sodinokibi | 6de45c62ce1024829017e4e46177ee4df4b79f296c519bba0755963aecc92f79

General

Target

6de45c62ce1024829017e4e46177ee4df4b79f296c519bba0755963aecc92f79.bin.sample.dll
Size

122KB
MD5

3bd469353983cd9ae85eae534a84a668
SHA1

e0556ea1335207f0bf0a12a8b947d9c04ef69d52
SHA256

6de45c62ce1024829017e4e46177ee4df4b79f296c519bba0755963aecc92f79
SHA512

0d5ebd7edead562fefeaad840ef1fe421adfe2e4dc2123637cad75226571f253c333c5991ce8935c144b3f0e89a7b60839a62cc9823ddea1491ee4c4d8fe2184

Score

10^/10

sodinokibi evasion ransomware

Malware Config

Extracted

Path

C:\d62705-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d62705. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/508996C823A90E2C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/508996C823A90E2C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: uuvbg5HuKOYGfy7sujEsmeFHILyR6e0MzhsXIYwpL7RPlCO8llqdMc8FS+e2bMkd SY4tBN65E4Y6knJpL/FvKtZD5G2EfszcEo9jGKa0KCmeddEXctPJOBMPxY0yS7te s5dhms2YmUorjtNDP/ajm58sZKYipEegugo7rdJjhKbWNdvkRay+R5WJTCGR81HK 2Vv3u4ZeK1JYBI7PCc2zW6LZEGyfwTA9ey0dJJ7cJIgj0LtdO4GKa1TGcm6gHfeS u2nYmiQ2cFFuxNvgoup77mKaKuZD32YA6/3CAlchkevm7zomMF9ucOQBvCsrxIE5 33BdCvPSPR2aXp6ue+F/nsmYOGhj3sMxTc90QzCypBJyKG4m+YvFWQN+s4aSkoCr kBY8dcqIIIykGaxWvnfnPHjJNtIWzu3quiSmagIJLJ5YtTi92ClIxntUulP26iB6 Rzxg9qh+M06wjeImUUOPkRrMSb5YiwVNug7mQ/2UNzkVC5X9WLoqjQnBW3Mf9LGn xrazWAzPpaXx0qoEbP+DSCd0EbS6BRtULtrZjBK5XsSwn6MR7LWpKi7zNz64sCRJ cxPPbbnRF87+8mF4XatI+utAqM9HD3oTrzJjrBVtToJr0iAc6cxGJMMkW0aD0FKl 6TS3CkntmDGoUyGHCmEXiF6ttE1V+PMzD+W5Ft1F9nBDLyE9jjMeF7La6gxpNowe OXvoHs86F2gi1hjbvlFUW1o9VGFrihoCVc/D2zTCMonWXPoAj72dT67FNY76Lqf5 rS4RAdh8WcGfdz3psw8xzL4+KqPNP/u47tb5dqFh9U75LlZ/6Dx41zjJ7SXwuQgk wDGi4nz4LhJOZdBd9r8Z6suWNr8mpIaqRp+1YtNToWpo4wy7/MhxUHC0rOJVC0Ff r6x1D1+CggeHY1ZtYqfM4nHlnNuXOfgxlUkVYtHNXX5sJN7p4/1aPOdD2afWJjU6 REDKkxbcQFeDLh0YE+D8dwTiy4AX03xfrWFRRhtBe6/DtVw67g1Hr7/sxjx/Wpo5 W6pY1YpLz58qpB10Q7r7zvSlq2wxpjqLMOrviJpSexgCF47fjro1vTG10CXmSrd8 oP/1Qrw7Tfg4dR32XOhzC3sSMle0FsD2QcHZhrB7IcvoTdyH3RdaltwdjHOwiuXP 18qX1egIG0diNBPB8zU15jAp4X7oMhnnfhNAaDK2is7DjiKE7EwMiYMJsP9ssWXP MXFzzRzvRXGouO+J3bpC+URV8VtGp7gSebSKBRZCMmXEAJYnObFrAjAJS1XFUobg iWJ8mvQb ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/508996C823A90E2C

http://decoder.re/508996C823A90E2C

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\BackupStop.raw => \??\c:\users\admin\pictures\BackupStop.raw.d62705	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\SelectMeasure.crw => \??\c:\users\admin\pictures\SelectMeasure.crw.d62705	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8vvq8ayr832.bmp"	regsvr32.exe

Drops file in Program Files directory 33 IoCs

Processes:

regsvr32.exe

description	ioc	process
File created	\??\c:\program files\tmp	regsvr32.exe
File opened for modification	\??\c:\program files\BlockCompress.cfg	regsvr32.exe
File opened for modification	\??\c:\program files\ClearFind.pcx	regsvr32.exe
File opened for modification	\??\c:\program files\JoinStart.jpeg	regsvr32.exe
File opened for modification	\??\c:\program files\RegisterStart.mht	regsvr32.exe
File created	\??\c:\program files\d62705-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\RenameSend.wps	regsvr32.exe
File opened for modification	\??\c:\program files\MeasureBlock.7z	regsvr32.exe
File opened for modification	\??\c:\program files\ResolveDismount.mpv2	regsvr32.exe
File opened for modification	\??\c:\program files\EnableUninstall.aifc	regsvr32.exe
File opened for modification	\??\c:\program files\ExitInitialize.wma	regsvr32.exe
File opened for modification	\??\c:\program files\ReceiveUnregister.contact	regsvr32.exe
File opened for modification	\??\c:\program files\RenameClear.mp4v	regsvr32.exe
File opened for modification	\??\c:\program files\GetComplete.3g2	regsvr32.exe
File opened for modification	\??\c:\program files\RemoveExpand.css	regsvr32.exe
File created	\??\c:\program files (x86)\tmp	regsvr32.exe
File created	\??\c:\program files (x86)\d62705-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\CheckpointInstall.WTV	regsvr32.exe
File opened for modification	\??\c:\program files\CompressNew.pptx	regsvr32.exe
File opened for modification	\??\c:\program files\DebugUnblock.TTS	regsvr32.exe
File opened for modification	\??\c:\program files\FormatConvertTo.AAC	regsvr32.exe
File opened for modification	\??\c:\program files\SubmitOpen.shtml	regsvr32.exe
File opened for modification	\??\c:\program files\TestSend.M2V	regsvr32.exe
File opened for modification	\??\c:\program files\UnregisterRestore.asx	regsvr32.exe
File opened for modification	\??\c:\program files\ProtectRequest.TTS	regsvr32.exe
File opened for modification	\??\c:\program files\SyncInstall.mhtml	regsvr32.exe
File opened for modification	\??\c:\program files\SuspendRename.mpp	regsvr32.exe
File opened for modification	\??\c:\program files\AddRestart.vdx	regsvr32.exe
File opened for modification	\??\c:\program files\CloseUnblock.odt	regsvr32.exe
File opened for modification	\??\c:\program files\ImportShow.DVR	regsvr32.exe
File opened for modification	\??\c:\program files\InitializeSet.jtx	regsvr32.exe
File opened for modification	\??\c:\program files\PopResolve.tif	regsvr32.exe
File opened for modification	\??\c:\program files\SetLock.pub	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

regsvr32.exe

pid	process
2888	regsvr32.exe
2888	regsvr32.exe
2888	regsvr32.exe
2888	regsvr32.exe
2888	regsvr32.exe
2888	regsvr32.exe
2888	regsvr32.exe
2888	regsvr32.exe
2888	regsvr32.exe
2888	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2888	regsvr32.exe
Token: SeTakeOwnershipPrivilege	2888	regsvr32.exe
Token: SeBackupPrivilege	2248	vssvc.exe
Token: SeRestorePrivilege	2248	vssvc.exe
Token: SeAuditPrivilege	2248	vssvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3700 wrote to memory of 2888	3700	regsvr32.exe	regsvr32.exe
PID 3700 wrote to memory of 2888	3700	regsvr32.exe	regsvr32.exe
PID 3700 wrote to memory of 2888	3700	regsvr32.exe	regsvr32.exe
PID 2888 wrote to memory of 2200	2888	regsvr32.exe	netsh.exe
PID 2888 wrote to memory of 2200	2888	regsvr32.exe	netsh.exe
PID 2888 wrote to memory of 2200	2888	regsvr32.exe	netsh.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6de45c62ce1024829017e4e46177ee4df4b79f296c519bba0755963aecc92f79.bin.sample.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\6de45c62ce1024829017e4e46177ee4df4b79f296c519bba0755963aecc92f79.bin.sample.dll
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888