sodinokibi | c8c169ad2628ff3860c4d0bd04afeb81262051f664f9d5a334c32c78e791a7f8

General

Target

ransomware.bin.exe
Size

118KB
MD5

39d22b8f3da4a83cd957f324f2423309
SHA1

70baae39f80e8917a71353110bb85e797e23524a
SHA256

c8c169ad2628ff3860c4d0bd04afeb81262051f664f9d5a334c32c78e791a7f8
SHA512

293ac35141e885e685b7ba588fea2ba84ece78441dea9c9b3e28d584923dc9ab0605016244d3f95dec56e49c701a9e19d006e8d5d3604a3423ed167b236a7ecd

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\3j428mt-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3j428mt. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 80 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Personal Data - Banking data - Strategic sourcing - Management - projects, plans - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5371DADB7A7051A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/B5371DADB7A7051A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9LP7/3k6BQ33zctdBc1/yBkB3pp3rV8LkrPg6pBscq3b1YbTgq418A9kKJcDDsGO vbAYMphY6Nljh8WbkZ6+n4poeNT8yMuTbfidb0Lv7gIOwQJk1bzapg7oTAT+syx/ N1uqk3HJkTiKrWYwlk4tGXfOAmzfHWtdmgURXkW9pppUZVz/QSDwzkK+qvEpYSQ1 YWJxpkd5hXMPUPa0cX94enkzr5jk2f3t33AsLQF6/dmAAuiyAdwKIH6zTIODCuUP Us2vCQuxp1BpD2/jQOg3vzf8W4kvQxiHpg/sBNdPqUlf+PLlRvIQlWIGnpv1l9M2 NDxGY20ZtDA4Py/5q/0aUMh4acqi28yHQ5e5D16kbdCM2vhZffkM44giwXkQiTno UUmoRqtRyXmoUW+DAEn/LXPqYIKRUCPAHWccOvHk4Z6T1Bq0zpQp2an8rKlq0qZh DnRJ7HQobnVO1+p0HPI984s5br+zORqMJ99Y+MvRIiwXf3UXmf9NoCZboGUCNl6k u4/Yrr7/Xk22nsUtd3geSWSoU0YiZ17HCIuSx4BAFc4jSqkWRIZWx/jzsC8aZuET MTTcTNngQBc0QR9bLB4fxtHQ4r6Y365KnRUIyns89qe3BET+mKOt85ZYKZhFEl7s n82ylFI3q14Xf5jKvwyW2xbM3wuN+N0NmnA9lxW3K49kaTb/wHHCGC8tLei9z1fa i88TT13yb0djovPtiMXxOT8bvh07VmDtunjsSw67FykyzbcIHo3S7kDp2BzXPXjG zwtmxrDBysbHonkX15EoLJ+hhFchwX1jrg4+3vGYOtgOfuUiZ4FLYMHAt/kAMZGA pTxOzMm8KkhtewTqmyDVWuiEhoRofUcTYkBTQV5zCWiwTS9spUtB5N82cbaYYXes lBk8M/THGUt38hRs4hH8aRukRhoKM7XZLNNmqqx8UKFEa5QR4POIBjxqvDI24mHy oDizHOBgJAdoy+q1XpypJJ0lCAzP85oJd/oS0Y9k+F+BNpW+UY22Xx5+OLG2urET oWwPMeUoA4hrqMStpnQejKiKyLawHnz+dbP+A0tKQMSoo1Zjfp8lb0SW7g455ijK KSJbMmR3kWyz9U92X0rcxpfNzISvO5ONXkxqNHQ9dm2+goC20+pVB/7Rdq5nvfkO 5ZW2VCfZumWEsKIrBq+BrwfKBkE7ETyfpaAmRbRJS13t1q1lexP/yiOO4Ty+xAdz M1LudjjZELTtUJkVxBMCJIjrwAtv0s8ToftqJbXyvNfQMoUbNyWjJe0om2fsVLpc DwiM0yWbdhEbGT5pHfiRj4e/ ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ransomware.bin.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RequestRegister.tiff => \??\c:\users\admin\pictures\RequestRegister.tiff.3j428mt	ransomware.bin.exe
File renamed	C:\Users\Admin\Pictures\SyncConvertFrom.crw => \??\c:\users\admin\pictures\SyncConvertFrom.crw.3j428mt	ransomware.bin.exe
File opened for modification	\??\c:\users\admin\pictures\WaitRestart.tiff	ransomware.bin.exe
File renamed	C:\Users\Admin\Pictures\WaitRestart.tiff => \??\c:\users\admin\pictures\WaitRestart.tiff.3j428mt	ransomware.bin.exe
File renamed	C:\Users\Admin\Pictures\FindPublish.tif => \??\c:\users\admin\pictures\FindPublish.tif.3j428mt	ransomware.bin.exe
File renamed	C:\Users\Admin\Pictures\JoinRepair.tif => \??\c:\users\admin\pictures\JoinRepair.tif.3j428mt	ransomware.bin.exe
File opened for modification	\??\c:\users\admin\pictures\RequestRegister.tiff	ransomware.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ransomware.bin.exe

description	ioc	process
File opened (read-only)	\??\P:	ransomware.bin.exe
File opened (read-only)	\??\R:	ransomware.bin.exe
File opened (read-only)	\??\V:	ransomware.bin.exe
File opened (read-only)	\??\E:	ransomware.bin.exe
File opened (read-only)	\??\F:	ransomware.bin.exe
File opened (read-only)	\??\I:	ransomware.bin.exe
File opened (read-only)	\??\Q:	ransomware.bin.exe
File opened (read-only)	\??\S:	ransomware.bin.exe
File opened (read-only)	\??\W:	ransomware.bin.exe
File opened (read-only)	\??\X:	ransomware.bin.exe
File opened (read-only)	\??\A:	ransomware.bin.exe
File opened (read-only)	\??\G:	ransomware.bin.exe
File opened (read-only)	\??\H:	ransomware.bin.exe
File opened (read-only)	\??\J:	ransomware.bin.exe
File opened (read-only)	\??\M:	ransomware.bin.exe
File opened (read-only)	\??\O:	ransomware.bin.exe
File opened (read-only)	\??\T:	ransomware.bin.exe
File opened (read-only)	\??\U:	ransomware.bin.exe
File opened (read-only)	\??\B:	ransomware.bin.exe
File opened (read-only)	\??\L:	ransomware.bin.exe
File opened (read-only)	\??\N:	ransomware.bin.exe
File opened (read-only)	\??\Y:	ransomware.bin.exe
File opened (read-only)	\??\Z:	ransomware.bin.exe
File opened (read-only)	\??\D:	ransomware.bin.exe
File opened (read-only)	\??\K:	ransomware.bin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

ransomware.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\k8ktucve1.bmp"	ransomware.bin.exe

Drops file in Program Files directory 26 IoCs

Processes:

ransomware.bin.exe

description	ioc	process
File opened for modification	\??\c:\program files\OptimizeSwitch.M2TS	ransomware.bin.exe
File opened for modification	\??\c:\program files\RemovePop.mpeg2	ransomware.bin.exe
File opened for modification	\??\c:\program files\RenameEdit.xlsm	ransomware.bin.exe
File opened for modification	\??\c:\program files\UnlockLimit.dotx	ransomware.bin.exe
File opened for modification	\??\c:\program files\DebugOpen.vstx	ransomware.bin.exe
File opened for modification	\??\c:\program files\GrantSuspend.mhtml	ransomware.bin.exe
File opened for modification	\??\c:\program files\ImportCompare.search-ms	ransomware.bin.exe
File opened for modification	\??\c:\program files\MergeDeny.ttf	ransomware.bin.exe
File opened for modification	\??\c:\program files\UseClose.docm	ransomware.bin.exe
File opened for modification	\??\c:\program files\HideDismount.svgz	ransomware.bin.exe
File opened for modification	\??\c:\program files\UnlockInvoke.pps	ransomware.bin.exe
File opened for modification	\??\c:\program files\UnprotectApprove.wm	ransomware.bin.exe
File opened for modification	\??\c:\program files\UpdateGrant.ADTS	ransomware.bin.exe
File opened for modification	\??\c:\program files\SendOpen.wmf	ransomware.bin.exe
File opened for modification	\??\c:\program files\FormatInitialize.dib	ransomware.bin.exe
File opened for modification	\??\c:\program files\InvokeApprove.mht	ransomware.bin.exe
File opened for modification	\??\c:\program files\MountResolve.dotx	ransomware.bin.exe
File opened for modification	\??\c:\program files\OutGet.vb	ransomware.bin.exe
File opened for modification	\??\c:\program files\ResolveConvert.mpv2	ransomware.bin.exe
File opened for modification	\??\c:\program files\SuspendSubmit.mpv2	ransomware.bin.exe
File opened for modification	\??\c:\program files\SyncMeasure.mp4	ransomware.bin.exe
File opened for modification	\??\c:\program files\UnprotectNew.html	ransomware.bin.exe
File opened for modification	\??\c:\program files\BackupClear.wax	ransomware.bin.exe
File opened for modification	\??\c:\program files\DismountDisable.docx	ransomware.bin.exe
File opened for modification	\??\c:\program files\ExportEnable.m4v	ransomware.bin.exe
File opened for modification	\??\c:\program files\JoinOpen.potm	ransomware.bin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ransomware.bin.exe

pid process

3116 ransomware.bin.exe
3116 ransomware.bin.exe
3116 ransomware.bin.exe
3116 ransomware.bin.exe

pid	process
3116	ransomware.bin.exe
3116	ransomware.bin.exe
3116	ransomware.bin.exe
3116	ransomware.bin.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

ransomware.bin.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3116	ransomware.bin.exe
Token: SeTakeOwnershipPrivilege	3116	ransomware.bin.exe
Token: SeBackupPrivilege	3936	vssvc.exe
Token: SeRestorePrivilege	3936	vssvc.exe
Token: SeAuditPrivilege	3936	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\ransomware.bin.exe
"C:\Users\Admin\AppData\Local\Temp\ransomware.bin.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116