sodinokibi | 4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e

General

Target
4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
Size 118KB
Sample220305-vhtdcaaddk
SHA256 4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e
MD5 7a1f0972848cc265748d789b24a877af
SHA1 7337d1bf76994fe7dabc9ef32867c31c21148102
SHA512 9ea38d01a48f4fd17f4fc246bdee542952cca477ed1e21077625d28b856d3d43d8ec83247b21c816c65476e85992fd59b1068e723fabb9f525cbf07f99030c65
MD5 SHA1 SHA512

Score

10^/10

sodinokibi persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\6bcy7w7gnv-readme.txt

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6bcy7w7gnv. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D186C299A8E62097 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D186C299A8E62097 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JkakoXa7A8Cx49XsbchHEHv8fvllKlzhiTUt09BRRdK+MByAHqVQTqf/WxXAhetm QZx38OVp7sDl9op3tqwcbfh571qgmxOGttu9USR0DBbAX1SRfT1L+WTwnECyXCkY te7DHJMUcdkRbKWjhzqKoxAEMLB58LvQoBSz/7HoYUsgIF8OEdiwUt9lBINk2GF9 B7eOAdDgNGJrqIk+8+2p9sstXwmXog2QmlWN0kH8NgHl1ScUx5NtQfw3/1RHbhdL L03UxT1GFXfXMu2l8/XibfTPwWpLpW2csFI8mBlWNXPMh77wCm2mikL7iPAcWcEl YVBJoUUmjzyf8cVJtt4Ihhipk7PbGQ9ICFyyEMiVYtEv85yZ9bw8ZIqS/qgvb2Wu 1/1P9q5GUA1aX2GQgMtdJaVyIT7K6nsZY8yXsWAYRS3aDXUmTWXdlOATnJjnvSrD /Glq94aXlLNLnXDSICvtB274sAQte2QHagRq0e/8aVc/AtS545EaluScnqkckcII hecQaBh18a1oTCkAPjAwUodMKrK5vSrHkG1n3Kx7R4DWQpM53jxUEbt6sV0qwhHe HJvZMzfrUew5CfNxAjRGiS4MR5Kkazn0/5wZF7QXLPDJhDDX2EU8+fNoY2qo50vI rcOSFQXp0rbEEXmcdfMDNfvuUTgyZ6VxVmW61dPCfY1/DXkRmmRvmRaf0CKOcmwn 9LDwrqKAN7t3LFPpgKQ96wQWwiDEX3yXYpdsXJ7i7UFD+D6mpApxhulATzImy2di P0NVK0sMUIrh1jxhu7cQ2TyLG3Ges1hV/btlroj3a/QS93svtmBg3b2CMqLS4rsP e4pI9/JaNKxbrji1GADzaHx77S9AXP5ZUCJx0fKMBjAAY/I3sBYsOMfQzEfl+wZO 6Hzl9JcAF3D+tbrsy27RtJRi+FyboacOYJf6GTPfDIvnTfuEYNKfI6iPvUOdvYUi t8d+bxWoYImHuqOZkCGRs8kA3pjJGFUFBkynwbi+My6HofbtMupZF2F8dc10/jzd I81kNgTYGO6keC3goS5KVx6OhTNJBJK8uYAXLdti/cx+beaC++DPsWsiNpRK6IKq eA8n5ni1FUs6Pnkams6dVP0q9ZJrSzlUfUqDzNGg0bEIBgxBcf/JjGMCXx1qs5La f8qq6SsgW363/IAt2/y81Wby3U/gXw4h1wvZAw5jKk8T6GKFKx/KXL9aUxuRZk53 1nZD98Clit7ooKUIbaD49rmz3eFrJ+lpwZV1LYfxnSFZDWb51a4jV5q+RfWPT7wS EdJfftRMJV0aVAgFbVJr+BYSvSTPkjG6bHHCPQv7bGdYhJ/Ggus= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D186C299A8E62097
http://decryptor.cc/D186C299A8E62097

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\SplitConnect.raw => \??\c:\users\admin\pictures\SplitConnect.raw.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\SyncPing.raw => \??\c:\users\admin\pictures\SyncPing.raw.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\UnlockRevoke.raw => \??\c:\users\admin\pictures\UnlockRevoke.raw.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\users\admin\pictures\ApproveNew.tiff	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\ApproveNew.tiff => \??\c:\users\admin\pictures\ApproveNew.tiff.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\CompleteRead.png => \??\c:\users\admin\pictures\CompleteRead.png.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\GroupUninstall.crw => \??\c:\users\admin\pictures\GroupUninstall.crw.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\ResolvePush.raw => \??\c:\users\admin\pictures\ResolvePush.raw.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\GetSuspend.raw => \??\c:\users\admin\pictures\GetSuspend.raw.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\RestartApprove.crw => \??\c:\users\admin\pictures\RestartApprove.crw.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\SuspendStart.raw => \??\c:\users\admin\pictures\SuspendStart.raw.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File renamed	C:\Users\Admin\Pictures\UnprotectConfirm.raw => \??\c:\users\admin\pictures\UnprotectConfirm.raw.6bcy7w7gnv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pC9JjJxkVH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe"	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\U:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\V:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\F:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\H:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\I:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\N:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\Q:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\G:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\O:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\P:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\T:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\X:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\B:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\E:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\J:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\L:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\M:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\Y:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\Z:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\A:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\K:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\R:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\W:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened (read-only)	\??\D:	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\699jqu7d.bmp"	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\SetSearch.3g2	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\UpdateRepair.sql	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\ConfirmUninstall.3gp2	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\FormatUnblock.otf	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\PublishTest.001	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\SelectMount.xps	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\RenameBlock.csv	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\UnprotectCompare.mhtml	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\DebugConvert.dib	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\DismountBackup.asf	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\LockSplit.m4a	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\MergeUnpublish.txt	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\PublishConnect.dot	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\RevokeSave.scf	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\SaveRequest.TS	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\UndoStep.mp4	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\BlockUnpublish.mp3	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\ConvertFromSelect.wax	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\ResolveCompare.jpg	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
File opened for modification	\??\c:\program files\StartConvertTo.wps	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1868	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
1868	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
1868	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
1868	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
Token: SeTakeOwnershipPrivilege	1868	4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
Token: SeBackupPrivilege	2952	vssvc.exe
Token: SeRestorePrivilege	2952	vssvc.exe
Token: SeAuditPrivilege	2952	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe
"C:\Users\Admin\AppData\Local\Temp\4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868