sodinokibi | da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a

General

Target
da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
Size 183KB
Sample220124-a9s7fahah4
SHA256 da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a
MD5 e7d37da33838e4f42a6f4c53529e547b
SHA1 0ad890e173e3a785deead0ef9260f52477a39eb8
SHA512 4b41dd537f15b885e00e015789af9923d5cad72ee19c98586da099e81cf0e93098ac0ddef8a1746ce0753dec0c8514a61f3fe7929495a2a254a4de3238684dd7
MD5 SHA1 SHA512

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\5zkr51gtk-readme.txt

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5zkr51gtk. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E2B336983095221B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E2B336983095221B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: /Euaw/typrnUrfLC2/DQKu24saq6yuztDRCeaypoz8UHjrisNIS6Jtn26rUPR1yU 2Rmt3sUjW6L0NmabFoxFiuTZ4opxRha3VGnQd18jExUQFKI8r1xJJ6h+bgmwZGgD mF/duCyxO1dAr8tYOcEqQPz31FbwUaQRkzSLzPa1aLLOW7TBw9fGdzqUj1RdGAcE fhLFWLv6x0xSW1An7oiGA/j7JUkmXGzFf3cwZp5WCfrLkPQgaG7VfBYSjgPUW3lJ oqLGr5oPfcm7sQapQupx/tnBsvm553TnrcLHT/d18syelswmg3SsLux7KbPrhVpF s0mRJUeT+pbA/iqknttnh52rpR7R+e4GJoOUqttOY5Q8oGESL7B8VZNKeqoNRfBp LziSaxPdFmvk3puC9k4yFk3I3BEjAmgnCWZAUkoeoza24fRorBFzTZKHL8IUbwKj sgYMtlfakEQ0D9gSw2CNXf0YIZra68+92oJ9qc15VPJygluYSadKS6pX+Yq3xpf6 VtPzzDD5jUO40/A+kUoNMiMVWRkWHqiqutnCtfIMXphz8rgIF3bK67/sn4UcMAwF MYmZ0uMz4XXZy3C57orDNJx5IRcnSv8m6Pxs1WavAJqDibLGWNyt+5BfQ6XjCq8F w4EWqJGa4+d07TwPET93PuynFY7Ed98Kzg5E5e6MIrX8ZH/b222y/dYy8S24sA5R kIi7bpXL3Vw+AlCm9CRNiX7vpA+wZ86AtCfC3EMKwWoRdF3Tpj77RP7qQbASKSP4 WQ9wtnSpl3qADI298mtJIENhnYNfz00vEvKEjT2QqcTvo6PaSe8zH5HCucOw37dZ pcCSHx7W7/3fHt7lgDYijsNIfM7aTaOg4o9eKzP+vpwdPsR5yMAt6j9rIhIlmsrz shPyzddoB5PiwGIzH8PnEdHY2jG+PHqFeG6Cqjg4oNrRloBn11V+i/Sk6cr5MSvS EraOPYyQC6wExuTlHZ7iVEZr8Izz0tvBf1+rU2o7qebnFqop/Es808y1Mv3ROKnw asm229JAMHf0O7R93EkM8YATD5qb8zv8E+k02QXuGvLWNq+o6i8/ByEUZEKbOtgA vwW5c29GgAaO1vMKfz4shdVat5GRmuB2srNg1iGyi2qLe+eHoztRn+ply6cA4MWk +p8Y7+gOqbbegMXlTodOlqoq2m244B0lqm1xa4Xfjm6JQZR3BG6hRd7nCYk8k3Vi 4jgtfWD7LV4T0dAHmsF5/3wyYoG2EKZQRtFKAHv5ja2qhP0fZQtAP/pWCURm43ml ugdieCKY/QCq4/+yKARDr6yq+53uXA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E2B336983095221B
http://decryptor.cc/E2B336983095221B

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\SyncExport.tiff => \??\c:\users\admin\pictures\SyncExport.tiff.5zkr51gtk	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File renamed	C:\Users\Admin\Pictures\UpdateDismount.raw => \??\c:\users\admin\pictures\UpdateDismount.raw.5zkr51gtk	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File renamed	C:\Users\Admin\Pictures\ConvertToLock.tif => \??\c:\users\admin\pictures\ConvertToLock.tif.5zkr51gtk	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File renamed	C:\Users\Admin\Pictures\FormatSplit.crw => \??\c:\users\admin\pictures\FormatSplit.crw.5zkr51gtk	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File renamed	C:\Users\Admin\Pictures\ReceiveSkip.png => \??\c:\users\admin\pictures\ReceiveSkip.png.5zkr51gtk	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\users\admin\pictures\SyncExport.tiff	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\D:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\E:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\I:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\K:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\N:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\Z:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\F:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\G:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\M:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\W:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\R:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\S:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\T:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\U:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\B:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\H:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\J:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\Q:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\X:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\Y:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\A:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\L:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\P:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened (read-only)	\??\V:	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2l64fv0.bmp"	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\InstallCompare.odt	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\PingGet.vssm	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\RequestDebug.xml	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\ReadUndo.kix	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\SetEnter.mid	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\ShowDisable.docm	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\UnblockDeny.php	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\UnblockReceive.zip	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File created	\??\c:\program files\5zkr51gtk-readme.txt	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File created	\??\c:\program files (x86)\5zkr51gtk-readme.txt	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\EditEnable.temp	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\OutSync.tif	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\CloseMove.vdw	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\ConnectInstall.wmx	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\OutBackup.potm	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\TraceResolve.xla	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\LockRequest.docm	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\RedoTrace.png	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\RequestUndo.vdw	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\StopExport.jpg	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\ConvertReset.zip	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\FormatTest.mp3	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\TestMeasure.mpg	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\UnprotectGet.mpeg3	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\InitializeEnable.jpe	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\MountComplete.vsdx	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\NewDebug.asf	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
File opened for modification	\??\c:\program files\ResetRepair.dotm	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2092	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
2092	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
1004	powershell.exe
1004	powershell.exe
1004	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeBackupPrivilege	944	vssvc.exe
Token: SeRestorePrivilege	944	vssvc.exe
Token: SeAuditPrivilege	944	vssvc.exe
Token: SeTakeOwnershipPrivilege	2092	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1004	2092	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe	74
PID 2092 wrote to memory of 1004	2092	da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe	74

C:\Users\Admin\AppData\Local\Temp\da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe
"C:\Users\Admin\AppData\Local\Temp\da2a3c7f6226de957657318994e7937e1a6fdfcd92b8dd6e2a800406e8a8247a.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1004