sodinokibi | 7ac75d8d4390707428b148cf3cad23d804930141fd8ea53cf1a7790f7d1c3c88

General

Target

7ac75d8d4390707428b148cf3cad23d804930141fd8ea53cf1a7790f7d1c3c88.bin.sample.dll
Size

121KB
MD5

612f5b62182b5c3a8eb64ecaa2827462
SHA1

9d2bfcbaf44f9e59bbb451dce29e4c7ad6778808
SHA256

7ac75d8d4390707428b148cf3cad23d804930141fd8ea53cf1a7790f7d1c3c88
SHA512

9e001e766a6bb8505a15830b25268f958f79c6ed064b07b70af0165e3a2f967c3689581c012cdd7c3d631076172c2acc0fd1406fac809e835b149669db7a23a9

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\v035n67-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension v035n67. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/72B249B6BCE45579 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/72B249B6BCE45579 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: J4wBNp4y4MqZA5P7JaZJPyzL7pmIgQRlHICfADP+H+5PYY/8fM0hi+6bSvbL8mO3 5bJNfmQuU69jTvEVVX9MrpnEAx+QbujPEpXukw/X1iIceWhjb89sbxGvnS1Okt58 LbQL7M7AkILsBeomE1NLaunujrbHolQd+lloL7Evx3ae/rj28drCO5nb4N2DHP7X 2OZnvgM1fjZGxXaeQcnyANBm1j2k4O7eMUccgOtrW4IFcFGHx2U+Wcr8k9asOY9P R2Dr2dD01X7l0v47unZwJ/A6jTJ9ms0tg0j7UeLgjQQUBbIoKDMRSe8N9er3DFxB hNZn9NYPKTtSvDmUm1VpQAqLsM8gEc7S8/JWdXvyPAVvF21H++JfI60S+cn9M24z stFNggG1hFa8R3mSCXebglNG9h6vg1Zjn2WOts9cpeY3xkaWVASy0Zm5+Y/DZgkG XkkWeLvQyF5ibnsZnyWZU+JYfdVC4P/Xgcf1y9Y0YWE0saN5y1bIOxHroRZhvM+z GkzDvDxitUTVshgCLKHmq62r36iwzqMkQREb32Kp5nAj3/nWfYa2D1NBkQ9BT1YU rU2XjoZ0OKO4ERUBmr2ylYp3zDFElK/ya+wWbotfPlKN6jqj3ScGSKlsNJod1T1+ FSAy7HLxf4BpYvS8TDglX18rlS3xDZvuADkNJR6hk3BmeMoGT1tigDwH/fB9HION 2z5DPkzmjOyiVD97HSKT/5EO1eIznwv12gFSL2KnRbwrgrjG+XbUw3o6pLm1Cv2k H9KD61lN+hoAcbIJ7bztL8PMrvlNSyaWNh2/L/RtqMYRvuBhM8zU3ekf4cEV5HRA QYQ9cWTmqpaaroZc+wLPXaq8hQgGZzc9pKwHGl0qFrUph810KnjvdjcN443cDgUl KvIurVBNsxjhz0YIdhET7R4O5g4OqQNgiDKoqtC+agmWWJ9A27GgpJuGzN65Vl76 NyKfkrWjz5Mn8rLLDVJnyTzLro/OTzEnp3pE6Mxa2edlW8DADa7gs+b6+fwOI53y 22m4VCUlgRlY/P1i9qeKH+D7Bcr/1BOsXbqj4JLFWo7gJOuYrItGyKoQe7KKIzcA TDjvYA8WwmsFSA837U9z93wih8AVukcxVgvYFuroNH3sT+odz8+AsMgt/NrgK+zG zdwzjSEpGzDDaMGlD/5IJX7O6sC1pr6PZIV0woqmOzGurrpPa4PAYQLHl5aeSGgd nwtb4JlplKKYzRM14pvjWNhIhMl+VBRPbfKT3U1Evn91VgcSdjku439XzhpYrY7g FB9+pqwOcnk= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/72B249B6BCE45579

http://decoder.re/72B249B6BCE45579

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 16 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\OpenProtect.tiff => \??\c:\users\admin\pictures\OpenProtect.tiff.v035n67	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RegisterSplit.png => \??\c:\users\admin\pictures\RegisterSplit.png.v035n67	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\UseDebug.crw => \??\c:\users\admin\pictures\UseDebug.crw.v035n67	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\WatchUninstall.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\WatchUninstall.tiff => \??\c:\users\admin\pictures\WatchUninstall.tiff.v035n67	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\EditSet.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\EditSet.tiff => \??\c:\users\admin\pictures\EditSet.tiff.v035n67	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\InstallCompress.png => \??\c:\users\admin\pictures\InstallCompress.png.v035n67	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\OpenProtect.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\EnterComplete.tiff => \??\c:\users\admin\pictures\EnterComplete.tiff.v035n67	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\GetSubmit.crw => \??\c:\users\admin\pictures\GetSubmit.crw.v035n67	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\OpenResume.png => \??\c:\users\admin\pictures\OpenResume.png.v035n67	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\AssertStop.raw => \??\c:\users\admin\pictures\AssertStop.raw.v035n67	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\DisableEnable.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\DisableEnable.tiff => \??\c:\users\admin\pictures\DisableEnable.tiff.v035n67	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\EnterComplete.tiff	regsvr32.exe

Drops startup file 1 IoCs

Processes:

regsvr32.exe

description ioc process

File created \??\c:\users\admin\appdata\roaming\microsoft\word\startup\v035n67-readme.txt regsvr32.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\v035n67-readme.txt	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c5ck713h6l.bmp"	regsvr32.exe

Drops file in Program Files directory 20 IoCs

Processes:

regsvr32.exe

description	ioc	process
File created	\??\c:\program files (x86)\v035n67-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\ConnectStep.xlt	regsvr32.exe
File opened for modification	\??\c:\program files\ResumeStop.dib	regsvr32.exe
File opened for modification	\??\c:\program files\BackupUnblock.ttc	regsvr32.exe
File opened for modification	\??\c:\program files\ConnectInitialize.jfif	regsvr32.exe
File opened for modification	\??\c:\program files\DismountSet.dib	regsvr32.exe
File opened for modification	\??\c:\program files\GroupAssert.iso	regsvr32.exe
File opened for modification	\??\c:\program files\SwitchSplit.wmv	regsvr32.exe
File opened for modification	\??\c:\program files\UnlockBackup.xht	regsvr32.exe
File created	\??\c:\program files\v035n67-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\DisableCopy.3gp2	regsvr32.exe
File opened for modification	\??\c:\program files\GrantMove.jfif	regsvr32.exe
File opened for modification	\??\c:\program files\PushBackup.3g2	regsvr32.exe
File opened for modification	\??\c:\program files\RegisterSearch.7z	regsvr32.exe
File opened for modification	\??\c:\program files\SendRemove.cfg	regsvr32.exe
File opened for modification	\??\c:\program files\FormatTest.DVR-MS	regsvr32.exe
File opened for modification	\??\c:\program files\MountWrite.emf	regsvr32.exe
File opened for modification	\??\c:\program files\SearchStart.001	regsvr32.exe
File opened for modification	\??\c:\program files\UnlockGroup.mov	regsvr32.exe
File opened for modification	\??\c:\program files\UseExpand.cr2	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

regsvr32.exe

pid	process
1916	regsvr32.exe
1916	regsvr32.exe
1916	regsvr32.exe
1916	regsvr32.exe
1916	regsvr32.exe
1916	regsvr32.exe
1916	regsvr32.exe
1916	regsvr32.exe
1916	regsvr32.exe
1916	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1916	regsvr32.exe
Token: SeTakeOwnershipPrivilege	1916	regsvr32.exe
Token: SeBackupPrivilege	204	vssvc.exe
Token: SeRestorePrivilege	204	vssvc.exe
Token: SeAuditPrivilege	204	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 604 wrote to memory of 1916	604	regsvr32.exe	regsvr32.exe
PID 604 wrote to memory of 1916	604	regsvr32.exe	regsvr32.exe
PID 604 wrote to memory of 1916	604	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ac75d8d4390707428b148cf3cad23d804930141fd8ea53cf1a7790f7d1c3c88.bin.sample.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\7ac75d8d4390707428b148cf3cad23d804930141fd8ea53cf1a7790f7d1c3c88.bin.sample.dll
2⤵
- Modifies extensions of user files
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916