sodinokibi | 89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce

General

Target

89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
Size

179KB
MD5

dbfbc199086b40dd57c667844aefd9a9
SHA1

22d5bf8051eccff69ffcb3167b939312b9539378
SHA256

89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce
SHA512

363306bca170923bf7a6c47b6531ae7bdc95fde7a4b481635fb55b38298a918757743291a4318b158a389ff36536eb49c3457150d71dce5ee58ead855f62c96e

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\68d82-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 68d82. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/54FEDA1185C95883 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/54FEDA1185C95883 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: /UpTp6lEOfcQ2VEwvzjVgPTePdNz/asvd1QK1r5nBIo9wLPUNt6h4YkGRvnFTl0b Dw2pGbVjWiY1e4urPDi58QEpXCN7CBU8W7NhXJHFGx/5EQm+M18CHCrkCNLx/+ds Z9y/+qw3WDrWZ3zlkofTSxSIrI8fvkNUv90VWaBKCpdtmHaV4/8DkX68EpcVrKty SredrlLBnTOtEko0jSLsPFt+N8lfaEXznndNGhao5Zb6BZ8kLdDmCc2fFRT4frDO HL+E8ua8tsGJnAvaabXJ4lDpKiIBFWMIXpJrr+kBjcOsOTNwyuZZq7rMKw5E9K76 gKtTH5dQT8P1kmiSRnvlQ6yezj+ktE1RFp6QrW9zfCSwGX8J0qDd6e2II0AQ/K/f kdsD7cHmcoqmXxpDB2oFgls4BZuj+Wxe/XjCsla8GbhF//uiomjsFjK6Qsr/wyj9 bNVcyUfoosMwUPMbDj4NEy2RAeo24C1lw1PeM+2tOeCGtf1uIecgECmtDDhcwuuR 5zcYgFoHi7hFpZfjKfSapWZoFcn2vHsq6U1q1pX5flDodBncSUseFjB+gkXqeyrl YWqnPGRxwqRNQR4CV74JTbmW70bKgsKqRe0ksLHYfTvFVbmPwVvtOFsVcoyHmwpG +H4A9Ib+WXwKrmimNCP/oZTu7RvZyzwpNnfJmjUVzKPoQRFW5NhgHD96MlpX7pKw z6g5e4TKzSS91rhAzyF5eBJGQelIKiF97RjSlVW3SaW0KW/4PU+/vz4INLE0vE5R 0gsGQrD7OfBakguncS2JUURWm8yaqw0smA1vQePVOZDcnPVKCERZrVFqY1beBsyY 4XhHaJy++B3DcmfU1OeHvCRC7bOl7naHj5CexuNSXY3KwLdpUbQFiwLPLQpv0cZo O62P2ZfEr1Gz7sEX2fPltOnuksZc1PrpBV9F7ZqPoq0iaDD1Z6tOpuEzt1D6/ITj i243U0DMGK4vluWkNeW62O6/7V4vLjkyzPo65trtbFUmwMF8YMmR2icZhhbWMLsf 6LXH2kVexAL/glAG63rkSkd4O0iBW5I8eyrLsjG9u+RnehSHmCt94UATAVDVpzvr lMWrRAxM5luw5h8XG8f60f9n85e7Yqy/TdQpNJ6bjlQ1p/xc2fw= Extension name: 68d82 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/54FEDA1185C95883

http://decryptor.top/54FEDA1185C95883

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ExpandInstall.png => \??\c:\users\admin\pictures\ExpandInstall.png.68d82	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File renamed	C:\Users\Admin\Pictures\ExpandReceive.raw => \??\c:\users\admin\pictures\ExpandReceive.raw.68d82	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File renamed	C:\Users\Admin\Pictures\UnlockCompress.crw => \??\c:\users\admin\pictures\UnlockCompress.crw.68d82	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File renamed	C:\Users\Admin\Pictures\CompareReset.tif => \??\c:\users\admin\pictures\CompareReset.tif.68d82	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File renamed	C:\Users\Admin\Pictures\DenyRegister.crw => \??\c:\users\admin\pictures\DenyRegister.crw.68d82	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe

description	ioc	process
File opened (read-only)	\??\I:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\Q:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\W:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\X:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\Z:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\E:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\F:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\G:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\M:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\V:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\D:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\A:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\K:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\L:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\P:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\R:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\T:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\U:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\J:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\N:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\O:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\Y:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\B:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\H:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened (read-only)	\??\S:	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe

Drops file in Program Files directory 12 IoCs

Processes:

89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe

description	ioc	process
File opened for modification	\??\c:\program files\StepClear.easmx	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened for modification	\??\c:\program files\CheckpointRestore.3gp	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened for modification	\??\c:\program files\ExitResolve.rtf	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened for modification	\??\c:\program files\InstallSplit.wdp	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened for modification	\??\c:\program files\LimitHide.gif	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened for modification	\??\c:\program files\RenameSave.mp2	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened for modification	\??\c:\program files\WatchSubmit.ppsx	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File created	\??\c:\program files\68d82-readme.txt	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File created	\??\c:\program files (x86)\68d82-readme.txt	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened for modification	\??\c:\program files\DisableComplete.odt	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened for modification	\??\c:\program files\UnprotectMerge.mhtml	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
File opened for modification	\??\c:\program files\UnregisterSet.ps1xml	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1968 vssadmin.exe

pid	process
1968	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe

pid	process
3612	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
3612	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2108 vssvc.exe
Token: SeRestorePrivilege 2108 vssvc.exe
Token: SeAuditPrivilege 2108 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	2108	vssvc.exe
Token: SeRestorePrivilege	2108	vssvc.exe
Token: SeAuditPrivilege	2108	vssvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.execmd.exe

description	pid	process	target process
PID 3612 wrote to memory of 1436	3612	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe	cmd.exe
PID 3612 wrote to memory of 1436	3612	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe	cmd.exe
PID 3612 wrote to memory of 1436	3612	89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe	cmd.exe
PID 1436 wrote to memory of 1968	1436	cmd.exe	vssadmin.exe
PID 1436 wrote to memory of 1968	1436	cmd.exe	vssadmin.exe
PID 1436 wrote to memory of 1968	1436	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe
"C:\Users\Admin\AppData\Local\Temp\89a2ea9628e0c31ad5d0abe764b8390b70cf4dbe5cdf198c4cd08efa3adad8ce.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
2⤵
- Suspicious use of WriteProcessMemory
PID:1436