sodinokibi | 12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39

General

Target
12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
Size 120KB
Sample210323-wfpb8whegx
SHA256 12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39
MD5 2075566e7855679d66705741dabe82b4
SHA1 136443e2746558b403ae6fc9d9b40bfa92b23420
SHA512 312dcb3d83a5201ef16c5027aabd8d7baebfd9761bf9514cafecc8a6936970b897b18b993e056d0f7aec81e6f0ab5756aa5efd3165e43f64692d5dbdb7423129
MD5 SHA1 SHA512

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\vkyz4h-readme.txt

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension vkyz4h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0EF5DF8065515373 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/0EF5DF8065515373 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: wwKK1q1Z9Rc2VtFHechjaMWiGLmJPjt/vdOtIrJkxPLUEqfuVDCahIgKm38NIcuO ly/eSAW6NZJHoGIYfIUKrEepud+VMd1kW3PtaXvWEf0paSR2vFYyMN15gJkSc2b+ 79AyT6OSjCSYFR6XbTDCghfBNGVw30ANTVzfOAsPnZLR9fhbLEwBkz2i7nKgMqiC l9EDkle+Ekg6FIuvqwUXVhT95wncgZEyv0Pf7xZadkbjxME+xxrXyk/eOoCywEB/ LLFNBU3ImMP1LNkR9utVaQJGjab2IjWysjg6s9QKfmiuhiLGPIW51UZk1wwmAvJN s5WtqcAv955+FeSbS3QFNMcwYue26xl6vR/JMVQQ2/P2f9y0uBNkJB4AvJDkWyVO nlbJotO3Hfax2TAeWibWIfLQeOblETOqLkNVZxJPiqUbopvI4H8qPG0KhKVR3qJk UwQ03EruY2VYV91ypZe5v6qDnM/BN8AR7K059MXbfsYFC84oKryFoVHKkMv3US1m wDcNMOYuHgsFU2KMHwWQFnIF0sIrO4iGx2iQTsZ+dObaB3iJI7oHGgLu5DyVD5iW 6dlAyJxFGGJ3T6gxXZu7FaCm9uiJDKj+FtuZj+N+qUQ4jvMDCGNOm1HFhIrmFP1Q nixl1v/WKy2faiSa3SK5oi5LeiCfn2UEBMuAef3/noYU+kspeXuauq6BUpESUKAN 9/EaaDrl1MB37jF5hlJLWAxrrVWtAqL1WVLH+npF5d/eWeu+v/yAst9llML40RAN ZUo37e5sAcH0IMzw157169wy+dCTkaJ5/JuTHVKXAbzh0chtH6YIksl06ndoFHC6 Mm+0OWq0fBNVjYWWxlCAtAmSi1AH/AvdqHg8krVjmWem2zV+M+Cda2RAZJpIaTW3 H/kSwLqzE41y9n8NsgYINdZCgJl+iJTBEV7A75Aj0MA1EFt5BePQX817aUcZ1bdV SLPYACEzlcBgKNZHlv68oEEi3iQjUmE7NAE46KzAk+sbP2uXV96Exv2nuWEA7jZV 4LUPb7m3g95SCNRpBl+YML6IeB+ViLKLEgqIt1RxSKytGm0lNRal0wjzSL1Fb0ra tS2jS40Q6NbERKhoqx05BZlQaKxGpChKDcAUMqp70Eo48wna0UkHASZ6SDPjZ5eu CFUcXueUeJWUCHUQmEaXOYZWAsUf5IDNgLBWteO6fcAngDdFCBFUQyFkXGQcxHns ygQbUbw63nwgoramBR5sPKjqLd+gewhGgss+hFBtriXJOgirFJH7ymfPkwccAGPz AnDRrrxw ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0EF5DF8065515373
http://decoder.re/0EF5DF8065515373

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\DismountResize.raw => \??\c:\users\admin\pictures\DismountResize.raw.vkyz4h	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File renamed	C:\Users\Admin\Pictures\MoveAdd.raw => \??\c:\users\admin\pictures\MoveAdd.raw.vkyz4h	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\users\admin\pictures\ClosePing.tiff	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File renamed	C:\Users\Admin\Pictures\ClosePing.tiff => \??\c:\users\admin\pictures\ClosePing.tiff.vkyz4h	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\J:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\M:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\P:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\A:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\E:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\K:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\L:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\O:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\R:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\T:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\U:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\B:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\X:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\D:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\W:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\Q:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\S:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\Z:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\F:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\I:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\N:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\V:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\Y:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened (read-only)	\??\H:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c4ffvjwg4p9.bmp"	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ExportLimit.gif	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\ImportGroup.rar	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\RedoResize.docm	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\RegisterResume.ini	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\UpdateLimit.aiff	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File created	\??\c:\program files (x86)\vkyz4h-readme.txt	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\ConvertToMount.vbs	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\EditBlock.jfif	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\ComparePublish.rle	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\CompressDisable.svg	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\UnlockConfirm.odt	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File created	\??\c:\program files\vkyz4h-readme.txt	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\ConfirmConnect.mpeg2	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
File opened for modification	\??\c:\program files\EnableTrace.m3u	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3584	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
3584	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
3584	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
3584	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
Token: SeTakeOwnershipPrivilege	3584	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
Token: SeBackupPrivilege	4020	vssvc.exe
Token: SeRestorePrivilege	4020	vssvc.exe
Token: SeAuditPrivilege	4020	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe
"C:\Users\Admin\AppData\Local\Temp\12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584