sodinokibi | e5bbe16980677d0336ae0e6830ac887bf072c70caa6d9536ba146e0809bfa606

General

Target

e5bbe16980677d0336ae0e6830ac887bf072c70caa6d9536ba146e0809bfa606.dll
Size

118KB
MD5

4e142923b149ab179984940e1bfb6041
SHA1

f20a1803e38b4d7b9437d53a95403fb0b6387f11
SHA256

e5bbe16980677d0336ae0e6830ac887bf072c70caa6d9536ba146e0809bfa606
SHA512

6f6ece3f0152811348e44630a3139f2f6ed46fc43de97cceaabe35616abdb2c4e84ddd2e4b2c6350a78a49b8323910d09dc342c5836a2d882e23f76f2aee6fa2

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\i0uddnw1w7-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension i0uddnw1w7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/657C035421994DBD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/657C035421994DBD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ISEf6uJVw7MGo1za7m+E9gV34HCHl9RsrGnNoGIt6Tpe6j1G3S5eJMntRSYsMh5I JqeTUk4fk8AleIfT/J4uvFYuLC3d6tGpjOLEjKR4AXkYHSTCTqnsYVxhC+jMZwE3 4HUNU51nlxugaW+Oyv2vGdGNiI8bBggutKPqfu5/bDfmg5d86InMKK8uH+pVQvGF D1iwOgdFTSZ5RzkQa77zttLjU0PPK7SgQWLi1oRA2fzsjNZtOq8Lu9Sk3Rj8jAZH unO3Gfymv/cLde5X6yBuhGwzhP+t6Zi9743PPgVczQy3PcbcK3ySmXxooBXrsGLj TyAplbJwdOcIq9HFxjR14qFwyjErQgAJBhQhaMfpNBPX54aUwlE/ssEaXk48IqFJ p28uLCwoa4tlsh3tIzOmJ7kZKY8xC/vlqpsCEHUSyCllZUcBO7yFqdAawJ8hZ8+7 pZmDw6aYKXgIeC7YXNSl+UrjrOamv00Mya7gBUapDThi//3S9ingLTIexG7RGbMF DrhoIEgJy1OvhsZsHtNR1lyLRyYsXqsi+yB9J/RdWxGe2PO2Nu0QFNo32XKwmcpX XEyJpemA2u6Qn1wK9PqCIUP6yPboP21KHW5VOAbxPy5pIn4s1/J7PrMJzZvhigXI frLzX/E+HyfyMqV8XwNiM2LQnyyy/W2uHOo4T6MkX9m/Eq96SKsEfDhDFtgrqtse q2q7uBYWWCJtYuAUKVg4bdHq1m2aHsunhGS971N21q4/aIcV/BWxyg9+hYegQfpM NCSLrOgzRfWtNQrWcOfDApuSYipCRttLWk/SwJdJFMpjB2UiUoH4hb1s8NSJ0npl 7gXtlrEfXuyXjw7aEDFL/wE3xm704ywA3MWj1H6BHBXQtrjJCCTFtvlbyTHSPuqK FZNmdycWLFy2onjlTqR0PStu2r7dGzdlEXT8OUjNg1aSPx1Sn7CPq9wyUc3pY82x aGV5mHRHMHNaaeGLPWXy/msE2ZmbEHZZIxFPLp3/sOzSWdBNIdxiZHbROPDZhrOI DYQjbrjzuByvcRRbWgXyutaR09KS57Nh/OVv6+UC9uUqTvEnMFe1oE7Xj4Al6GH1 pZXjZ0ywgXnqdGCuzhoS9oRkRmn8zOWzj4Lmg/nmmpN0EPCMJ2Ox96DaDFxALxA2 qwDAI6C8Fih8Nk+ddWyEiUyWf0EnsRIE1paZaEuaPBb2mSim3Oq9eyw8u1NXkbP5 Z/kRJWSXnPSNAU2zepijFNXPWFgNoTVOaIP/d9CRYERckiYbDV1muf/ta/yTu2fc p4ELcxCzXngRXZ8HR4emgabznQMKzXW9 =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/657C035421994DBD

http://decoder.re/657C035421994DBD

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RequestDeny.crw => \??\c:\users\admin\pictures\RequestDeny.crw.i0uddnw1w7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\SyncGrant.png => \??\c:\users\admin\pictures\SyncGrant.png.i0uddnw1w7	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ProtectApprove.crw => \??\c:\users\admin\pictures\ProtectApprove.crw.i0uddnw1w7	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe

Drops file in Program Files directory 21 IoCs

Processes:

regsvr32.exe

description	ioc	process
File opened for modification	\??\c:\program files\BackupPing.gif	regsvr32.exe
File opened for modification	\??\c:\program files\DisableUndo.clr	regsvr32.exe
File opened for modification	\??\c:\program files\InvokeLock.txt	regsvr32.exe
File opened for modification	\??\c:\program files\ResumeWait.xps	regsvr32.exe
File opened for modification	\??\c:\program files\StartPing.DVR	regsvr32.exe
File opened for modification	\??\c:\program files\CopyRename.dwfx	regsvr32.exe
File opened for modification	\??\c:\program files\OpenResize.cr2	regsvr32.exe
File opened for modification	\??\c:\program files\SyncGet.ini	regsvr32.exe
File opened for modification	\??\c:\program files\ExpandCheckpoint.m4a	regsvr32.exe
File opened for modification	\??\c:\program files\FindSwitch.reg	regsvr32.exe
File opened for modification	\??\c:\program files\OptimizeSplit.css	regsvr32.exe
File opened for modification	\??\c:\program files\RedoRequest.emz	regsvr32.exe
File opened for modification	\??\c:\program files\UseSplit.jpg	regsvr32.exe
File opened for modification	\??\c:\program files\CompleteAdd.contact	regsvr32.exe
File opened for modification	\??\c:\program files\CopyStep.tmp	regsvr32.exe
File opened for modification	\??\c:\program files\DismountGroup.dwfx	regsvr32.exe
File opened for modification	\??\c:\program files\ProtectConvertTo.mhtml	regsvr32.exe
File opened for modification	\??\c:\program files\RegisterOut.3gp	regsvr32.exe
File opened for modification	\??\c:\program files\ResumeTest.mpg	regsvr32.exe
File opened for modification	\??\c:\program files\StopMount.TS	regsvr32.exe
File opened for modification	\??\c:\program files\SuspendSearch.ini	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

1344 regsvr32.exe
1344 regsvr32.exe
1344 regsvr32.exe
1344 regsvr32.exe

pid	process
1344	regsvr32.exe
1344	regsvr32.exe
1344	regsvr32.exe
1344	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1344	regsvr32.exe
Token: SeTakeOwnershipPrivilege	1344	regsvr32.exe
Token: SeBackupPrivilege	1060	vssvc.exe
Token: SeRestorePrivilege	1060	vssvc.exe
Token: SeAuditPrivilege	1060	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2268 wrote to memory of 1344	2268	regsvr32.exe	regsvr32.exe
PID 2268 wrote to memory of 1344	2268	regsvr32.exe	regsvr32.exe
PID 2268 wrote to memory of 1344	2268	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e5bbe16980677d0336ae0e6830ac887bf072c70caa6d9536ba146e0809bfa606.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\e5bbe16980677d0336ae0e6830ac887bf072c70caa6d9536ba146e0809bfa606.dll
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1060

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads