sodinokibi | eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4

General

Target

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Size

118KB
MD5

08fad193fc03bad8132bd791155212d2
SHA1

5c56fd5246f3680f4576a9e633fb76acfb15f994
SHA256

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4
SHA512

d2e3460998d409a530f5435f9c7693d1aa684b5016b8abcbfd86530cd2ed2fd7849094bf2be865e2f75179f557567265b8ee6091c39d96d7cb8c7b89a9d2835e

Score

10^/10

sodinokibi persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\0u8txz0-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0u8txz0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). In case if you will not contact ,your data will be posted online or sold. Also media will be informed! [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78AE43A9C61A1316 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/78AE43A9C61A1316 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: lGiIIDnUaMnCWAgbG7DpDUXtaVBFXp170npfvhL+1JykjBEZyifNNnz6hJHtqzYq KgbPQ0inw+8EugsRclm+/8tpbAM13UCh+1XRl3mdgILM9qf+zPqUYHa8IqRp0jVv s2dBK9xsI+GHuRsE6+9p+T2ag3BF/aBrHnAwr4r4PUKCEZBOPtegGyTzvwrAHf9J 1CeskZOVmCazV2+bwJm/lzIMKT4NbkYms095nxEmBq/nQ9X/3ZdU//x0YlSSKFvO zz0sZ0rZ3+Vk7MGuE05YzIC8drNoBz4TetUMO70nyVsKXz+nd5DzbKmPqPvYLvvh ChqqePwzzN5Gd54tuqJ+NThb5V/bSRA3OXQ6m/1TjlIxI7aXCOb2JQjjQujUjoao OMq4cWTz+zTQWooma/lUj0O00tX27F4mRSiLQh6f+Tq341es7wN2kCHgDYrLG/Ct s6Soek1wZoDWx4RFKUphGzu3dp+77Mb22kt/6IztbdwUfu7pMzEZT3e0iyyoBfR9 pPRQ2kj73kwj87us0l7jF+ENhPalCScgg8VaEhcxad6YXvIIC0pjt73C3WoekqYK M4IqhfyaHJ4H9V+0FA9MW9du2iXzE7XWMYdfmMKETSGc7zAjmXmh0DGwtAlFJgWH jEylXoqKTdFSKzixPMJAR33/BRsCOyfeAm4hVvv0Yeb79AN3KFgOZw3gzVLS0zg7 vwWBFpf+ATsD+aH0CkYAv+9OreKgUx7wbUNLP7BHobI5WFh/shP8UBMlSkFjAFnH Mv4RY8haLrS+LG5wUwqXnFcCFcah9FabbTqBQdznxpyFImCDUCmpxJa24fZ+Me7S X499ArKvEMXKFtlYqWLkVCexK1ioPlTr8Zt+N62lKN7Y7FiKIV7AXQI/jRvHAStE c0mgk2iB0xfn6hClAwBYYAnCjpSAg8++5JEiiLCcuYa/GQH5yqdbDpLxrMT2j1Z7 +avNCg2RkgBYpy+NZmh54PmvjbTa2c+s+w2UNp0+5J0oi66vDT4crcHU289dUL8c WBbinsPsP/Lsphgauetzzm8PnYQLzTqP9jNVNj8jICvbW1Gn5FGhTeKP2/5kb3W9 pq4w7Ty6qS3deEhssAstwEKg9qS303T83LsLG7kl3M5nClbg4dBLmnhvW7UE53Qh LeB51GSnDXCs9LR20RayllCHAkVKcgLift3Id0OcqnF+zWHTbTs6du8wj2GJsmLd 2XUhuQmhfKs4woC+XCh0n2dEKoxKboW+/0jNWEfkhvoJi9yj/U9vLyFj24ZXdeYw cmyha2XdA+1qfT/ddI2kXTC3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78AE43A9C61A1316

http://decoder.re/78AE43A9C61A1316

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\UndoReceive.tif => \??\c:\users\admin\pictures\UndoReceive.tif.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\WaitOut.crw => \??\c:\users\admin\pictures\WaitOut.crw.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\CompareSkip.tif => \??\c:\users\admin\pictures\CompareSkip.tif.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\users\admin\pictures\OpenCompress.tiff	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\OpenCompress.tiff => \??\c:\users\admin\pictures\OpenCompress.tiff.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\SubmitOpen.png => \??\c:\users\admin\pictures\SubmitOpen.png.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\ResetConnect.tif => \??\c:\users\admin\pictures\ResetConnect.tif.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\users\admin\pictures\RevokeRestore.tiff	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\RevokeRestore.tiff => \??\c:\users\admin\pictures\RevokeRestore.tiff.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\DenyRename.crw => \??\c:\users\admin\pictures\DenyRename.crw.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\MoveComplete.png => \??\c:\users\admin\pictures\MoveComplete.png.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\ReadOut.tif => \??\c:\users\admin\pictures\ReadOut.tif.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File renamed	C:\Users\Admin\Pictures\RegisterUnlock.png => \??\c:\users\admin\pictures\RegisterUnlock.png.0u8txz0	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1E8NAmhfRO = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe"	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
File opened (read-only)	\??\B:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\F:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\G:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\K:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\L:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\M:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\N:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\Q:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\R:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\V:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\W:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\Y:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\A:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\E:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\H:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\J:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\O:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\P:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\S:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\X:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\Z:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\D:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\I:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\T:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened (read-only)	\??\U:	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\i465i01y1e156.bmp"	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Drops file in Program Files directory 8 IoCs

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

description	ioc	process
File opened for modification	\??\c:\program files\UninstallSubmit.3gp2	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\UnpublishRename.potx	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\EditSkip.3g2	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\LimitDeny.wmx	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\RedoDisable.fon	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\SelectExport.TTS	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\SendUninstall.xlsm	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
File opened for modification	\??\c:\program files\UnblockWait.midi	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

pid	process
3984	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
3984	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
3984	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
3984	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3984	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Token: SeTakeOwnershipPrivilege	3984	eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
Token: SeBackupPrivilege	2212	vssvc.exe
Token: SeRestorePrivilege	2212	vssvc.exe
Token: SeAuditPrivilege	2212	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe
"C:\Users\Admin\AppData\Local\Temp\eeeeb1d683c948d0426e253d708445817ad66460a93ef53668dd67a6f5f223d4.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984