sodinokibi | 9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992

General

Target

9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
Size

122KB
MD5

201cc0e5afe6984f23ff5b36964588ae
SHA1

0d7d093a29470e40a6c15aa75cd7607fff480cb6
SHA256

9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992
SHA512

fbb9f80f58f7c1fef8807da4a6e5c40aae75def7e8d2cd3b82f8283def4621d148b4993ff736d40cac7978857e1c80716f447aee2622d6383acbba4563d4079e

Score

10^/10

sodinokibi evasion persistence ransomware

Malware Config

Extracted

Path

C:\vr855d-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension vr855d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/521B3AE3FFDF38EF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/521B3AE3FFDF38EF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LA6z8oQ+GSIr0NwHRDFLACG8brWooZoXz+ry5GNGY3LP78N/KIgmL15gaZfACG7k HEw9K6+XAhETQ3b8bOOgYUw+noWXzuVYMrQUiQkVIxRQKRT0m3AIOFStcQz3t8g8 t7qOWb+1JCThB2rFsTwm6jMfBCBrVz1XWqbUtzQ11Pj/rPXFikUvFS05JTsWax+5 UEQL9tqMfJHSl0p8943BuIwZWPEfum6LiyW8/xcK0kpmIUUcSwIjqQC76N8xdXJk jlbOQD2IQijAYIynr6O8ZWxZT/X0/K5inFxHIGOafVEjaUFr3PYJuuqOxUPTaPUR O7DxvNzyTPv8z7AQavcOlZpDo7bRDOcL8jhSuWfTjLwMdo7+hFpLXmm7CphCHfIU YyIbUXtIqgJtvotaSAlqTVuiYSU0DdTxwy8ttG6xhp7TWI9bc0K3Px5aDPV/i9y6 8AnQ2rF889EyVHbeDKyvUdxHWAebCmQ1In+J5eZ91OuXzGMl5h33/1eWjx5OpWLT xDt37MAhwCMSFktjTOF2ih2v+v57DQVXPccBGnRfCgYUSfjY5+H4N8+4JVhuRwoi GVC2OOZgipxOMiZQRsYzPE2CLiRQ2uK8n3+At56MFBhbJF/RKTDnoDabLV0L1gsY 7IKoyW+twnbEg2n7HZETcdPx4GqzI4A58g9T3dskYDkbVCDngmY7QIsDdy3szc9n 321Hk0YE6J6vothqEbe5/HRlTnP2Oegc5PwlRiXyC2YBKwZS2zouUroBbVlh1BRG bZEApOpXVMD6gri7n7OsvCzguZWY+HSh0kr+wXEeaWLr6W+A585l8Jr8H5DLeNS0 XruhFZr/bf6BROhqeuSn9TRqabfKn8CeAXnrtDLe0a0lomc8HAOQvITa2714ofbk CyKywSyIltV66o2GhtPke7S0+4xZgEk5qT7Bn48wzdYrvkHLt1KHwOwLYjonFhQV /raHXnNwLA2d/h5tso9C2IKgI3VaUUfnk4fvFYbdqET+TnpJdXmiWrHRyNiZ7AKs Pn7qUrkJ/uXemQHIX2MUd/1RdbbC+FJpLUJwHwdb6A6r4q/8IBvn9qsd+ZviKQbO vi0jg1d/jcd0KNbrgHPjHK28mNxkPbV/ddM02EVgWS1yAuf8MWMdeiYwWC+dFUKz QQ79YxrrxG/V431LRd6bVLgVewcX+GdHfVKu657yGHFWTgo9y2j56CLpO+qSTuNQ SR4gNuLM7euffguRqRRxJMUAZqn0NF19jzxK4le+4uxEFcq1PS/2qd2kSaF4UJgK Dh0zkUTr ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/521B3AE3FFDF38EF

http://decoder.re/521B3AE3FFDF38EF

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\LimitPing.png => \??\c:\users\admin\pictures\LimitPing.png.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\MoveOpen.raw => \??\c:\users\admin\pictures\MoveOpen.raw.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\UseOut.tif => \??\c:\users\admin\pictures\UseOut.tif.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\CheckpointClear.png => \??\c:\users\admin\pictures\CheckpointClear.png.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\EnterCopy.crw => \??\c:\users\admin\pictures\EnterCopy.crw.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\HideGrant.raw => \??\c:\users\admin\pictures\HideGrant.raw.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\ResetCompress.png => \??\c:\users\admin\pictures\ResetCompress.png.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\ResizeWrite.raw => \??\c:\users\admin\pictures\ResizeWrite.raw.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\DisableRegister.tif => \??\c:\users\admin\pictures\DisableRegister.tif.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\DismountFind.png => \??\c:\users\admin\pictures\DismountFind.png.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File renamed	C:\Users\Admin\Pictures\JoinPush.crw => \??\c:\users\admin\pictures\JoinPush.crw.vr855d	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\t32mMaunsR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe"	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

description	ioc	process
File opened (read-only)	\??\A:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\E:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\F:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\H:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\N:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\T:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\V:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\X:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\B:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\J:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\L:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\R:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\U:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\W:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\Y:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\Z:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\G:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\I:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\O:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\P:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\Q:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\S:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\D:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\K:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened (read-only)	\??\M:	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

Drops file in Program Files directory 25 IoCs

Processes:

9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

description	ioc	process
File opened for modification	\??\c:\program files\EnterAssert.htm	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\RestoreRemove.vstx	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\SendAdd.rtf	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\ShowGrant.kix	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\SubmitJoin.aiff	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\UninstallStart.tiff	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\CloseDisable.pcx	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\ConvertFromUndo.pptx	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\InvokeRead.rtf	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\OptimizeGroup.mpg	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\ResolveAdd.wma	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File created	\??\c:\program files\tmp	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File created	\??\c:\program files\vr855d-readme.txt	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\SelectUninstall.dib	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\UnregisterSave.mp2	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File created	\??\c:\program files (x86)\tmp	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\RedoUnprotect.clr	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\MergeTest.jtx	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\PopEnable.wma	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\RemoveOpen.temp	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\SendProtect.pub	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\StopCompress.mht	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\UninstallEdit.potm	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File created	\??\c:\program files (x86)\vr855d-readme.txt	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
File opened for modification	\??\c:\program files\HideSync.m1v	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

pid	process
4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
Token: SeTakeOwnershipPrivilege	4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
Token: SeBackupPrivilege	4124	vssvc.exe
Token: SeRestorePrivilege	4124	vssvc.exe
Token: SeAuditPrivilege	4124	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe

description	pid	process	target process
PID 4648 wrote to memory of 4248	4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe	netsh.exe
PID 4648 wrote to memory of 4248	4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe	netsh.exe
PID 4648 wrote to memory of 4248	4648	9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe
"C:\Users\Admin\AppData\Local\Temp\9df39b3b2b0ed8ed469d028cc4269655d6b70aef8b22a308f34e1929e4b00992.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648