sodinokibi | eac0fb771a2da0172395a5b21d02ce5ee6ae6d0e949214195e3fe4f46df566d3

General

Target

eac0fb771a2da0172395a5b21d02ce5ee6ae6d0e949214195e3fe4f46df566d3.dll
Size

119KB
MD5

e9329f1fcd4f2bcd9a283b3308f4b552
SHA1

52ff05217b158ef4df9dca6a8cf14f1e003a4d45
SHA256

eac0fb771a2da0172395a5b21d02ce5ee6ae6d0e949214195e3fe4f46df566d3
SHA512

4d3eebaf20486bacb7c13cdab4653496162bde433016e85e60ef59963ba834c0a21f3e8d057ddc014547bf671c24bf9d89a95c1004fe909a414c546ca40a3775

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\8hiuv77a0-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8hiuv77a0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8883FFF8357D343D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/8883FFF8357D343D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: m+Z8qUN2deUz2SksR9PJzAcUhtxcjqo5KMwcptU/mvXygW0gfPOgeFdIP9nDG09S NNRoSI9mVqj8c/AU/70qfy0ajBTyQfj8xJ0+sS+XPjZkQ2uSOxBwG4UPHQOBJPV2 8UJR7JBxI4XiG56rtJTb+5Od2yGX71w+QcJImpUsrGfHHf4k+rO5+6BLdSgg+986 wF2PCaOX8IPnDxUXQlH/Bf7omWqxNv5aSle7gTushHTDePalsvAKQtZ2PchoiuIy +Ds9jZvjDG4CigwD4W+0ELFwP/eRrz0pmjQTA09hImNTMUzcgfoF/HOgNk/aLEdm o7hJr6MqIO0Yqq8G/sZM61knMuY9zGhGj9ocj6DrHStKQQTi2zxOV7E1Dz09B94y /OqNjtcu410fwEJwtWA9rKMWC23nP4PkP+oc1oeSQ522VHqPv5Z21LlHMqhxopr7 xMeYMp0V1J+iILT42TIOx406AnPs5lrc/mU/7nqBO1N7tcEbykOx++W4nDXI+Q7R BYOJ177OmbNLtcVKeu6ePoEtRO9iSrG7J0Eqa2RP31nyWWSpgPesQda0D8TYvIUo 6h6pO1iE9f8EFFbMtkYmdpacpP0Fszic+xMJlFKMPEyt8Rn28rWWqGixvpSbRHdn KOzh7vNwopWTXbmAlNAdq2xXn9ohW9x2PWNZ5oW4xrueu34LSmtZ019Fr0X/a5cb A/e7CEJFoTY5SbyCIVeE/qEvWFQcpSjIX3ohaDap3huSbUjArDU3CXr+5B0VDncU U3ja9+SeTfxuiGt0e7XJyIqrOTgbt23qlp/92ZvOQRm0ktQy31UqVBEHbNbMeqSS eXo9HYwF4mrGyJvBid9o1hphc6cxuDlxnM2rAkBBx+T6s7otyeP/kVPzU+3j72UA oxTDYYjE7tuRiLvKWCCULLZAxgeWCnD4X3EjzfHrYV7PT2B3oSW9yuPXlh3gbG0R G0RNWFYu11uFpya4RwaY84qBjxGcsUPpDxgdj9OnqkSrWB4lVqB8L2mbWGMOfDep mbJxHN+ByQ7qOntUX4ISE5iGFRTm+cqx0BkPK1pl612a3a1SOuSTsfHJPn/5bvdA Saz/FbppRWVmxOrdhNwNUwXrulR2l05PruHtcf9qm+Wm/ssg3WV6mRdRQJ0jGjL1 8QyjpxWLytEliBLKaeE9vkGu/YoYBzGesYyNF7nKwHTi/q5UrVL1MqhI/uuKnMjw Ek0zmHNVDg4CpB9UXlYf78Sqh9fH5ih0B/TWuBdWN/+9PdG2hoepVRxwf3B37Sxg KAiXREU/BafHT7nN =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8883FFF8357D343D

http://decoder.re/8883FFF8357D343D

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe

Drops file in Program Files directory 25 IoCs

Processes:

regsvr32.exe

description	ioc	process
File opened for modification	\??\c:\program files\FindSend.rle	regsvr32.exe
File opened for modification	\??\c:\program files\ReceiveHide.dwfx	regsvr32.exe
File opened for modification	\??\c:\program files\UninstallUpdate.ps1xml	regsvr32.exe
File created	\??\c:\program files\8hiuv77a0-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\ApproveFind.xlsm	regsvr32.exe
File opened for modification	\??\c:\program files\ResetDeny.3gpp	regsvr32.exe
File opened for modification	\??\c:\program files\UnprotectDismount.au	regsvr32.exe
File opened for modification	\??\c:\program files\UseTest.ini	regsvr32.exe
File opened for modification	\??\c:\program files\WaitWatch.mpeg	regsvr32.exe
File opened for modification	\??\c:\program files\WriteMeasure.docx	regsvr32.exe
File created	\??\c:\program files (x86)\8hiuv77a0-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertExport.wm	regsvr32.exe
File opened for modification	\??\c:\program files\MountUpdate.aifc	regsvr32.exe
File opened for modification	\??\c:\program files\RegisterTrace.midi	regsvr32.exe
File opened for modification	\??\c:\program files\WaitBlock.js	regsvr32.exe
File opened for modification	\??\c:\program files\RevokeConvert.aif	regsvr32.exe
File opened for modification	\??\c:\program files\RevokeRepair.sql	regsvr32.exe
File opened for modification	\??\c:\program files\SendUnlock.wm	regsvr32.exe
File opened for modification	\??\c:\program files\ExpandComplete.3g2	regsvr32.exe
File opened for modification	\??\c:\program files\InstallSwitch.rm	regsvr32.exe
File opened for modification	\??\c:\program files\PopMerge.asf	regsvr32.exe
File opened for modification	\??\c:\program files\ResetGet.mp4	regsvr32.exe
File opened for modification	\??\c:\program files\ResizeFind.xlt	regsvr32.exe
File opened for modification	\??\c:\program files\TestUse.xlt	regsvr32.exe
File opened for modification	\??\c:\program files\UnblockConvert.7z	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

980 regsvr32.exe
980 regsvr32.exe

pid	process
980	regsvr32.exe
980	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	980	regsvr32.exe
Token: SeTakeOwnershipPrivilege	980	regsvr32.exe
Token: SeBackupPrivilege	660	vssvc.exe
Token: SeRestorePrivilege	660	vssvc.exe
Token: SeAuditPrivilege	660	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3760 wrote to memory of 980	3760	regsvr32.exe	regsvr32.exe
PID 3760 wrote to memory of 980	3760	regsvr32.exe	regsvr32.exe
PID 3760 wrote to memory of 980	3760	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eac0fb771a2da0172395a5b21d02ce5ee6ae6d0e949214195e3fe4f46df566d3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3760

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\eac0fb771a2da0172395a5b21d02ce5ee6ae6d0e949214195e3fe4f46df566d3.dll
2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:660

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads