??\c:\program files\PushMount.ps1xml	rundll32.exe
File opened for modification	\??\c:\program files\ReceiveAssert.vbs	rundll32.exe
File opened for modification	\??\c:\program files\RenameInvoke.mp4	rundll32.exe
File opened for modification	\??\c:\program files\SendFormat.pps	rundll32.exe
File opened for modification	\??\c:\program files\SwitchSet.shtml	rundll32.exe
File opened for modification	\??\c:\program files\SyncDisable.easmx	rundll32.exe
File opened for modification	\??\c:\program files\UnblockSelect.mht	rundll32.exe
File opened for modification	\??\c:\program files\ConvertFromRename.dxf	rundll32.exe
File opened for modification	\??\c:\program files\EnableDisable.TS	rundll32.exe
File opened for modification	\??\c:\program files\FindSend.rm	rundll32.exe
File opened for modification	\??\c:\program files\GroupCopy.xlsb	rundll32.exe
File opened for modification	\??\c:\program files\SelectEnter.xps	rundll32.exe
File opened for modification	\??\c:\program files\SendExit.kix	rundll32.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

rundll32.exepowershell.exe

pid process

992 rundll32.exe
992 rundll32.exe
4048 powershell.exe
4048 powershell.exe
4048 powershell.exe

pid	process
992	rundll32.exe
992	rundll32.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	992	rundll32.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeBackupPrivilege	1348	vssvc.exe
Token: SeRestorePrivilege	1348	vssvc.exe
Token: SeAuditPrivilege	1348	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 648 wrote to memory of 992	648	rundll32.exe	rundll32.exe
PID 648 wrote to memory of 992	648	rundll32.exe	rundll32.exe
PID 648 wrote to memory of 992	648	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 4048	992	rundll32.exe	powershell.exe
PID 992 wrote to memory of 4048	992	rundll32.exe	powershell.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
2⤵
- Blacklisted process makes network request
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-0-0x0000000000000000-mapping.dmp

Download
memory/4048-1-0x0000000000000000-mapping.dmp

Download
memory/4048-2-0x00007FFA311C0000-0x00007FFA31BAC000-memory.dmp

Filesize
9.9MB

Download
memory/4048-3-0x0000021ED1610000-0x0000021ED1611000-memory.dmp

Filesize
4KB

Download
memory/4048-4-0x0000021EEB830000-0x0000021EEB831000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads