sodinokibi | a494525da7014eb1fd267a1a47cd4ed6c5e3b290042eb34c8b49f0346a45e6e6

General

Target

a494525da7014eb1fd267a1a47cd4ed6c5e3b290042eb34c8b49f0346a45e6e6.bin.sample.dll
Size

121KB
MD5

b169ce72bc3f9f0838713d53ab08e9da
SHA1

268fd636b359f9ff425ebc7a591fafda6d7f93a8
SHA256

a494525da7014eb1fd267a1a47cd4ed6c5e3b290042eb34c8b49f0346a45e6e6
SHA512

12830464d6744130e69185d55a57187b7c1b3b42ca701069f5e2c3a27d90009f8ff4972d323243cf78009cc8ad0d6d3995577a0fbbb0fc05bb3cf80ee8cd7567

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\98600-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 98600. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We download your data! trailappliances.com - More then 320 GB of sensitive data. Included: Accounting HR General Payroll CONTRACT INFO Drivers License Abstract Financial Statements [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/110E8423B6333937 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/110E8423B6333937 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: b9fSw8PYlTot+eppll9u15dbS8VJBVb7DxrZFuTsWokUJtKIun9HB+g+ydg5OpD0 l+19P42706dZw0lVpDprGPcJM04n6dSEGqzsYixWjfGUvHHbibhkDDW3G/QSrtZ2 MIvru7OI9VkWCHCtO0RgcTRBXCecEaveB2HBin9w0P3NBYldVj00uzbSXx6rM5D4 NM60bEmKcBG4qdrGkoNGEK5RuqmcVTLvrupqFi3//oH5d9g3wb3wFRGWzUK8qk4i UdD0KM23iFLk08vsOeCoCgXPHTqMvp8dBN4Idhzev9HIY+h2MFRg+bM82dfSw4xX futDB+uIoybS2FrgMsE2Te63hn1G2ApmqgI4LNDyadYo4zXjGTskDYBzaY912t9c wBeh8HXehwGePtJ3ER9Uomi5DlXwof+IjbHjTvHWWSNfzpd1bPYkDWzM4RaLm9fX 2+23VGkrZK74NJ1niWaZ7fpDHIZhzZFhUS0QCqy/secELOjqzBePAXjsAqK8H4rI JirKmAYp5LAUsoCdyrzyZ0gJKKFOQeE6ZbnTPEcMJF66hfu357ssUmxU8e92nVGp nWiTQnaLLx2cs7Exf4qDrG/G1mSuG2QBipK9tCI0foCbYxEdpu+aezs9y8DGHWML PWUOn+84n3DSN7qH0L4CPNmcVwaPemiBa6vr1zkDPpfjolar4XyHAVlPq9oHIYsB QzmstmzuP5guRo7r4dDNMYZxMfYk2u4KsqNpBZGWUXXYN2i5nMaSXrcvWHK3cTXZ 5kIoF5PyxHaRMiwI9fkb65q8oHwmXQ2QYrgqiv0qZMqJ6egRQeHkXdWepIRUp0V8 u4xTNqVXrgd515a3MTLCRD0MQhfeT0ADuCcIt2vrziNX/WvJGdvpMoWmeqgW08Gr E9CDHBGR1Xndvpl2Hqp69s9G5bM5/NAG6qHEI9qAkuRg3GImHGa6vuByUo1ciG0z bLdORlOj6IxFzZHARZRZTRyAspmZXFUtTIvRLSS4ddCh1evvUpoAEw8iki7tKVbK HypU2dB/T6X6FTpj9b8iEmvxmCKXcqxQm1tWsB88vuuyXFchbCMIMT1FPdkFA+Ec 9K8fgbSVgnIUYleSd6du0h8owr1lrsuvdy5GlBjUfa7+ebRm7doOBOzWJ/yqCIWc QAlOvyD63vm2E3virh8LIuTvlQWBZr+3ty+egZo1chNn1E5gmM7cr3/lDujGF+rI DQuWXyPH8v2EmBH6ZwmalKLWvPxjE7djMULOCNbiGAkrEQeQFTGU+1fSZi2+mKUg BXs2Zw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/110E8423B6333937

http://decoder.re/110E8423B6333937

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\OptimizeUse.tiff => \??\c:\users\admin\pictures\OptimizeUse.tiff.98600	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\StepSet.raw => \??\c:\users\admin\pictures\StepSet.raw.98600	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\UnpublishInstall.png => \??\c:\users\admin\pictures\UnpublishInstall.png.98600	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\WaitProtect.crw => \??\c:\users\admin\pictures\WaitProtect.crw.98600	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromGroup.raw => \??\c:\users\admin\pictures\ConvertFromGroup.raw.98600	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\NewMount.raw => \??\c:\users\admin\pictures\NewMount.raw.98600	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\OptimizeUse.tiff	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ilbxy64yg2734.bmp"	regsvr32.exe

Drops file in Program Files directory 31 IoCs

Processes:

regsvr32.exe

description	ioc	process
File created	\??\c:\program files\98600-readme.txt	regsvr32.exe
File created	\??\c:\program files (x86)\98600-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\LimitSearch.xml	regsvr32.exe
File opened for modification	\??\c:\program files\RevokeOut.css	regsvr32.exe
File opened for modification	\??\c:\program files\WaitUnlock.zip	regsvr32.exe
File opened for modification	\??\c:\program files\AssertCheckpoint.MTS	regsvr32.exe
File opened for modification	\??\c:\program files\AssertLock.vsx	regsvr32.exe
File opened for modification	\??\c:\program files\GrantSubmit.wmv	regsvr32.exe
File opened for modification	\??\c:\program files\PingDismount.tiff	regsvr32.exe
File opened for modification	\??\c:\program files\ProtectInvoke.htm	regsvr32.exe
File opened for modification	\??\c:\program files\InstallRemove.xla	regsvr32.exe
File opened for modification	\??\c:\program files\ClearLock.mht	regsvr32.exe
File opened for modification	\??\c:\program files\CopyCheckpoint.TTS	regsvr32.exe
File opened for modification	\??\c:\program files\RedoUnprotect.png	regsvr32.exe
File opened for modification	\??\c:\program files\ResizeSubmit.fon	regsvr32.exe
File opened for modification	\??\c:\program files\UnregisterStep.pcx	regsvr32.exe
File opened for modification	\??\c:\program files\RestartUpdate.html	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertToOut.potx	regsvr32.exe
File opened for modification	\??\c:\program files\DisconnectComplete.scf	regsvr32.exe
File opened for modification	\??\c:\program files\InvokeMerge.mp4	regsvr32.exe
File opened for modification	\??\c:\program files\SubmitConvert.clr	regsvr32.exe
File opened for modification	\??\c:\program files\DenyShow.tif	regsvr32.exe
File opened for modification	\??\c:\program files\DismountRepair.asf	regsvr32.exe
File opened for modification	\??\c:\program files\HideMove.midi	regsvr32.exe
File opened for modification	\??\c:\program files\SubmitSync.mhtml	regsvr32.exe
File opened for modification	\??\c:\program files\UseUpdate.svgz	regsvr32.exe
File opened for modification	\??\c:\program files\CopyInvoke.xls	regsvr32.exe
File opened for modification	\??\c:\program files\LockShow.M2V	regsvr32.exe
File opened for modification	\??\c:\program files\MergeJoin.html	regsvr32.exe
File opened for modification	\??\c:\program files\ResolveTrace.jtx	regsvr32.exe
File opened for modification	\??\c:\program files\SearchRemove.avi	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

regsvr32.exe

pid	process
1068	regsvr32.exe
1068	regsvr32.exe
1068	regsvr32.exe
1068	regsvr32.exe
1068	regsvr32.exe
1068	regsvr32.exe
1068	regsvr32.exe
1068	regsvr32.exe
1068	regsvr32.exe
1068	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1068	regsvr32.exe
Token: SeTakeOwnershipPrivilege	1068	regsvr32.exe
Token: SeBackupPrivilege	1512	vssvc.exe
Token: SeRestorePrivilege	1512	vssvc.exe
Token: SeAuditPrivilege	1512	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2208 wrote to memory of 1068	2208	regsvr32.exe	regsvr32.exe
PID 2208 wrote to memory of 1068	2208	regsvr32.exe	regsvr32.exe
PID 2208 wrote to memory of 1068	2208	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a494525da7014eb1fd267a1a47cd4ed6c5e3b290042eb34c8b49f0346a45e6e6.bin.sample.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a494525da7014eb1fd267a1a47cd4ed6c5e3b290042eb34c8b49f0346a45e6e6.bin.sample.dll
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068