sodinokibi | 16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193

General

Target

16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193.dll
Size

119KB
MD5

98b6a07962de11c389e8f420eb4f0fe4
SHA1

ab9c70eff25fb0cc189d4950809822aaa05f7b86
SHA256

16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193
SHA512

950c5728b11295c86a0d3ca6cd8716175d28c9cf6affc340acfaef477dc24b52c51a649bf556d998ace6ae395c9e1f2ab732bff6e49f0aa97fcaad349866ab50

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\94kpkghj09-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 94kpkghj09. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4F22F43A57C5D56D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/4F22F43A57C5D56D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 18RlXGFvpR4DaHBKPnGOZ/PFvpbP/hIQ6ku000reXXdX8Lx6rAnYf2ZUjr5BsRYp 3gC0OkTem+ae30sy4kw8cL0Cf1tpA88L3l1DOZ0q/ZUbE8OuHwjHJMRi/Il+0FkO 8krRWd+S2QltBpLwyzmtqhH8pjpmqUscWiJjzbX79cIfZ5ZrmhZKjfrPBBYfOJ1U NSOV/NCRSSPS8F/Nrn4cRYLSc5Yl/cay3XvFKOYD1y0gs0FsGBWNCr0v3w8LGcd8 MJwdWF8ar1QrFpSPoPoMy2yAuQJLSDDeRx5ZpQsgOjvGtm/COqM4VJ34WQpE7fBI Amfk1XkbPLrb+FpW+Pw4ibeVOapm1ggRpZ2H0qkBpRgM/TA0a22HssYLQd8OblRA rDkfNMzmAQEp0hVnKGbYfBUMi2LYFtBL97Jd32hRr23j0reuO1hc3MNXZJ6SIBUC tqfTB/P0PzF2yc6A8t3YZzacpTt+gDsvwqR92X5MEtMrieO+F5LsHsJsLgnU0zqF RPK4ml61xrrWjsEuTGEXn6gqfRkUkTys3O+zJH9BPH2PTDqC0kNhkclyrjvDX8/k pZaObIEEf7jAysy9vqeQhsYZXCuXImeqISFrx8U8fbm2eVwIEG6fGHLVkh6PlUN2 ZHjTcOnAwjzvqu5zJlPN32l/09fEdHtkIYWs0bf4/jDfP6JNSFs9iWvUezDSt+ML TUI5UItEi0N032mPsEn9iRHYgwDtF1frDy91ejGZ2ZtdZLbSKpw6ANa3Bfds93Tv CkaqNdXvUoL2+FRZXULiKQ0MZ0kwiCXgl8hbk0sX3k3+TECzhq/OZottrxspQkWW fuPRkG/v4yAx21x7s7TmNf7mLn7yLVXHA2s4ZxRAD80u7NoFFnikEd1RuIVG25ZG Fpm+RCi6vL52GwPZDxb+L9qRNGflBvXoZX8Z5byjy/AUsVUaSpkFcj/aTz919W7v +fZlUINIhVbXMZe5dQRmOtLHwVlzgLr059zjBpCm/ml8QRcTqptRdPER/kvGGgD6 z55+qEgLr3jSZPoWfIL/fcXiqIzA6qkPGi1isAkFJfCU+Shn80WnD2bKlWSACf1L zr5b3wYFtpEYcJrh3jwjn+TK+EmIlf4UY6QCVi5gUj1dy4L0Qb82c4ojYmdZsHms XMKNrw27m2ZIRg8R/ao72pbp74Ot0dI+lbNTIqML8hULoGergOJE6vcV1G5OnrXH P7MsAnuncHCNCoJ4YCpe0FlagUDNX6Q/T15sTPJER/xWUHmLlolT/FBXaD4WqJlT 3NT6Hr1wyuMhcJ5eoaE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4F22F43A57C5D56D

http://decoder.re/4F22F43A57C5D56D

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regsvr32.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConfirmSwitch.raw => \??\c:\users\admin\pictures\ConfirmSwitch.raw.94kpkghj09	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\DebugTrace.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\PingDismount.raw => \??\c:\users\admin\pictures\PingDismount.raw.94kpkghj09	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ResumeSet.crw => \??\c:\users\admin\pictures\ResumeSet.crw.94kpkghj09	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ConfirmDebug.raw => \??\c:\users\admin\pictures\ConfirmDebug.raw.94kpkghj09	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\CopyUndo.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\CopyUndo.tiff => \??\c:\users\admin\pictures\CopyUndo.tiff.94kpkghj09	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\DebugTrace.tiff => \??\c:\users\admin\pictures\DebugTrace.tiff.94kpkghj09	regsvr32.exe
File opened for modification	\??\c:\users\admin\pictures\UnregisterRestore.tiff	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\UnregisterRestore.tiff => \??\c:\users\admin\pictures\UnregisterRestore.tiff.94kpkghj09	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\CheckpointPublish.tif => \??\c:\users\admin\pictures\CheckpointPublish.tif.94kpkghj09	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
File opened (read-only)	\??\B:	regsvr32.exe
File opened (read-only)	\??\L:	regsvr32.exe
File opened (read-only)	\??\M:	regsvr32.exe
File opened (read-only)	\??\W:	regsvr32.exe
File opened (read-only)	\??\E:	regsvr32.exe
File opened (read-only)	\??\I:	regsvr32.exe
File opened (read-only)	\??\K:	regsvr32.exe
File opened (read-only)	\??\N:	regsvr32.exe
File opened (read-only)	\??\O:	regsvr32.exe
File opened (read-only)	\??\P:	regsvr32.exe
File opened (read-only)	\??\Q:	regsvr32.exe
File opened (read-only)	\??\S:	regsvr32.exe
File opened (read-only)	\??\D:	regsvr32.exe
File opened (read-only)	\??\A:	regsvr32.exe
File opened (read-only)	\??\H:	regsvr32.exe
File opened (read-only)	\??\J:	regsvr32.exe
File opened (read-only)	\??\X:	regsvr32.exe
File opened (read-only)	\??\Z:	regsvr32.exe
File opened (read-only)	\??\F:	regsvr32.exe
File opened (read-only)	\??\G:	regsvr32.exe
File opened (read-only)	\??\R:	regsvr32.exe
File opened (read-only)	\??\T:	regsvr32.exe
File opened (read-only)	\??\U:	regsvr32.exe
File opened (read-only)	\??\V:	regsvr32.exe
File opened (read-only)	\??\Y:	regsvr32.exe

