sodinokibi | d2ea89e73804efccefceaa193c80ef4a8454f7db638c0d3502530652a8a430e9

General

Target

d2ea89e73804efccefceaa193c80ef4a8454f7db638c0d3502530652a8a430e9.bin.dll
Size

118KB
MD5

c9b3946c7408aac0c307aabb90881908
SHA1

bed3433d677c3ceddab2a7c927cfc3cf336dc172
SHA256

d2ea89e73804efccefceaa193c80ef4a8454f7db638c0d3502530652a8a430e9
SHA512

5f839954c71d350bf13610933875459bda9d955c7b9d2828ddc28668a60b7625db94131a04ce1b567a2bf98b96703ac038f6ed0364cf415abc0b880b7e13c9d3

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\4z5x872y-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 4z5x872y. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/214D9B37DEF128DC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/214D9B37DEF128DC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: bknZDYV+a84AD8DxZr5fZwAJuGUYDYKBC7ng9hoyxFCPxMCyoAhBs+ZnFZUCOz1s uGB+pBziK2jwZ4tiK6zfhSZPyvcJlQhyxLMcg43Yh7IRU68H1ySHc6n/1GKaMip1 hnDMxgb0wP/09hIF9nyl911z2Ax+X8YhFI0PZXNLprR2y++wIMLvzINTjDBiF1kd Fi2u4A5HMPAuHlFAjpLbRK5w8Q4v+wKqgAU+HQE4qvQhBzr8TTAKwUVBQBd4Wbbi DIA2WMIXdrmAjJR043fPSCqZyvb/77VEgDBFFnDo6fUneTryubgijHbC7bXWqa8R VS8UYoWrHaYZdNE05BGtqacfu9RMJhA8pXn5HfZEpRWn8U5HaJS5yjeUtpqXATaZ pAsFLH7F+346tSR0RUuR+QG3dzU+y7wJhwsHn6Uhqu0M55TNOkazH4E5eiQzvfbG tfQCnoZlJCZMAFR8vYAUwzJzJLPNBgl/ceUNLSNjHoZn8NdqCq4i7Pf4OeRfX5UF b5GDw+o27162q/wv8dg7ttrju34aQrpv+Zw1+/ToDeiIUwU7aoXCVdw4G+3ooXP/ Yjtrho3/qOVsMcpdAOuRU9IrwQyGfKV4PiEjqDJXPhOmCSQqObmrFpeBng0FsB9X JJQgSkqajIRw+Xr0QoqhlTCPmyJT7t5i0zc67eb1+ZfK5dJGkuBYeQ5OlKoVppbW q5aNa7dlRSh4d6TgXicj6xXstRgbElXQMOdh4nkGliiE05tP6yx+wepjb2ZxMolC 6ZCA5hsNRfz0iO+mETV4LuHh+xRV9SrZxRw5EtxFfrHwon9QucHLq8TIbes4hzGC rHpqyUZQKeZ469x3FLLWY1eft9JMPGaR2oCiSYIcFpIxu6672T8CStWnrkjJ9GIY V5r+pXmnCFGa5ehfaoytelQF9oz6dZGg0SmDd6XtsDK1tp/iipVT/4cql+wrF1K2 QG9yGmAxLPWsWbB6pz32SIQYhTV+p1xmsL3LVSTVlBK1/hmpdU/mxvtufhcxev7B MfZdaThBQCh2ZqQR45Eg6sywxDn6OWchWd2tXw4AEZhji92uXF6VNAqBCiuV+uTM /GCW1srCjlpHriyvcnBrFveXYqpYu1pppaGhOBrdOlz1MOXN28ZD1Xletrlhs7wJ pZ7PyigFIj2QYvd+TgxTAXmFYpw9+GltZrN1xIjolkiuJfjGrayVfRXZifQ5gddm XySd9pZGnk8lBD2JJTTuyjFRiHd55WtA9iBG7goDZIB4SyXd/+iG+7MANbF9aeld Q63MjlrnJksP6UUPaLC5ztNrfkI= Extension name: 4z5x872y ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/214D9B37DEF128DC

http://decoder.re/214D9B37DEF128DC

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ClosePing.tiff => \??\c:\users\admin\pictures\ClosePing.tiff.4z5x872y	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\DismountResize.raw => \??\c:\users\admin\pictures\DismountResize.raw.4z5x872y	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\MoveAdd.raw => \??\c:\users\admin\pictures\MoveAdd.raw.4z5x872y	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\ClosePing.tiff	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vk4.bmp"	regsvr32.exe

Drops file in Program Files directory 12 IoCs

Processes:

regsvr32.exe

description	ioc	process
File opened for modification	\??\c:\program files\EditBlock.jfif	regsvr32.exe
File opened for modification	\??\c:\program files\EnableTrace.m3u	regsvr32.exe
File opened for modification	\??\c:\program files\ExportLimit.gif	regsvr32.exe
File opened for modification	\??\c:\program files\RegisterResume.ini	regsvr32.exe
File opened for modification	\??\c:\program files\ComparePublish.rle	regsvr32.exe
File opened for modification	\??\c:\program files\ConfirmConnect.mpeg2	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertToMount.vbs	regsvr32.exe
File opened for modification	\??\c:\program files\UnlockConfirm.odt	regsvr32.exe
File opened for modification	\??\c:\program files\UpdateLimit.aiff	regsvr32.exe
File opened for modification	\??\c:\program files\CompressDisable.svg	regsvr32.exe
File opened for modification	\??\c:\program files\ImportGroup.rar	regsvr32.exe
File opened for modification	\??\c:\program files\RedoResize.docm	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

1460 regsvr32.exe
1460 regsvr32.exe
1460 regsvr32.exe
1460 regsvr32.exe

pid	process
1460	regsvr32.exe
1460	regsvr32.exe
1460	regsvr32.exe
1460	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1460	regsvr32.exe
Token: SeTakeOwnershipPrivilege	1460	regsvr32.exe
Token: SeBackupPrivilege	2904	vssvc.exe
Token: SeRestorePrivilege	2904	vssvc.exe
Token: SeAuditPrivilege	2904	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1924 wrote to memory of 1460	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1460	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1460	1924	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d2ea89e73804efccefceaa193c80ef4a8454f7db638c0d3502530652a8a430e9.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\d2ea89e73804efccefceaa193c80ef4a8454f7db638c0d3502530652a8a430e9.bin.dll
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460