sodinokibi | 2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507

General

Target

2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
Size

161KB
MD5

d599cfe7691e8499941d7e4f0d51616c
SHA1

843070b5c802a5dbc9afbbdf03ee1153f3249165
SHA256

2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507
SHA512

f04a3e88dc69641e0682d6e74a7ac75f80e06924f3d25987e74674d9dabac040a70164cfa241078954274cb164c45bccdba3d06cd026934f66a12460a3add2e6

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\xn6cj-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion xn6cj. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/85EB5461AB1897A2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/85EB5461AB1897A2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hInvpQGM69bPbJf1aFqVcAnKNpAzIYSwydo+wpy0SR8N9trD9HCc752i77iNrCec UT4fKAvHuSroWU8cXLhlo7ahBeNgrq708BzutSphVxMx8kv3ASuJ6vmtUyMK7LEl ljjHOxx2ANh0o81PsiTTJ9TDL7TKVxfTf273d/k/nzQRjOXc+1mXTp8EDl+lh3ga jB1Qhdam7tICU6fiwvzi3DR98chrAXi2t3nFGqoby9qi5Cqu1XbWJ6CXMC2ZmLeK FyHWu8GBEEmoEVBIsQfzevA0cFu8+vN27Kjy2AI1tZvLt32Mavw4xwtxW+plv/fH nXtyjYYuk+YcbvwH1RFGxDmQOBvhXTrt1nl/fT47Ad+/gl3VE9jpSIMvIpf4RQf6 VmF40Uq4bJmf9wgOi0TGWzBWuHYRi6RSiI2QclliDkaitY/mhk9Yz0Rbazq53Rsq sd9Ng6SnFzJTjMR4jXV0J6TVQ2xjtOQA93nNnKV5YNizpjq9L1xoit4tpTP2dAnv Vg0snRqgeuAv7a2sODKNSaSQk1f1H/1MDgZeuHeVN6qbJGVisfONOVryZmywJvlT YJXeov/pHTIUQJaMo3N6ktJApGCF1JLrhZklK2jQeOl9U9WYEern/OUiYcTKDwO/ ddhIrKg6pv6wDERDa7/qDBXI3PqZo4IyiXcZDR90mIgwOvpQcUhuqK9IpZnCX6Be LZnnLCA8tSYFqr1fu/clzzh7+703NsiKpDtMDhj1eQuBUitB93qVt3b4JnNGY69J Rb3FPTF9A4PIj7kdR5qCRodZhV5asiXr8QPkgpQhCJi9psJa4gUrUWUNAPKTcAlE 3pitRt/0AnHIhIoUwmgdOSQ29h9i9srhqCThYmcmJ3uf4tWhn21whJJE+2JTyR1U 5yTVvAeZDRPSW9xRYuDQyx4U+uZW6252eJKUiK+Ri8T5GkoI7FE2VfhVQGiC7MKi /GEWfber2S5+585F6T33CvRyiWbGgEyKC1fHiifQG514W55djK0T8C3Jg6qFHMGX 6Nr87UWc2r5XzY7IkjGgSSSTeoqGHGK987r6oNPTgQLBWk1tdcAn9Ff/B6/EzvQj rfRZY+zboXf2UUz+ZXt9tTuqnFCdtPV5wlCLPP9klg3lMse0RviHdhcFHY96XKni zw0Ff2sH Extension name: xn6cj ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/85EB5461AB1897A2

http://decryptor.top/85EB5461AB1897A2

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe

description	ioc	process
File opened (read-only)	\??\F:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\P:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\J:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\L:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\M:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\Q:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\V:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\Y:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\G:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\I:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\Z:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\N:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\O:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\T:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\U:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\B:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\E:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\K:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\R:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\S:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\W:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\X:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\A:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened (read-only)	\??\H:	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe

Drops file in Program Files directory 17 IoCs

Processes:

2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe

description	ioc	process
File opened for modification	\??\c:\program files\RestoreRepair.vbe	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File created	\??\c:\program files\xn6cj-readme.txt	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File created	\??\c:\program files (x86)\xn6cj-readme.txt	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File created	\??\c:\program files (x86)\5c4c3ad0.lock	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\ConnectUnblock.odp	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\PopEnable.mp4v	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\RegisterUnregister.xltm	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\RepairConvertFrom.shtml	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\GetComplete.mpeg3	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\MountSync.jpeg	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\ResolveSend.wdp	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\UpdateRequest.search-ms	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File created	\??\c:\program files\5c4c3ad0.lock	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\GroupMerge.mhtml	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\UnpublishCopy.dot	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\GrantInstall.wax	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
File opened for modification	\??\c:\program files\RestartCompare.m1v	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1704 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe

pid process

1944 2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe

pid	process
1704	vssadmin.exe

pid	process
1944	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.execmd.exe

description	pid	process	target process
PID 1944 wrote to memory of 1684	1944	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe	cmd.exe
PID 1944 wrote to memory of 1684	1944	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe	cmd.exe
PID 1944 wrote to memory of 1684	1944	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe	cmd.exe
PID 1944 wrote to memory of 1684	1944	2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe	cmd.exe
PID 1684 wrote to memory of 1704	1684	cmd.exe	vssadmin.exe
PID 1684 wrote to memory of 1704	1684	cmd.exe	vssadmin.exe
PID 1684 wrote to memory of 1704	1684	cmd.exe	vssadmin.exe
PID 1684 wrote to memory of 1704	1684	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
2⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:1704

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-61-0x0000000000000000-mapping.dmp

Download
memory/1704-62-0x0000000000000000-mapping.dmp

Download
memory/1944-60-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads