sodinokibi | 3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a

General

Target

bbdd.dll
Size

599KB
MD5

fd6d16ef09a96897604557faf17ac1f9
SHA1

8b702da8f8426af9f501ba546f273c2d5f79f75d
SHA256

3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a
SHA512

d68c63366abcf5b19417d165e4b483cd660235e8ce1b4abaf943e1f2985d8c58f71a03da90c55dc73e4c95945baed3d78d23bda00122ee5bf230e43ef751f34e

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\p97w46w9t-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension p97w46w9t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/81F9B0D2E6549CCF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/81F9B0D2E6549CCF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: q/avStkvxtCseJr6R4w8H+FP/S30GfpWipcXnqGpGGyuxzapKuE5RH1B3P/N7j/V Oo/WcaVK8FTu8XoSkoXGTaSkzqVdsho/EmW8z/XyeYmihw2dKnZAMSg7NdlWnZFF 7Zg7jzG//HdxDrtLF6LLVAKFjX7nxJzIFeA+dAZdzVoU2QoUuPSPctfiurg9rRo3 s91a2denLf6wYB2+CV708jn9L4RkhgBICFDQwzFu/IxfzqgMgF5F15A3yRXEUdyj ibov1feif+vi3hs7ojVbt2I1MkLvz3KtzEY7fGsjrF+mKh4mtVQJcug1ipXJYBT6 iNoz3umPH+X+/bvLu7NpiT1Bp3OOxRdyjORRwZHHbt8VnMHJcwv+EHc7mk2CMgal HpGc16O1lRiMw0DueHorMYKmmbtwyUawL2z8QOCcnTVJDvumxr9tpttcZJ7yFF8A l26p4ofn2OZxQOc6m19GsxkbfwZawSiP2J0Tt/qVo1o3uVjuSDVdWmSQPc3JFnlj pzd0lF+JH3zYbtw9DdfiGBdMUae+1CG4wAQ81pg3tgLygzF4Az9B4ja/qm3W0LuV BQvQ9ThXGe+r0/9KYuuqb6sL0+cG0yFywna1mekqapb8Gr8QVbY7LrPy0VtfWMMk pv4h2uSYSqwBhTkOCuWe0FO+GD1q1WmRxt6Ux/FbptLeRlsS/mOt3xkUDg5mYkKd EdRqQ1r0blMS1olWc8NkPqAN8LFRxaR8ks1yB1YG6ve4e1biG33SrRQBbgEdBMtZ BEsS63kgzq8Pk+2WEynPxq9h4QNSQ+0vw8OmTA9vnA+EvfZAB3JyYpWh3tWRZ92/ N9KB6Tb+Dx9alOu1tMQ0xzbEQco+TJeMC7aZTvhQpV47ueMUk6JE7e9utJ0v7U0J r/h6RuNh7ztVAK0+nMG8lKzuFXD1g7E/R/cj39wXTh91DBSKSwQRAwOZMZoo3AiG U3kV4iEWzIxZDHn8z1zTP/fTaSiqa9bN/GLmN0L7CRh4mtGoD6g6Bu1ZLvqImZk+ /ddCrULt0UCcPChzCd1eV3rVQhjGA0COzMOE1bIvrPQUH68mll4BRQIcR4PInSQy a/B8vKG+sdXWCbBGfAY+s6oX1quT2tUZoIKIQNsjJ0oOyHUE8HDjFRRRY2AXIJ4n xdnyk9+fsIYj1YWZwGSR5Z7uk3sKVrOI4XHv8mlA+onM5O9i8ILKDN4FaJwFnZlH DcuUe8MS9TQPyZs5XEeXPfmTXdpM2QH94fDcqMPnhkoeuGg8wuHagLp687Dwbv6L sdA7j74JWPu8J09hV3FyAfw/Sn0zRO2ke0cM9Y/pcx5aNPjw8iI= =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/81F9B0D2E6549CCF

http://decoder.re/81F9B0D2E6549CCF

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1316 regsvr32.exe

pid	process
1316	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1316	regsvr32.exe
Token: SeTakeOwnershipPrivilege	1316	regsvr32.exe
Token: SeBackupPrivilege	324	vssvc.exe
Token: SeRestorePrivilege	324	vssvc.exe
Token: SeAuditPrivilege	324	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1812 wrote to memory of 1316	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 1316	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 1316	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 1316	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 1316	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 1316	1812	regsvr32.exe	regsvr32.exe
PID 1812 wrote to memory of 1316	1812	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bbdd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\bbdd.dll
2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:324

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-3-0x0000000000000000-mapping.dmp

Download
memory/1316-4-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1316-6-0x0000000000A10000-0x0000000000AB7000-memory.dmp

Filesize
668KB

Download
memory/1316-5-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1812-2-0x000007FEFBA41000-0x000007FEFBA43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads