sodinokibi | adcd8610415d62e2e886bad0fae495861023ad457a0fcbab77d2345d571b190f

General

Target

3c4063956b797106cc43a49a634bb530aecd6e9a898124bb8fed6978f4556ee0.dll
Size

119KB
MD5

91e06d83a0ea2e73f8143f9d70c2b8b1
SHA1

7ff7ce00ddb41170fe4b86858ae7bf4b9957ff0c
SHA256

3c4063956b797106cc43a49a634bb530aecd6e9a898124bb8fed6978f4556ee0
SHA512

48e60e0da5a730837c1845552db012578c91655ae5234a27093408a83c25b2b4aee9b7c710a4484d591bdaaae838634aad02b8f35f656cdfb8ada5721cbada47

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\l364kn6w8-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension l364kn6w8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We downloaded more then 515 GB sensitive data from your file servers, including internal company data and clients files and documents. We are ready to publish all data if you do not contact us! [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2A6F89CAECC9B2C7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/2A6F89CAECC9B2C7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: jfsNdZ1FML6j6pfnspS10lfidPvS26SV6dq34tEfg5Pz3fKEptNys/H2saZCt5kv s43VOj/wv3chmj9jSZ27Oq9qdK3z+PU65GG2eH/RBFtUB9wxenN/ZVN7jkh5s0DV nE8z9FAgyOE0OZ3kX6oSEON7zIi/eTgQTINPaORJMOmsl8y7NsXMQuWMjNdD1AOf Fa0cFQ/zBAxxll66SFDX3ZpWVZc+DJDl3zOLazSweb9FYNzZR9DFMEJ9J9xo1FHm 5mh1rLEqMOj7tfQ8oZr3tAkNw4vubSx49ktnZqqgyikNMySPFFHMRCDmQwSl0Znx RIlIsNAI0YohdXyodE9c2fXQkpReMq3LAar/EABuAdMGp0Ay002B4Tzi+Tg2jxTn 5ML0j2Pydaq7aNUhqyzqMttkEornxNfTgJB7Y3gHKw2aeQIhyFPJGvswSxSULcVv T8KZUOG20RBTDfQrM3dEfJ6ymQqh+5fvAiOVsF/oV6C/efkUhgUTnjFo7LuME1M1 l0wekYb8UQLOFhYJTzdGSBc7Lnz1WFgMQ6Ghsv1ZY0TY4SsmrJGfkWXgac96z+5K k/STdmZBuwHEZXI6a94cgQEC2rKKJ32igyI+9ioTkmVoWYtDqNTHfNE54ENVuedm srem6yaINWnp1c+AS0Q6ZDgwYJjqLbDIz76U8Q2Tj8XjOf8Y8ejgI5GYBBGrdO93 zuvYSX6J9lJD0WAh3SOfk8aPkj9cfRAgHsovsikAIkxUL+1oItiWsQixnlawI34m QcIopVXPePgVGKSdKEEK+/bd6pRXsv2mGAfyuc4ghG4HVwAbybQfVE1BXxADw6rO 3T55A5ck2MAJFLHMa6AEJ+4PnHQsqBhs/CcyPnuzh9gB9hT/blkrh5vPFB5rH2Y9 f24ZO0fxwL3sUOKRnrpEUSwUMDkxKmiX1UNUVaKI8HkUDhWDi0SqsNX8VN9gpysT kfD5ShNSeEZZ729Hn2gPJVhkJz9fSh5pDXBaLusEG3BnuT3Av7uxzh/DUbJmXYIZ GBzMFQIKGtn9quCzIC9czdfe1odEz6Qg4SRYELURSsRaqSh82bLYKPqmKjo2vqdh 3BtlojiuqAt+qvUnmFHGvrGQL+v4h1GwsDAC3enh+IBEp0eXFtJk6vQg/OUdCsSK UufGNxbnmAOtb6VexpjfFDIVEj4hJ22RAyCB3+1XLfmd37NShaXeeU3X1CwJH4Bq FVO3TvHViH3T9KfBQllLtSfClTOmqodAykZ5rvgouNwPj5k0AO+TEBt56loX0It2 Q7xEsCSdZRaebsmp ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2A6F89CAECC9B2C7

http://decoder.re/2A6F89CAECC9B2C7

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ahk657.bmp"	regsvr32.exe

Drops file in Program Files directory 33 IoCs

Processes:

regsvr32.exe

description	ioc	process
File opened for modification	\??\c:\program files\ExportClear.potm	regsvr32.exe
File opened for modification	\??\c:\program files\GetResolve.svg	regsvr32.exe
File opened for modification	\??\c:\program files\RegisterJoin.jpg	regsvr32.exe
File opened for modification	\??\c:\program files\RenameConvertTo.htm	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertFromMerge.wdp	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertToWait.m3u	regsvr32.exe
File opened for modification	\??\c:\program files\DisableHide.aiff	regsvr32.exe
File opened for modification	\??\c:\program files\InitializeCompress.jpe	regsvr32.exe
File opened for modification	\??\c:\program files\LockUnpublish.vstx	regsvr32.exe
File opened for modification	\??\c:\program files\BlockFormat.dib	regsvr32.exe
File opened for modification	\??\c:\program files\RestoreMove.vdx	regsvr32.exe
File opened for modification	\??\c:\program files\ExpandPush.ex_	regsvr32.exe
File opened for modification	\??\c:\program files\GetHide.jpg	regsvr32.exe
File opened for modification	\??\c:\program files\RestoreGrant.cr2	regsvr32.exe
File opened for modification	\??\c:\program files\ResumeShow.wm	regsvr32.exe
File opened for modification	\??\c:\program files\RevokeSync.shtml	regsvr32.exe
File opened for modification	\??\c:\program files\UnlockGet.wmv	regsvr32.exe
File created	\??\c:\program files (x86)\l364kn6w8-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\EnterResize.htm	regsvr32.exe
File opened for modification	\??\c:\program files\UseInitialize.3gp2	regsvr32.exe
File opened for modification	\??\c:\program files\UndoUnregister.jpg	regsvr32.exe
File opened for modification	\??\c:\program files\UnprotectSplit.png	regsvr32.exe
File opened for modification	\??\c:\program files\CheckpointAdd.ps1xml	regsvr32.exe
File opened for modification	\??\c:\program files\CompressMeasure.eprtx	regsvr32.exe
File opened for modification	\??\c:\program files\CompressStop.vsd	regsvr32.exe
File opened for modification	\??\c:\program files\LockFormat.dotm	regsvr32.exe
File opened for modification	\??\c:\program files\NewDisable.rle	regsvr32.exe
File opened for modification	\??\c:\program files\OutEdit.vdx	regsvr32.exe
File created	\??\c:\program files\l364kn6w8-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\MountImport.pub	regsvr32.exe
File opened for modification	\??\c:\program files\OpenUpdate.ex_	regsvr32.exe
File opened for modification	\??\c:\program files\ShowSearch.potx	regsvr32.exe
File opened for modification	\??\c:\program files\WatchPing.dwfx	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

1828 regsvr32.exe
1828 regsvr32.exe
1828 regsvr32.exe
1828 regsvr32.exe

pid	process
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1828	regsvr32.exe
Token: SeTakeOwnershipPrivilege	1828	regsvr32.exe
Token: SeBackupPrivilege	3604	vssvc.exe
Token: SeRestorePrivilege	3604	vssvc.exe
Token: SeAuditPrivilege	3604	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 512 wrote to memory of 1828	512	regsvr32.exe	regsvr32.exe
PID 512 wrote to memory of 1828	512	regsvr32.exe	regsvr32.exe
PID 512 wrote to memory of 1828	512	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3c4063956b797106cc43a49a634bb530aecd6e9a898124bb8fed6978f4556ee0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:512

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3c4063956b797106cc43a49a634bb530aecd6e9a898124bb8fed6978f4556ee0.dll
2⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828