sodinokibi | d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6

General

Target

d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
Size

120KB
MD5

726d948d365cb9db1dfd84a30203a642
SHA1

78ed4bcf9c0aca8d14b25da2e679a91c48dd6797
SHA256

d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6
SHA512

bd17f2b265c30f0d9ddc60e01026f21ad6b6355f68b762b14b3e8882a90de0a20970f77105a2515a7cb4a0d1429f3a70cdf40d4247384592d36da6f2907a690a

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\89277-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 89277. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 70 GB archived data from your file server and SQL server Example of data: - Accounting - Finance - Personal Data - Banking data - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/70B787E72D09333A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/70B787E72D09333A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gAcKy5HpU6Y4ra5JIZUYUxCBWgGGCYBDX2VPpXeHs1TRMS1kGYp2/fDie0XJI1+U kZx/ivaOXwMusGFWXUNgG/kpxlpxNWuL5f57mT+2bn/yM6xHRMi0+fk6AbL3v789 BXSjnDfepXAnque6IJNmHvn6NHPMz3a/P5l5KEZWFlPpOmyGPy+HoHYIgw5qPjGh yoSpqqAvlusDeHiHKjrcJeo9V1+pqiqm5uOjOyttFT2dZ0p4oCYiz0VCCdrG3cfP lZFjd8CNM7DPiFrGlAjxaVDA0C78S56E/cnsONmVYnuR8qlhV3tP2ECu5vXlPug5 DJem2xqlsDd2KsBOKWhBkHYXSxm7ZUS9MXA8Vsc7roaV+iyxo5H68WUrHOL72zNW aQXsFPcwUAa9KZWEX1eJ53OXNeK3l7bRDrp3+8evmgxd6ih13EX2MRRIxNhybuTp tWLruqJmRZ74+MYuaP5CT4VTlLwuMKbprlYd1wgIdLBiG3ZFtLue6bR3lZfMgUTd aex58isjvpjw1tIS7IqI/xZJKBu8KOyZBj3RrKDEc+/rRIKda4Iu7q71Irzfifim 4/DUGZRxRa/fAekYFT0IXJFzid7WS/Cav0EERhwLaiT8tfsGJ/Is2heChYmfC9IR xtXP0qbaIlMcxHBHwaya1WOiE83M4s9VWx4qOWX1xjzWfV0NgjxBR3fXY6Y9/tUP H63WL7EXeL7DRHbU2VHS7Gdmo5+J89RQ/1JagF1So0ZJ+Cgjj1ke3yW/dvZmv03b /o9Nwm/KZt5C/PNXMeqvGIRlFSbi+rE+RCGC3fmt5B+ST3B6Udn+qj58sKm/XK5t 8CszKSK8c0cbds4THJ1S1IeWIv2/Ek1p4og2oYQs60LUox/WFesRxleXCHD/W14G afFnutwIU35I8IsJxLECopK3qaOmefwn95Nlk0BJYvFWrGOkuTkeE3akv2rnPA7e QPG/jzQBkNbtFHuZCsEwyrxlDaFL7etvRTnbz3DBIEvWAD/eWU8pzwiE9B5bW+G7 sMmdfEctRw+SxA8KsEEBC0ytAj6nOH6WAvAWuo0AkVsgPeWhZu+MScH5OYoowEIP tNJMbGrDPhElswyb8aSFkcy2ZnRPJvKqXBfrkk1Vdd4/4Tj9lPtvDvmGB/fZLCap lx13g2fwLtwqhqLqGPr2nROld5oM6lJV9+eZ9vUygm3agfno3drDnQ+0sg0v5e3S D0qic9u2dWcRWf9nb9Y1ayoP8XiKlmpEAM4VWBkEGhEU8N4LvLIYDHdKpqt2kB+t fVAflw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\DisconnectResize.tiff => \??\c:\users\admin\pictures\DisconnectResize.tiff.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\MeasureReset.crw => \??\c:\users\admin\pictures\MeasureReset.crw.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\ResolveResume.tif => \??\c:\users\admin\pictures\ResolveResume.tif.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\AddImport.crw => \??\c:\users\admin\pictures\AddImport.crw.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\BlockMove.raw => \??\c:\users\admin\pictures\BlockMove.raw.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\CloseMerge.raw => \??\c:\users\admin\pictures\CloseMerge.raw.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\CompressUnprotect.raw => \??\c:\users\admin\pictures\CompressUnprotect.raw.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\DisableSuspend.tif => \??\c:\users\admin\pictures\DisableSuspend.tif.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\SelectReceive.png => \??\c:\users\admin\pictures\SelectReceive.png.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\users\admin\pictures\DisconnectResize.tiff	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\InvokeSwitch.tif => \??\c:\users\admin\pictures\InvokeSwitch.tif.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\ReceiveEdit.raw => \??\c:\users\admin\pictures\ReceiveEdit.raw.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File renamed	C:\Users\Admin\Pictures\WaitStart.png => \??\c:\users\admin\pictures\WaitStart.png.89277	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

description	ioc	process
File opened (read-only)	\??\Q:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\T:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\E:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\F:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\K:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\M:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\N:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\P:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\W:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\Z:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\B:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\G:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\L:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\R:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\X:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\H:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\J:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\O:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\U:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\V:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\Y:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\D:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\A:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\I:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened (read-only)	\??\S:	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\87h.bmp"	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

Drops file in Program Files directory 27 IoCs

Processes:

d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

description	ioc	process
File opened for modification	\??\c:\program files\ConvertSkip.ppt	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\InvokeGroup.xltx	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\RestoreEdit.xhtml	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\BackupSkip.jpg	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\ResizeExpand.vsx	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\StopBackup.vstm	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\SplitCopy.snd	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\MergeSwitch.css	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\MoveReceive.vssx	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\ProtectStep.ttf	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File created	\??\c:\program files\89277-readme.txt	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\ConvertSelect.DVR	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\DenyMeasure.m3u	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\InvokeOpen.mpg	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\RestoreSplit.rle	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\SubmitTest.avi	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\ConvertFromRequest.mht	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\JoinUninstall.zip	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File created	\??\c:\program files (x86)\89277-readme.txt	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\GroupSearch.htm	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\RegisterUse.vb	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\RepairConfirm.gif	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\AssertResize.mpeg2	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\InvokeCompress.css	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\InvokeConnect.cfg	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\CompressUnblock.m4a	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
File opened for modification	\??\c:\program files\DebugSave.scf	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

pid	process
4636	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
4636	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
4636	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
4636	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4636	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
Token: SeTakeOwnershipPrivilege	4636	d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
Token: SeBackupPrivilege	4156	vssvc.exe
Token: SeRestorePrivilege	4156	vssvc.exe
Token: SeAuditPrivilege	4156	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe
"C:\Users\Admin\AppData\Local\Temp\d74f04f0b948d9586629e06e2a2a21bdf20d678e47058afb637414eb3701c1f6 (1).exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636