sodinokibi | d2fcfddfcfffdc2236e7cf7ece8579c7c104a333ad0697304392ad0629541682

General

Target

d2fcfddfcfffdc2236e7cf7ece8579c7c104a333ad0697304392ad0629541682.dll
Size

116KB
MD5

c75f4c8e053f5aeafdf0169698b7823e
SHA1

be6cc1941aeae4ba84715d5f197089fbacecb788
SHA256

d2fcfddfcfffdc2236e7cf7ece8579c7c104a333ad0697304392ad0629541682
SHA512

83787bd850c6ce35fd1fbb511204b60a6cf9e8ba1b9b08af812608e45f6b1e8aef371e2c7e5eaca662ee8f86bcf41f01bbce47cb685b32c138de12e8998a427e

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\w5813-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension w5813. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A50E2C07329F83E2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A50E2C07329F83E2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: BVY4hYr9DPMofLQLlHpS47l0TvcLDEqilraucg+bTDKkseS5drWxsV2GEY6GLIhm nkyn5sC1ekAwlrJE6PwCHS4JRS+2awh1jnKqbSV9EBY81QvkW+oT8wFUwFo3PahY YdwzpBVr/lv067wDjIEpGb0QB38kXnLzLd4RlKdSWICM0ZblBr9xcESTRoprZ4G+ nDQLKgO//LrNjimc0CKipKhV01oLK4kwFBO/UKO3sXEqSS/X8DtfYqMd1n+7ju05 LkwxeAY2iaM7J4ciplHSljspsAaM6ihjv4H060vlEIS4VEpqW372Nxnfgye+xqRN wawXkv0tEyWKkGNNN1unbXOpQE50b39VqQnxOk4BhSYX60Xhv6wLoetHpwvsUzSB IXuG2qc2GndfD20znhR8K9SCe/nozAzFCVRcNTVrsWgwN3jtXCgwOdyN8H+N8qP2 PS7TYXOywKSmxfYexiFQer4RwbJQKL6zEHoPcCRQWwjsP4O2ndKtyC+Bi2rZ4ee3 0wSXeWpu1LoFsAAWCR1NdqlZ6tssYxlB3e/EQA+uLSe9YWM1nR0xCsA3O9lfyog2 TefrcN5MfIxBGesDfe/twICjCgf8WXUNtQq7YwWzLpxPWPi3xtrVGhoXUOx/LnJR z8X46fL9B4Y5HTGRPIkUaQlz22ICKBVzjPIlcQ+wsTAbAOB7LgKns54NfXx5wu4w +tr2fiLWVYecJzlKjfvp6vRCVxyrP5rIOpO9CkdtpcSpVWikdht6QzxWZR6cSUmn 4DvlW3wYjZpDJeJR79SOdqDO7SRYp5wiOZ0zQrHukmg/+bcHNH/cAGzV+eNp/J8O FTtSzw+hlFsT+MnosdqlAbQoL1EQnpgAOlP1kFl8L4jh+ZF/s48mzFpIklQgXXEJ qofoLKL7qnZtQ05iZUmyb7SJk4jDFgIvT2fjCcEg2TpS1+ZJUzSiFzA3ESpFKgrw dwA4qdJlqbUr+klAPrR5SgAyDRGhKw0Ko11DSpuCLT00N2ZZl0XpFVZUsxiDKFdN 7G6ce9v65CXwDxfH9T8iPDMKCDkmcKRssV7TYm3gTn+ZyIox3TSCaduU2W3mkmUJ j/v00MEXG/Ne23HUEf20ALxkyv6ld482Xt0QFUnG9FHZpF1QN1Nz9Ka5qg8FKXb9 Uk8aJQRBiPWutV218f+nzkkc3cTarFs8AoEctAje44pHsDjgHF3HUatGiPEO9uts 6WzzClKYuqR7YMNuuzpkj+m0a9TH0pyZPgkG2iKJ6arWXANp6nNU1sEdj64aKSP0 scIcQNs0G2GY5Q7kPQ4= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A50E2C07329F83E2

http://decryptor.cc/A50E2C07329F83E2

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe

Drops file in Program Files directory 17 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	\??\c:\program files\ConvertToCompare.docm	rundll32.exe
File opened for modification	\??\c:\program files\SubmitPop.xps	rundll32.exe
File opened for modification	\??\c:\program files\TestSave.xlt	rundll32.exe
File created	\??\c:\program files (x86)\w5813-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\RestoreDisable.vbs	rundll32.exe
File opened for modification	\??\c:\program files\EnterSuspend.avi	rundll32.exe
File opened for modification	\??\c:\program files\AddSync.zip	rundll32.exe
File opened for modification	\??\c:\program files\HideDisable.bmp	rundll32.exe
File opened for modification	\??\c:\program files\ReadEnter.mpeg2	rundll32.exe
File opened for modification	\??\c:\program files\SelectSwitch.ex_	rundll32.exe
File created	\??\c:\program files\w5813-readme.txt	rundll32.exe
File opened for modification	\??\c:\program files\ConvertFromPing.dwg	rundll32.exe
File opened for modification	\??\c:\program files\RenameExit.php	rundll32.exe
File opened for modification	\??\c:\program files\RequestRemove.au3	rundll32.exe
File opened for modification	\??\c:\program files\UnblockUndo.wax	rundll32.exe
File opened for modification	\??\c:\program files\UndoRemove.otf	rundll32.exe
File opened for modification	\??\c:\program files\BackupUnregister.svg	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1972 rundll32.exe
1972 rundll32.exe

pid	process
1972	rundll32.exe
1972	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

rundll32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1972	rundll32.exe
Token: SeTakeOwnershipPrivilege	1972	rundll32.exe
Token: SeBackupPrivilege	3684	vssvc.exe
Token: SeRestorePrivilege	3684	vssvc.exe
Token: SeAuditPrivilege	3684	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4012 wrote to memory of 1972	4012	rundll32.exe	rundll32.exe
PID 4012 wrote to memory of 1972	4012	rundll32.exe	rundll32.exe
PID 4012 wrote to memory of 1972	4012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2fcfddfcfffdc2236e7cf7ece8579c7c104a333ad0697304392ad0629541682.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2fcfddfcfffdc2236e7cf7ece8579c7c104a333ad0697304392ad0629541682.dll,#1
2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3684

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads