sodinokibi | 68a96bd0c150d2808755edfc90b2263626de612b4907e772af3bb552f0fcc4ca

General

Target

68a96bd0c150d2808755edfc90b2263626de612b4907e772af3bb552f0fcc4ca.bin.dll
Size

119KB
MD5

fbd2a737bfd8a83dcdc9b9359e2ca68f
SHA1

8ef5072dc4351e49c11241f332577c7630656c95
SHA256

68a96bd0c150d2808755edfc90b2263626de612b4907e772af3bb552f0fcc4ca
SHA512

450a883d139f0a18d278b87b6810e73e97ed8e02a2e48256bdcbca25988ea440bbfa1977df728564f5c1c6db30b11c84f5f3f3dcb0a24febcddd868442a7453c

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\754v6cngk3-read-me-GLOBAL.txt

Family

sodinokibi

Ransom Note

---=== Welcome Global Underground Corp ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 754v6cngk3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your info copyed to our servers. If you do not take action to contact us, the data will be published for free access to everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/41CE99B36C28F853 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/41CE99B36C28F853 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ekY2qO1JLNLGEmZ6WJ/NcZxQ7zeqqcU1nTfhrav00wOLSiJEULDOiwuA1reGlynj jSLvRZJPLQ375CrCzXu4BgzPlIyA9MNGwEDBoHughZi9cwMXGpkaG8e6UzH0nKfw jiWOSHfD0dfpLzYcXJQhzLmaGQAvHwFYd4g5V9w+tRtouWrsWFNX16QKo/sE8nw4 cGMt0lrSHMNlPfqSmRY6trsAnAtjcRw+iQinh80ouyeZIT1wrmd1TPefGjmqWrsF UqDaAXrQXJZEA9P8dgUuD8jvtkW/IdBBLrou+yOJ23zX/3Uzc5srAJVfs+o8oXOr x/1BQupgZnZDAXfXIWfcBtZbEPv2y7noXCP9SXk94ghhFn9pXLeRW72c1GiDdwEL cWj3XW/j+7/xcuX1GSqMefGZ0bGoT37xuefNdWeawagd3/3EU7BrkOMn7YERb5pL X5+Dp1bpp+V0xBc1UskKMWfBYqkLGzIoQ4SJ787q2RxUjm9NiVaoDG94s6i6ofDx 3V9ixJfE6TS+ErdyaRJ5fwVqwQMu1cj24dfuegDvSTNh0otJbu32Tzijjl+ihaXn BEmdbyNsF6tZ2aYs6cThyLRsM8mg3BWKrerOmX65PK0eOCO0BCrtb5CWXzYWAbD3 9jBB52xsCzKz0lJuKF6sSA7XYM4mCuUd1Z2tIBoMluQlj85YC5qlqYXHXNj7YWv1 aKTtOfdbdFZul2yT1TJa3woVuMWM3dCPzVEwO56ZXE9llPLnO+jK55JWjSJPdPPG Z153tbye3MmJOB/YkXELv3mEhoU1k1XNL+J+bZyyvxAJn5RnEEE+4ZCap1ipc7dN QkKg5SbwqqG5LAXeCY8rqGV8maU4Zugv2n3zQVrCzWB5KehSa9TF/oq9CeA0VMg2 lsFqR6hG8p2ATrMHgA6nFkwNcgUj6L4PkeP4wPAAMSG5i2AeIipwJpQirjSa05o7 UctwY1pBp5ADo+V78xaWZlA7WBo2bp2AbmVlurH/O9a1ZJwzWDTOS9iovXToJC1Y gdigGNBJiuT3UgkVYa1706vbGqVxHbf4ZLRGR58fU1qDAgd0M43vB7cXeqbkbrs6 0RlkvCgrcz3k4xE22Gf9duoejsI0Lrk+cRv8MF7MABonlbrRLmSEHVHLJ4sipFyk kEpWSa+oLHBdmE6HRYJDOThLrqWWeDrKEZSkbwZZHJnfaGPdeThX35SVLMiaAlF5 hGLaDBiCfRMMIciOhiIi7L52JyQd5CI6x/z7OL8IxV4axqon1joyS9RVjesluyL9 YO4PlrtRltP6dPeeSsI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\InitializeBlock.crw => \??\c:\users\admin\pictures\InitializeBlock.crw.754v6cngk3	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\PublishStart.png => \??\c:\users\admin\pictures\PublishStart.png.754v6cngk3	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\StepImport.tif => \??\c:\users\admin\pictures\StepImport.tif.754v6cngk3	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a51.bmp"	regsvr32.exe

Drops file in Program Files directory 22 IoCs

Processes:

regsvr32.exe

description	ioc	process
File created	\??\c:\program files\754v6cngk3-read-me-GLOBAL.txt	regsvr32.exe
File opened for modification	\??\c:\program files\ApproveClose.search-ms	regsvr32.exe
File opened for modification	\??\c:\program files\LockRestore.htm	regsvr32.exe
File opened for modification	\??\c:\program files\ShowDebug.jpe	regsvr32.exe
File opened for modification	\??\c:\program files\SubmitUnlock.jpeg	regsvr32.exe
File opened for modification	\??\c:\program files\DismountClose.xml	regsvr32.exe
File opened for modification	\??\c:\program files\EnableExport.dxf	regsvr32.exe
File opened for modification	\??\c:\program files\SendBackup.avi	regsvr32.exe
File opened for modification	\??\c:\program files\SendExport.xla	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertToUnblock.eprtx	regsvr32.exe
File opened for modification	\??\c:\program files\EnterUpdate.wmx	regsvr32.exe
File opened for modification	\??\c:\program files\LockDisconnect.gif	regsvr32.exe
File opened for modification	\??\c:\program files\SyncStep.css	regsvr32.exe
File opened for modification	\??\c:\program files\RequestWait.avi	regsvr32.exe
File opened for modification	\??\c:\program files\ResetSkip.tif	regsvr32.exe
File opened for modification	\??\c:\program files\SubmitConvertFrom.vssx	regsvr32.exe
File created	\??\c:\program files (x86)\754v6cngk3-read-me-GLOBAL.txt	regsvr32.exe
File opened for modification	\??\c:\program files\GetImport.php	regsvr32.exe
File opened for modification	\??\c:\program files\PublishExpand.i64	regsvr32.exe
File opened for modification	\??\c:\program files\RedoClose.tmp	regsvr32.exe
File opened for modification	\??\c:\program files\RemoveSearch.rtf	regsvr32.exe
File opened for modification	\??\c:\program files\WriteExpand.sql	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

2280 regsvr32.exe
2280 regsvr32.exe
2280 regsvr32.exe
2280 regsvr32.exe

pid	process
2280	regsvr32.exe
2280	regsvr32.exe
2280	regsvr32.exe
2280	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2280	regsvr32.exe
Token: SeTakeOwnershipPrivilege	2280	regsvr32.exe
Token: SeBackupPrivilege	2016	vssvc.exe
Token: SeRestorePrivilege	2016	vssvc.exe
Token: SeAuditPrivilege	2016	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1052 wrote to memory of 2280	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 2280	1052	regsvr32.exe	regsvr32.exe
PID 1052 wrote to memory of 2280	1052	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\68a96bd0c150d2808755edfc90b2263626de612b4907e772af3bb552f0fcc4ca.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\68a96bd0c150d2808755edfc90b2263626de612b4907e772af3bb552f0fcc4ca.bin.dll
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280