sodinokibi | e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685

General

Target
e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
Size 143KB
Sample220124-a7p21ahad9
SHA256 e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685
MD5 f15cd1311e851792e6660dd527989ff5
SHA1 71583cdda001972a96be863e73c5ab490f41cf90
SHA512 07f2dd86f340648f4a06da44ebcfa1897b1196411c05a002e085779224c7154e325bbafcdac1254a1bdc3e5c11579023d4804d639ea112d047d011c6a32b5710
MD5 SHA1 SHA512

Score

10^/10

sodinokibi ransomware

Malware Config

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\R:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\S:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\Z:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\G:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\J:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\L:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\M:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\N:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\P:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\V:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\W:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\A:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\B:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\F:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\I:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\X:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\E:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\U:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\Y:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\H:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\K:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\Q:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
File opened (read-only)	\??\T:	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
712	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2764	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
2764	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
2764	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
2764	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1388	vssvc.exe
Token: SeRestorePrivilege	1388	vssvc.exe
Token: SeAuditPrivilege	1388	vssvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3128	2764	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe	68
PID 2764 wrote to memory of 3128	2764	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe	68
PID 2764 wrote to memory of 3128	2764	e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe	68
PID 3128 wrote to memory of 712	3128	cmd.exe	70
PID 3128 wrote to memory of 712	3128	cmd.exe	70
PID 3128 wrote to memory of 712	3128	cmd.exe	70

C:\Users\Admin\AppData\Local\Temp\e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe
"C:\Users\Admin\AppData\Local\Temp\e043c9c475ce6a24337f7eb6a5359a0a23d9c33d2d69d14dc70d94b20276c685.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:712