Drops file in Program Files directory 36 IoCs

Processes:

regsvr32.exe

description	ioc	process
File opened for modification	\??\c:\program files\AssertOptimize.rmi	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertProtect.fon	regsvr32.exe
File opened for modification	\??\c:\program files\FindMount.fon	regsvr32.exe
File opened for modification	\??\c:\program files\MountInvoke.jtx	regsvr32.exe
File opened for modification	\??\c:\program files\ResetRedo.rtf	regsvr32.exe
File opened for modification	\??\c:\program files\UnblockApprove.xla	regsvr32.exe
File opened for modification	\??\c:\program files\DebugMove.avi	regsvr32.exe
File opened for modification	\??\c:\program files\InvokeStep.jpeg	regsvr32.exe
File opened for modification	\??\c:\program files\LimitGrant.vbs	regsvr32.exe
File opened for modification	\??\c:\program files\OutGrant.i64	regsvr32.exe
File created	\??\c:\program files\94kpkghj09-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\ReceiveRegister.M2TS	regsvr32.exe
File opened for modification	\??\c:\program files\RestoreNew.aif	regsvr32.exe
File opened for modification	\??\c:\program files\RevokeProtect.dxf	regsvr32.exe
File opened for modification	\??\c:\program files\SetInstall.dxf	regsvr32.exe
File opened for modification	\??\c:\program files\SuspendBlock.ods	regsvr32.exe
File opened for modification	\??\c:\program files\EnablePing.ex_	regsvr32.exe
File opened for modification	\??\c:\program files\ExitRestart.odp	regsvr32.exe
File opened for modification	\??\c:\program files\AddDisconnect.midi	regsvr32.exe
File opened for modification	\??\c:\program files\InitializeConvert.3gpp	regsvr32.exe
File opened for modification	\??\c:\program files\LockDisable.dot	regsvr32.exe
File opened for modification	\??\c:\program files\RenameConvertTo.pot	regsvr32.exe
File opened for modification	\??\c:\program files\ExpandCheckpoint.xml	regsvr32.exe
File opened for modification	\??\c:\program files\MeasureMerge.ex_	regsvr32.exe
File opened for modification	\??\c:\program files\OptimizeMeasure.m1v	regsvr32.exe
File opened for modification	\??\c:\program files\ReadSkip.mid	regsvr32.exe
File opened for modification	\??\c:\program files\StepResolve.scf	regsvr32.exe
File opened for modification	\??\c:\program files\UnregisterClear.potm	regsvr32.exe
File opened for modification	\??\c:\program files\ConvertToExpand.raw	regsvr32.exe
File opened for modification	\??\c:\program files\ExportConnect.asf	regsvr32.exe
File opened for modification	\??\c:\program files\SkipEnable.fon	regsvr32.exe
File opened for modification	\??\c:\program files\WatchEnable.TTS	regsvr32.exe
File created	\??\c:\program files (x86)\94kpkghj09-readme.txt	regsvr32.exe
File opened for modification	\??\c:\program files\ConnectUnlock.xht	regsvr32.exe
File opened for modification	\??\c:\program files\ExpandRestart.avi	regsvr32.exe
File opened for modification	\??\c:\program files\TraceSet.3gp2	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exe

pid process

3064 regsvr32.exe
3064 regsvr32.exe
3064 regsvr32.exe
3064 regsvr32.exe

pid	process
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

regsvr32.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3064	regsvr32.exe
Token: SeTakeOwnershipPrivilege	3064	regsvr32.exe
Token: SeBackupPrivilege	604	vssvc.exe
Token: SeRestorePrivilege	604	vssvc.exe
Token: SeAuditPrivilege	604	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2692 wrote to memory of 3064	2692	regsvr32.exe	regsvr32.exe
PID 2692 wrote to memory of 3064	2692	regsvr32.exe	regsvr32.exe
PID 2692 wrote to memory of 3064	2692	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\16afea7cb64bcbf0a8a8da5e67120dec851068d421caa79ac197c804a2e9c193.dll
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads