sodinokibi | 6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d

General

Target

6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
Size

120KB
MD5

18e958c8975f67d02d3e6e4a269c2e08
SHA1

f03b3b2777ce07fd68b7d242c7355c93748f86af
SHA256

6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d
SHA512

3c74d8d13611565d9334cd80ebb3f010606edb30df17f1a052469e14b3df915dddc28bb9c1d99984cd2a610650e8dd7e4cb77f85f7730a833d2f8ed5cdadbdbf

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\9438anusxz-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9438anusxz. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E6307FCD73386587 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E6307FCD73386587 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: YN0384rOjV/1WtS/eZCAvAq3KXM3dqWSXGi69EQyhtFAY0LqcK0mDIpIgC2er6Oc xZ/qwZfvK7z+ikI2Yvo/33ShYyNplVYLVUyEdpqwodsqnSFBjO5HUTQprT7EfGrp tATrOtk9RsyHzQ2PsC2KQN+ofPSpvs63QHjtgWYpHxM5+U1doe4+KUQ9lQzN2sCg HceZdAH+qS2qnh0OPqu+2TYld1vzoE519Er51Xh7UYHBg2kuftLk8j4PTaUXXqh4 QxP+ltZ8UjxmOAOHvPjEyu3/ME0vMhvZFQnI7QFVWK4r3fR14c4idwYFZ9N0bWFA z9COLT0qjz1aIcEfIcXggDXrZvEZOmE6sXoTPs9fWY5iRDXb3aUja8Q369wwjq/w 1W+t7L0k2Zg22ywzaNjVgTxWbxSektnOdBwHqLlBtfq7W5QmR9cRGZDUfvcoQ3iG 8a9BO6fgYWyJDk0skKDF1X9RIOXhUyRq/l+6G5/iZkNQSUstM39keXHOKDwZUU5L WwGQmXMk1zk8ZYcGsIFJL/r+fVdNYXpXU/pbQblXx4IuL6Wlxcqa5t5R81AOG2Z4 dX+SHrKovsCFM9Wdl9AH0qmiNbWAmhgKiISYABG+FhJkRvhOfBSu/yp5SMzmSDOd 5CnL54Cewo6Eb9JCroaSC6mzE2+p1y8neIWk2ORmA4+MPlYj4T9lwEyIbrQzZE5u q1r4hjgfC5vZ2ZhDGWd9h8nutMFp9uoejjldJPpPboO2SCOqTLs4r/n+ezcg71NF D2p6ArVYYkQehUOaK6lF329WO+AhKWcKwn3Wt+kQvn/Fh2zggpN2MiajO9t+K/JE 0sgZTxtSpl8DIi+C7FJ60cqSVU50XrTlcH/v3QolOZr4z6B0iLK32e9/mUgssM5U 8Bg3xcsNKbqPQCyBtMl72aCarxCgapZgGSsxD3tGTV08IyWMyJijt8cAHhfTny/J qh7clBRYF8tpjVi46pHXLHuq4TKhDg7uMbFJ/ZHrm2iNLogMP2oRfUT5JQnQIuvf N/ZudEdo+x9uXWFlqr8gpNAeI+50tAVB4GjH83SM5E8fbZl6Gbe5lHNVrx9NjNzF j447ZT1zGITHD/RFbyy3DwZSQQ7XuA/workPV96yFbvwqlCr9znRkM4O000pASj9 tK1T+xrqYdjIYC2fYxE6IgB92+8fk6vNTrDQ7EzvEY6leNmnkx+xNDODoGlpj+DO SDg4AIs/avHmAb7semFAHbHMRm4sYq4/DE85zf4XVIJpCITu8f4lc2xA5KS1hk7B UpJe2uNtTiiyDy8zPZg= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E6307FCD73386587

http://decoder.re/E6307FCD73386587

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\StopUninstall.tiff => \??\c:\users\admin\pictures\StopUninstall.tiff.9438anusxz	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File renamed	C:\Users\Admin\Pictures\TraceSet.tif => \??\c:\users\admin\pictures\TraceSet.tif.9438anusxz	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File renamed	C:\Users\Admin\Pictures\UnregisterMerge.raw => \??\c:\users\admin\pictures\UnregisterMerge.raw.9438anusxz	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File renamed	C:\Users\Admin\Pictures\EnterExport.raw => \??\c:\users\admin\pictures\EnterExport.raw.9438anusxz	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File renamed	C:\Users\Admin\Pictures\ReadOptimize.raw => \??\c:\users\admin\pictures\ReadOptimize.raw.9438anusxz	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\users\admin\pictures\RequestAdd.tiff	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File renamed	C:\Users\Admin\Pictures\RequestAdd.tiff => \??\c:\users\admin\pictures\RequestAdd.tiff.9438anusxz	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\users\admin\pictures\StopUninstall.tiff	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

description	ioc	process
File opened (read-only)	\??\B:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\J:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\L:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\O:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\T:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\X:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\Y:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\A:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\F:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\I:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\M:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\R:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\V:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\K:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\N:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\P:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\U:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\Z:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\D:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\E:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\G:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\H:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\Q:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\S:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened (read-only)	\??\W:	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7a2.bmp"	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

Drops file in Program Files directory 20 IoCs

Processes:

6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

description	ioc	process
File opened for modification	\??\c:\program files\SkipStart.mp4v	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\AddSearch.jpg	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\PublishSubmit.cfg	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\RemoveEdit.DVR	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\ResumeDismount.ini	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\SearchShow.xml	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\ConvertToGrant.wm	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\InvokeCheckpoint.xltx	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\SelectMount.m3u	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\TraceMerge.dxf	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\CompressExpand.jpeg	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\UnlockWatch.aiff	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\UnprotectWrite.pdf	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\UseExport.htm	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\WatchOpen.css	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File created	\??\c:\program files\9438anusxz-readme.txt	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File created	\??\c:\program files (x86)\9438anusxz-readme.txt	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\ConfirmEnter.WTV	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\UndoNew.TTS	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
File opened for modification	\??\c:\program files\UnlockUnprotect.rm	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

pid	process
668	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
668	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
668	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
668	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	668	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
Token: SeTakeOwnershipPrivilege	668	6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
Token: SeBackupPrivilege	2752	vssvc.exe
Token: SeRestorePrivilege	2752	vssvc.exe
Token: SeAuditPrivilege	2752	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe
"C:\Users\Admin\AppData\Local\Temp\6ebf347c7866b9d347642585a5171930c0ce06f5f32654fa1b84876d74f82e4d.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668