sodinokibi | 892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f

Analysis

max time kernel
150s
max time network
153s
platform
windows10_x64
resource
win10v20201028
submitted
07/04/2021, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f.dll
Size 119KB
Sample210407-5ffjds8z8x
SHA256 892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f
MD5 52d280d45daba695a565e25cdd2863d8
SHA1 60c525e2a52137514d3dfa72e8a49a0d4da98759
SHA512 8304713277dddc0e9f899d3f91b1a8e33fb654945bd71f45185dcfee70a681df337d53df891272003ec93827aa2d5db77a9c652a3253409fe65b42c368a55701
MD5 SHA1 SHA512

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\6sw9v-read-me-KRBL.txt

sodinokibi

Ransom Note

---=== Welcome Kubasta Bickford & Lorenson ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 6sw9v. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your info copyed to our servers. If you do not take action to contact us, the data will be published for free access to everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F4DE6354A5D3A379 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/F4DE6354A5D3A379 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Dps3CsenGYTVrHV4h8jb2nlkcwnG5eNKSPM7dPbjsqR97nFfvFA7x8CpalcQ0F0z 8Lz/ezEQLvydXvTchmOjNTQT5dn4iT+ncHQo333KrnrTvGVSHigkNV64zEpujOZI RTfG0yVFqAJF6ljy6+0RgnOL27oUmTrZiDFh2eaw7RP+z8FaRqH+LEv42sDWlR5f UKxAL2p7mRMqRyDnadOwywAE5kIwXhTVuGw4kBgC7YksPmkftpytJi6mEuNP1juF rMxel6xMbRj56RcQeDOW/tlwjt1GB2tk5Hw1ymhXf7s9Dcy2XFGc3vvQnA0tzmsQ sujm6VlF2tgeQgV16YdlqnAKkWngmkGnXhwox0AAaYtCr/M4SfiGVh1+bowyfptD IUzsBqFmY0VYEvqL/7XzLD4YLBPA25ExIHKB141Tf2mKDTkZq17mzdajScGtbUNN +wbQNSTRZJcPTsrAjOtCUi7QQ/sDtYl4+dSU2p4Xq2BrEl4enhaoGQITmvEWU0kB hZylrbl2FQ2LkSV0TlV/HhY0C1lqxplfIrkQ2mzwUpM2bdeht+FF5XOGV9HoZzQ6 33aMtbq8vTWNdq0Z+n1coGQCL1xb8Zt2x1YObKlVvYXFN0MkVRppFnLhCfQDfijP zA7oiToh6mBixxrwkV685lff+advZmGnhVocSKxaPhWVDkUFzxWqqSx8Iquat4vq O7YoT3Kf270UJBLFURtYvORPzeO71dVEU2RUhoZM7ubH2UbZhTEq9dzFAHM3wcxf sVQTCURkHyRttqOwknxvh6u7DIvsCpB817H/y3JqY9O6YU7Sw52h72vqnGFC7MEd 7fgLEz6FTl3hm+HfwtJ0k0vi61SvPmkPsfM8+qZDuha2gFqowyHQEZUrMZmr21p9 xKm+kVR6vWSKXmSo7Chy5cuhojikcxR2Jg3fU5/84ksxnRW6egqsaJgiPjX+vrLW 1Y9BQdAXwNvhDlCBSEE7FZvIJ+Cl7siZzZIm6rVxetFxfyJEtJNkss9vnCiGjbAJ JVdbXtEpLgiXimkYm1jOzGuJ/H3YDnRnP9LcSYXA1bGH8uCsU0VDw4sOLlqv4Aov gp8gY5K9ovQXzstQbWqkZnHC6a4NTdr+WhTbdbaW7RzK/Yv3t0xTDn79Qir88Dj1 bEw4V/BBIbH65DVATKRzf/tJYj+olkNe/+Il16pyIer8P4QZ/FCh5IbdWwHj6NxQ tGfyJWze0Y2VfwYiQ5kFHzlwrJyZBrOt7d0MDzVYkANM6300YLwtvt4MOWWL5i7E /0oFCg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F4DE6354A5D3A379
http://decoder.re/F4DE6354A5D3A379

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\StopGet.crw => \??\c:\users\admin\pictures\StopGet.crw.6sw9v	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ClearResize.raw => \??\c:\users\admin\pictures\ClearResize.raw.6sw9v	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\EnterSelect.crw => \??\c:\users\admin\pictures\EnterSelect.crw.6sw9v	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\FormatEdit.tif => \??\c:\users\admin\pictures\FormatEdit.tif.6sw9v	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\FormatRestore.png => \??\c:\users\admin\pictures\FormatRestore.png.6sw9v	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\InstallUnprotect.raw => \??\c:\users\admin\pictures\InstallUnprotect.raw.6sw9v	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\SearchRevoke.crw => \??\c:\users\admin\pictures\SearchRevoke.crw.6sw9v	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ShowCheckpoint.crw => \??\c:\users\admin\pictures\ShowCheckpoint.crw.6sw9v	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4o0tn83.bmp"	regsvr32.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\CheckpointResolve.php	regsvr32.exe
File opened for modification	\??\c:\program files\CompareReceive.xlsm	regsvr32.exe
File opened for modification	\??\c:\program files\CompressDisable.MTS	regsvr32.exe
File opened for modification	\??\c:\program files\EnterSubmit.scf	regsvr32.exe
File opened for modification	\??\c:\program files\StopCopy.mp3	regsvr32.exe
File opened for modification	\??\c:\program files\ApproveRestart.scf	regsvr32.exe
File opened for modification	\??\c:\program files\BlockClear.tiff	regsvr32.exe
File opened for modification	\??\c:\program files\DisableCompare.tmp	regsvr32.exe
File opened for modification	\??\c:\program files\ResolveStop.pptm	regsvr32.exe
File opened for modification	\??\c:\program files\RestartGrant.xml	regsvr32.exe
File opened for modification	\??\c:\program files\UnregisterMeasure.cr2	regsvr32.exe
File opened for modification	\??\c:\program files\ApproveEdit.bmp	regsvr32.exe
File opened for modification	\??\c:\program files\BackupSync.mp2	regsvr32.exe
File opened for modification	\??\c:\program files\CopyGet.tif	regsvr32.exe
File opened for modification	\??\c:\program files\EnableBlock.dwg	regsvr32.exe
File opened for modification	\??\c:\program files\ExitSearch.mpeg3	regsvr32.exe
File opened for modification	\??\c:\program files\SplitLock.svgz	regsvr32.exe
File created	\??\c:\program files (x86)\6sw9v-read-me-KRBL.txt	regsvr32.exe
File opened for modification	\??\c:\program files\PublishSplit.ttc	regsvr32.exe
File opened for modification	\??\c:\program files\SetUpdate.php	regsvr32.exe
File opened for modification	\??\c:\program files\OpenTrace.xsl	regsvr32.exe
File opened for modification	\??\c:\program files\ResetInitialize.ram	regsvr32.exe
File opened for modification	\??\c:\program files\UnprotectUnblock.dwg	regsvr32.exe
File opened for modification	\??\c:\program files\UpdateRemove.rm	regsvr32.exe
File created	\??\c:\program files\6sw9v-read-me-KRBL.txt	regsvr32.exe
File opened for modification	\??\c:\program files\BlockSelect.cr2	regsvr32.exe
File opened for modification	\??\c:\program files\CopyGet.mpg	regsvr32.exe
File opened for modification	\??\c:\program files\StepStop.m4v	regsvr32.exe
File opened for modification	\??\c:\program files\UninstallRedo.search-ms	regsvr32.exe
File opened for modification	\??\c:\program files\UpdateRevoke.vsw	regsvr32.exe
File opened for modification	\??\c:\program files\ApproveRepair.crw	regsvr32.exe
File opened for modification	\??\c:\program files\EnableSend.ppt	regsvr32.exe
File opened for modification	\??\c:\program files\PushMount.css	regsvr32.exe
File opened for modification	\??\c:\program files\SplitPush.vssm	regsvr32.exe
File opened for modification	\??\c:\program files\UndoUnpublish.xlsm	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2316	regsvr32.exe
2316	regsvr32.exe
2316	regsvr32.exe
2316	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	regsvr32.exe
Token: SeTakeOwnershipPrivilege	2316	regsvr32.exe
Token: SeBackupPrivilege	3408	vssvc.exe
Token: SeRestorePrivilege	3408	vssvc.exe
Token: SeAuditPrivilege	3408	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2316	1108	regsvr32.exe	72
PID 1108 wrote to memory of 2316	1108	regsvr32.exe	72
PID 1108 wrote to memory of 2316	1108	regsvr32.exe	72

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f.dll
  2⤵
  - Modifies extensions of user files
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact