Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
08-12-2021 09:05
Static task
static1
Behavioral task
behavioral1
Sample
sodinokibi.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
sodinokibi.exe
Resource
win10-en-20211104
General
-
Target
sodinokibi.exe
-
Size
143KB
-
MD5
a3749c66f65d247d8a6fae1be26d3ef9
-
SHA1
c394464bba56e62ddfe2c9073932fb656fb78b6c
-
SHA256
d191761ac8a7b0a3525764664609a8fccfa3732d331c525e9c1c9eb0a7068a9c
-
SHA512
65bc1dba7e4de098e6b27b13b1e0723f703f645e4a4c6e53b7b03ec096a70d48ec2aca7e8bcd911ced61bab35e95983510604421ef35a593278414bfbb1cb01c
Malware Config
Extracted
C:\8d0024w08s-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FD1D15B5DAE72CD5
http://decryptor.top/FD1D15B5DAE72CD5
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
sodinokibi.exedescription ioc process File renamed C:\Users\Admin\Pictures\DisableGrant.crw => \??\c:\users\admin\pictures\DisableGrant.crw.8d0024w08s sodinokibi.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
sodinokibi.exedescription ioc process File opened (read-only) \??\Y: sodinokibi.exe File opened (read-only) \??\A: sodinokibi.exe File opened (read-only) \??\G: sodinokibi.exe File opened (read-only) \??\L: sodinokibi.exe File opened (read-only) \??\N: sodinokibi.exe File opened (read-only) \??\T: sodinokibi.exe File opened (read-only) \??\W: sodinokibi.exe File opened (read-only) \??\X: sodinokibi.exe File opened (read-only) \??\Z: sodinokibi.exe File opened (read-only) \??\F: sodinokibi.exe File opened (read-only) \??\J: sodinokibi.exe File opened (read-only) \??\M: sodinokibi.exe File opened (read-only) \??\R: sodinokibi.exe File opened (read-only) \??\U: sodinokibi.exe File opened (read-only) \??\D: sodinokibi.exe File opened (read-only) \??\V: sodinokibi.exe File opened (read-only) \??\E: sodinokibi.exe File opened (read-only) \??\H: sodinokibi.exe File opened (read-only) \??\K: sodinokibi.exe File opened (read-only) \??\Q: sodinokibi.exe File opened (read-only) \??\S: sodinokibi.exe File opened (read-only) \??\B: sodinokibi.exe File opened (read-only) \??\I: sodinokibi.exe File opened (read-only) \??\O: sodinokibi.exe File opened (read-only) \??\P: sodinokibi.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
sodinokibi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6dl59f59ko.bmp" sodinokibi.exe -
Drops file in Program Files directory 23 IoCs
Processes:
sodinokibi.exedescription ioc process File opened for modification \??\c:\program files\ClearMove.mp4v sodinokibi.exe File opened for modification \??\c:\program files\RequestRevoke.mpeg sodinokibi.exe File opened for modification \??\c:\program files\SuspendGrant.xltx sodinokibi.exe File opened for modification \??\c:\program files\DenyExpand.docx sodinokibi.exe File opened for modification \??\c:\program files\ExitMerge.mht sodinokibi.exe File opened for modification \??\c:\program files\SetUnprotect.wma sodinokibi.exe File opened for modification \??\c:\program files\ShowUnblock.rm sodinokibi.exe File opened for modification \??\c:\program files\SplitPop.svg sodinokibi.exe File created \??\c:\program files\8d0024w08s-readme.txt sodinokibi.exe File created \??\c:\program files\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\ConvertFromGroup.ex_ sodinokibi.exe File opened for modification \??\c:\program files\UnblockRevoke.pptx sodinokibi.exe File opened for modification \??\c:\program files\UnregisterClear.TS sodinokibi.exe File opened for modification \??\c:\program files\WaitEnable.AAC sodinokibi.exe File opened for modification \??\c:\program files\ImportCopy.rm sodinokibi.exe File opened for modification \??\c:\program files\UnblockJoin.wmf sodinokibi.exe File opened for modification \??\c:\program files\UnprotectCheckpoint.vsdm sodinokibi.exe File opened for modification \??\c:\program files\EnableCompress.vbe sodinokibi.exe File opened for modification \??\c:\program files\JoinMeasure.temp sodinokibi.exe File opened for modification \??\c:\program files\SyncLimit.wm sodinokibi.exe File created \??\c:\program files (x86)\8d0024w08s-readme.txt sodinokibi.exe File created \??\c:\program files (x86)\d60dff40.lock sodinokibi.exe File opened for modification \??\c:\program files\ApproveAssert.asx sodinokibi.exe -
Drops file in Windows directory 64 IoCs
Processes:
sodinokibi.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_en-us_7f2aa019e80ba70a_userdeviceregistration.dll.mui_22ab8f29 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_bg-bg_e617457ad1e00a3e.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_30cfa4f72d905e85.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.15063.0_none_8375fc1900429a0a_nsi.dll_e72df756 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsiwmiv2.dll_daf801c2 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_en-us_5ed8287abe95c9de.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_lt-lt_ce3b1a34396db477.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_10.0.15063.0_en-us_77cfed1b3d429e22.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.15063.0_en-us_87ac933f1cd28fdb_winresume.efi.mui_f412814e sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_10.0.15063.0_none_7adeb53576aeb7a4.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_9120bc15bf67e669_bootmgr.exe.mui_c434701f sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_en-us_15a35bae90857b0c_listsvc.dll.mui_27f0fc85 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_sv-se_3d51cb70dfbd2866_msimsg.dll.mui_72e8994f sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_10.0.15063.0_none_d3bbda919a7b39f1.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ole-automation_31bf3856ad364e35_10.0.15063.0_none_d868ae1968a9ae8b.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_pt-br_6fe305a38dbc322b_comctl32.dll.mui_0da4e682 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-webauthn.resources_31bf3856ad364e35_10.0.15063.0_en-us_324d9d52150f7e18.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_e5db677400777894_mofd.dll.mui_793ef98d sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_c8514oem.fon_9ff1fe45 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_10.0.15063.0_none_67af460eee1c40c7_netio.sys_a06e75d0 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.0_none_9055be80f37df5c1_gdiplus.dll_423f7010 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_en-us_7f2aa019e80ba70a_dsreg.dll.mui_5d9efc7e sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_03474fa863a84227_bootmgr.exe.mui_c434701f sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_en-us_3095a2f55ebfb3fd.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_8514oemr.fon_dbe7e3dc sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_sl-si_88a80d10cfcef28d_comctl32.dll.mui_0da4e682 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-os-kernel-minwin_31bf3856ad364e35_10.0.15063.0_none_490d7cf764513c99.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_de-de_33ac492def379f50_gpapi.dll.mui_ef0a9748 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.15063.0_en-us_f9cce479897c6462_fidocredprov.dll.mui_4ca89266 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..geservice.resources_31bf3856ad364e35_10.0.15063.0_en-us_80f9be2c08ee2caf.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_en-us_567969ff4355ff0f.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_fr-ca_f4a5b54d6c6b3700.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_it-it_b3446171d6b6f90b.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_de-de_2af769b1bbfa0dd4_combase.dll.mui_6db10b33 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_nl-nl_48f7bf74aac3a3de_bootmgfw.efi.mui_a6e78cfa sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_vgaf1256.fon_9bd7a63b sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_uk-ua_cb62fe0eb7312018_comctl32.dll.mui_0da4e682 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..oryservices-ntdsapi_31bf3856ad364e35_10.0.15063.0_none_ea45c9f15e65cc3a_w32topl.dll_1a0f388b sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-profapi_31bf3856ad364e35_10.0.15063.0_none_19b189889e364052_profapi.dll_d55ae499 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_5cfc9994b735544f_afd.sys.mui_ff192075 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-grouppolicy-base_31bf3856ad364e35_10.0.15063.0_none_438be56a54322168_gpapi.dll_868dd225 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_nb-no_8f43ad922e3e34f9.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.15063.0_none_e8b186736ef44520.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.15063.0_none_a69f8cf95bf4534e_dnsapi.dll_c81f5791 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..n-cmdline.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_83341399f9512935_dsregcmd.exe.mui_8ce2c638 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.15063.0_ja-jp_927b4bdd0caf1fba.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ldap-client_31bf3856ad364e35_10.0.15063.0_none_0ea4cb22c39b2f3e_wldap32.dll_09c99dc1 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..opactivitymoderator_31bf3856ad364e35_10.0.15063.0_none_1afe75a2a51438fe_bamsettingsclient.dll_db7ec840 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-system_31bf3856ad364e35_10.0.15063.0_none_946aa6202fade3c5_hvgasys.fon_9f580ce4 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..gon-tools.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_5590b20187c8e1aa.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_nl-nl_8b5dcc4a81438dbf_memtest.exe.mui_77b8cbcc sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.15063.0_de-de_86f7ec01bdc8e68b_samsrv.dll.mui_32250491 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-msxml60_31bf3856ad364e35_10.0.15063.0_none_a3d67fce0405ea82.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore.resources_31bf3856ad364e35_10.0.15063.0_en-us_6a6c9bb281748302_srpapi.dll.mui_2693a558 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_7827ea7767da95a8_bootmgfw.efi.mui_a6e78cfa sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_en-us_d4770771a66242c7.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_lt-lt_4a7c585e4840d4da_bootmgr.exe.mui_c434701f sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_de-de_6cb285b5a1a76f47_listsvc.dll.mui_27f0fc85 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_hu-hu_583a2249f8610baf.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1c02e7b415c9e014.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ui-xaml-maps_31bf3856ad364e35_10.0.15063.0_none_b2b63099374d63dc.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_j8514oem.fon_cf1af1d6 sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon-sysntfy_31bf3856ad364e35_10.0.15063.0_none_6686cc5b4881feb6.manifest sodinokibi.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.15063.0_none_80d6da500dc0355d_winlogon.exe_ac37d0c5 sodinokibi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3348 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
sodinokibi.exepid process 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe 2436 sodinokibi.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3668 vssvc.exe Token: SeRestorePrivilege 3668 vssvc.exe Token: SeAuditPrivilege 3668 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
sodinokibi.execmd.exedescription pid process target process PID 2436 wrote to memory of 3460 2436 sodinokibi.exe cmd.exe PID 2436 wrote to memory of 3460 2436 sodinokibi.exe cmd.exe PID 2436 wrote to memory of 3460 2436 sodinokibi.exe cmd.exe PID 3460 wrote to memory of 3348 3460 cmd.exe vssadmin.exe PID 3460 wrote to memory of 3348 3460 cmd.exe vssadmin.exe PID 3460 wrote to memory of 3348 3460 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe"C:\Users\Admin\AppData\Local\Temp\sodinokibi.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2436-118-0x00000000005A0000-0x000000000064E000-memory.dmpFilesize
696KB
-
memory/2436-119-0x00000000005A0000-0x000000000064E000-memory.dmpFilesize
696KB
-
memory/2436-120-0x00000000005A0000-0x000000000064E000-memory.dmpFilesize
696KB
-
memory/3348-122-0x0000000000000000-mapping.dmp
-
memory/3460-121-0x0000000000000000-mapping.dmp