sodinokibi | 3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a

General

Target

bbdd.dll
Size

599KB
MD5

fd6d16ef09a96897604557faf17ac1f9
SHA1

8b702da8f8426af9f501ba546f273c2d5f79f75d
SHA256

3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a
SHA512

d68c63366abcf5b19417d165e4b483cd660235e8ce1b4abaf943e1f2985d8c58f71a03da90c55dc73e4c95945baed3d78d23bda00122ee5bf230e43ef751f34e

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\4509y7-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4509y7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FB713FE8306337B7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/FB713FE8306337B7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JLsA2kYSkqzpGkhJmCILONAOGzRGMXDY1I9w29tQu6viCGkkUoZ4WKDflZ26NmA/ QlOakFfaOBntsHiDJmlCxxf1k+MoRLGhI2dtggLMcCPhFOv+iX1/skut8J0LqYqD AnL/1XHan3KSz2ubMwwHHHMS5CHtqeuYWYMFnwCeYaU1c49mUmbUyfwhF1hxv6X+ KQ+7I+eIRZ20E6gmi17ZBamKPReFFQ2rvi5ksy0qsG8LpVeYl0uk0MuqjUPk9UJI 6OOvktljTsAisHilLgV4inmuC03S6UfipXY0lrWluqbP6N0Dl+0WAgYenk2Zs3Zf PHfgsd/ObE0s1MCzyiMaEcL1Kg7GPBw6n4NL9mJEXSY1XAiyRjcg6qGSKHVHCEUR BCIJls29t1G7jv5sACKh9m7L7054/kC3dpoPnQadoQQ7m3RlokNIoH1lADr1im64 nGxNBuLMRVNqInG9Hecc7LoPmZE3LCp9oyKo0o+tvG53pkBzGqlPgcnz/qFeto/4 3yp+u7lS+4ONkg2FUxfHLFuN8OK3nVuTssHo/cVL9dBfoJiuctCiOvcoTOzYfE8o aATnpYQU0dUerIBBO+FmeNhz1b0+IXprLJ6OKl+KHR1CL84nhMD4bCmhWdb75sHy CNxEFVukQNF1BmJGlcXlNqMnOpRIbGnBFuawf1xDDLWW5eKbS+SuXlof3fYM4G+o rA2FBn1jkRfteqeuxqzGro9aNQX0kg4HEd3fW3rh2zVeBaM7CtQqEB3XcXmqlB56 f38/CUnv3RtmqrI7yUWQu/NkVXKmaEvt4PfxiCufJNWiPuxlEGwG8SwwhKz0NjBk vipMoIkhCJWwwvsryatycHi+tEtEu+neGS8U4SMPFVYtTVuL6v16DOjoF48UVitO d0tHLQI6CBn+4FWywKgHCnn+aHDxV7AIVnmcMLmOvrsY/P2fvMH2yg/+LS4FGJWJ xwhyPkx9hjh8aln/xlLHrSZ8Z9rYONX3chdt5ZZmLZz3WkG9L4TcrA3252/G3adC fL5WV9dzhOBHRxwCkP0L9X9EPQXXb7jQlnIV/7Dk2kIhLZPCnYJdxc/7BxIEuPPd ws8ErWVhpa6i6qGAeMEeVN0+/GOaku7t79u/9QL1vOL9uz3toFWkbD3LSPy7fWzv hOV8GxL6X1DAUyAe4ancbCM1YMOHLERtozYhB5L4ZaO6kiDv7jDh8ix/HGthRgbl oreJtDqnfRRYVyh+56su8LptQXrkZSsD6zjrfUPQTIUgNZtUwjiR5GZwgBSIEBTT riGPHGCeDy+EB0jb/7qf5Q== =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FB713FE8306337B7

http://decoder.re/FB713FE8306337B7

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\MeasureReset.crw => \??\c:\users\admin\pictures\MeasureReset.crw.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ReceiveEdit.raw => \??\c:\users\admin\pictures\ReceiveEdit.raw.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\SelectReceive.png => \??\c:\users\admin\pictures\SelectReceive.png.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\WaitStart.png => \??\c:\users\admin\pictures\WaitStart.png.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\AddImport.crw => \??\c:\users\admin\pictures\AddImport.crw.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\BlockMove.raw => \??\c:\users\admin\pictures\BlockMove.raw.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\CloseMerge.raw => \??\c:\users\admin\pictures\CloseMerge.raw.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\CompressUnprotect.raw => \??\c:\users\admin\pictures\CompressUnprotect.raw.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ResolveResume.tif => \??\c:\users\admin\pictures\ResolveResume.tif.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\DisableSuspend.tif => \??\c:\users\admin\pictures\DisableSuspend.tif.4509y7	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\DisconnectResize.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\DisconnectResize.tiff => \??\c:\users\admin\pictures\DisconnectResize.tiff.4509y7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\InvokeSwitch.tif => \??\c:\users\admin\pictures\InvokeSwitch.tif.4509y7	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqo5o1nzj7j.bmp"	regsvr32.exe

Drops file in Program Files directory 25 IoCs

Processes:

regsvr32.exe

description	ioc	process
File opened for modification	\??\c:\program files\SubmitTest.avi	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertSelect.DVR	regsvr32.exe
File opened for modification	\??\c:\program files\GroupSearch.htm	regsvr32.exe
File opened for modification	\??\c:\program files\InvokeGroup.xltx	regsvr32.exe
File opened for modification	\??\c:\program files\InvokeOpen.mpg	regsvr32.exe
File opened for modification	\??\c:\program files\JoinUninstall.zip	regsvr32.exe
File opened for modification	\??\c:\program files\MoveReceive.vssx	regsvr32.exe
File opened for modification	\??\c:\program files\ProtectStep.ttf	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertFromRequest.mht	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertSkip.ppt	regsvr32.exe
File opened for modification	\??\c:\program files\DebugSave.scf	regsvr32.exe
File opened for modification	\??\c:\program files\ResizeExpand.vsx	regsvr32.exe
File opened for modification	\??\c:\program files\RestoreSplit.rle	regsvr32.exe
File opened for modification	\??\c:\program files\SplitCopy.snd	regsvr32.exe
File opened for modification	\??\c:\program files\AssertResize.mpeg2	regsvr32.exe
File opened for modification	\??\c:\program files\BackupSkip.jpg	regsvr32.exe
File opened for modification	\??\c:\program files\InvokeConnect.cfg	regsvr32.exe
File opened for modification	\??\c:\program files\MergeSwitch.css	regsvr32.exe
File opened for modification	\??\c:\program files\RegisterUse.vb	regsvr32.exe
File opened for modification	\??\c:\program files\RepairConfirm.gif	regsvr32.exe
File opened for modification	\??\c:\program files\RestoreEdit.xhtml	regsvr32.exe
File opened for modification	\??\c:\program files\StopBackup.vstm	regsvr32.exe
File opened for modification	\??\c:\program files\CompressUnblock.m4a	regsvr32.exe
File opened for modification	\??\c:\program files\DenyMeasure.m3u	regsvr32.exe
File opened for modification	\??\c:\program files\InvokeCompress.css	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

4776 regsvr32.exe
4776 regsvr32.exe
4776 regsvr32.exe
4776 regsvr32.exe

pid	process
4776	regsvr32.exe
4776	regsvr32.exe
4776	regsvr32.exe
4776	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4776	regsvr32.exe
Token: SeTakeOwnershipPrivilege	4776	regsvr32.exe
Token: SeBackupPrivilege	4148	vssvc.exe
Token: SeRestorePrivilege	4148	vssvc.exe
Token: SeAuditPrivilege	4148	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4636 wrote to memory of 4776	4636	regsvr32.exe	regsvr32.exe
PID 4636 wrote to memory of 4776	4636	regsvr32.exe	regsvr32.exe
PID 4636 wrote to memory of 4776	4636	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bbdd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\bbdd.dll
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4148

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4776-2-0x0000000000000000-mapping.dmp

Download
memory/4776-3-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/4776-4-0x0000000002910000-0x00000000029B7000-memory.dmp

Filesize
668KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads