sodinokibi | 892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f

General

Target

892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f.dll
Size

119KB
MD5

52d280d45daba695a565e25cdd2863d8
SHA1

60c525e2a52137514d3dfa72e8a49a0d4da98759
SHA256

892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f
SHA512

8304713277dddc0e9f899d3f91b1a8e33fb654945bd71f45185dcfee70a681df337d53df891272003ec93827aa2d5db77a9c652a3253409fe65b42c368a55701

Score

10^/10

sodinokibi ransomware suricata

Malware Config

Extracted

Path

C:\o2cb495rx-read-me-KRBL.txt

Family

sodinokibi

Ransom Note

---=== Welcome Kubasta Bickford & Lorenson ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension o2cb495rx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your info copyed to our servers. If you do not take action to contact us, the data will be published for free access to everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E491EFEEBAD66778 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E491EFEEBAD66778 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JXiH9zS2Ky8hN0G7mE+Y5e3AFTiFWnRZpZ3BH4fWHuhI24CQscDYq+4tIOxsP04P JTKhcpoDFi1C6sR+i8rCGN3pt3iWBxnfWTYHvEYbvqhWGHb1usUt52CbggtTQsXh bS/HwMt1rjiotxtdmutyR5OiAHpSHbA5o0aLC6xVVpbLNdBduAjlVuNG9HmoNlti k+nnuaCguB5K+lb2HAVhv18aBS8M3RwEFKujpTrEdCsZ03h1ERQbac0Hl+uutczB 5DdDFHpwU4VA8Y/pOVYqLNMy+41pS90MS5RKOsopEMC/TlRcAXKWOMHsTie7ztmd +P14Vmrru8AsICP3D4cN2CugP50HFHyFdOqr6GdqSISjupxsYNJLiFWp9obcN4hu MOgWZV4CTrloAiYh0qP+GQn355gekjEGOggZOknDk9UV4sd12UDWknxKgwdKtWoS 3FFYZ4uiW/NB1RYxSDrk+/1unmfv77RHyfUfW8Kd+oSash/cLmy4KR5w2twEQ342 vISGFFmyQB2FRR2A6gpc90Tteo8hZhDSvCe/5rK2egT7xoQzAA1PXaTFvCy0QPkb 7Ill4gqJCY9pdcdxS+ZFNOm4SWMXEtdnGX7ybhUuhD5h3XJBcy9fFhBd0bnRvrp5 BMbClHTFUgkwDQEpmLsnLEzPS4m7c6YCIAJs52tR6c94vOGJa9xRlgYDv2y9JEZe BJo61xhFhlrHZJPBmXRV1obqTi2EgDOMGGOo4TAXTqksoy/klxtHNufhKuC1QJ4E JS3kFnj5UDbrO05ICyQKDRHXrfkMEMVIGalBebGcPcAzXGcfOK2Q/tZdZ52i3l8S OZBXNEM/ZJTYwJKEwI52Mi9vBin8Zeu7F6zUZFUs5zmVru73Nwy3IXws8aSdPISW y0TUbZr7tHziiuG/mfaj9PLH05XKjq9EsvhPeSW+2tggKdfB48hiEH/TtEr6yl4+ fWr6Ys2juSkdqg8O4zyNwxA3Or4IfzAEN+yynVqwUF2gMj7x/cY/L7H+8YpJiVYx QVi+5TrcJnjIPgA0REbj+NCMZg6G6iSS4YVOTY4Pxg6dmK2IRXuwbfFyaTAvAfXp cQZ2bhpuXI8tGfATX94feiz77ofIctfUlCSAm0dxSczhemDMXPLLTeDyXrPH811M SqcMtdJWS+tAcSQcKfvqfO+bZkb3ZpqoOJYtVa/Jvz6GKMO7jK8YSy7DuvBjY9e9 ug5YEGTewOYtZoNNx4ygIqnLQ0gEIcdt2iLmMQzCMFbNReASb+sTaBOhWHcuZQXd S47OEb6ALAqmLANVuQd3+RbnqQWY6kDpqpWC+A== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E491EFEEBAD66778

http://decoder.re/E491EFEEBAD66778

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
suricata

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\LimitTest.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\LimitTest.tiff => \??\c:\users\admin\pictures\LimitTest.tiff.o2cb495rx	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RepairWait.tif => \??\c:\users\admin\pictures\RepairWait.tif.o2cb495rx	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ResumeOptimize.crw => \??\c:\users\admin\pictures\ResumeOptimize.crw.o2cb495rx	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\LimitDisable.raw => \??\c:\users\admin\pictures\LimitDisable.raw.o2cb495rx	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

regsvr32.exe

description ioc process

File opened for modification C:\Windows\System32\CatRoot2\dberr.txt regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	regsvr32.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7egw9j.bmp"	regsvr32.exe

Drops file in Program Files directory 20 IoCs

Processes:

regsvr32.exe

description	ioc	process
File opened for modification	\??\c:\program files\CompressUse.wvx	regsvr32.exe
File opened for modification	\??\c:\program files\CopyRedo.png	regsvr32.exe
File opened for modification	\??\c:\program files\DismountCompare.iso	regsvr32.exe
File opened for modification	\??\c:\program files\MergeUpdate.ps1xml	regsvr32.exe
File opened for modification	\??\c:\program files\OutUnlock.asx	regsvr32.exe
File opened for modification	\??\c:\program files\RequestSuspend.vstx	regsvr32.exe
File created	\??\c:\program files (x86)\o2cb495rx-read-me-KRBL.txt	regsvr32.exe
File opened for modification	\??\c:\program files\ApproveSplit.M2V	regsvr32.exe
File opened for modification	\??\c:\program files\StartImport.vssx	regsvr32.exe
File opened for modification	\??\c:\program files\UndoReceive.dwg	regsvr32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\o2cb495rx-read-me-KRBL.txt	regsvr32.exe
File created	\??\c:\program files\o2cb495rx-read-me-KRBL.txt	regsvr32.exe
File opened for modification	\??\c:\program files\AddPing.ogg	regsvr32.exe
File opened for modification	\??\c:\program files\SetHide.aiff	regsvr32.exe
File opened for modification	\??\c:\program files\SetInvoke.xlsx	regsvr32.exe
File opened for modification	\??\c:\program files\StartOpen.iso	regsvr32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\o2cb495rx-read-me-KRBL.txt	regsvr32.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\o2cb495rx-read-me-KRBL.txt	regsvr32.exe
File opened for modification	\??\c:\program files\CloseDisable.vstm	regsvr32.exe
File opened for modification	\??\c:\program files\GroupRequest.jpg	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1196 regsvr32.exe
1196 regsvr32.exe

pid	process
1196	regsvr32.exe
1196	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1196	regsvr32.exe
Token: SeTakeOwnershipPrivilege	1196	regsvr32.exe
Token: SeBackupPrivilege	612	vssvc.exe
Token: SeRestorePrivilege	612	vssvc.exe
Token: SeAuditPrivilege	612	vssvc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 880 wrote to memory of 1196	880	regsvr32.exe	regsvr32.exe
PID 880 wrote to memory of 1196	880	regsvr32.exe	regsvr32.exe
PID 880 wrote to memory of 1196	880	regsvr32.exe	regsvr32.exe
PID 880 wrote to memory of 1196	880	regsvr32.exe	regsvr32.exe
PID 880 wrote to memory of 1196	880	regsvr32.exe	regsvr32.exe
PID 880 wrote to memory of 1196	880	regsvr32.exe	regsvr32.exe
PID 880 wrote to memory of 1196	880	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\892083cb3f064e9434df593bfdf6f00e48ab68778bfca8d9a64d697d5d19fe5f.dll
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1292

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-60-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/1196-61-0x0000000000000000-mapping.dmp

Download
memory/1196-62-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads