sodinokibi | fb54b4b9b9423886ae47dbf9309a5023f3094215adb1538f8b3d2184fbf6e5ad

General

Target

DHL __.pdf(4).exe
Size

555KB
MD5

e042695a3bafed9b991e345edb2446e3
SHA1

6e60f589c42b4521612f5fc43e3825fd8e3f33d9
SHA256

2fa8aa9c02c122e490aeee9dc0acce1fe7f3a74207cfd2e384ebfcaa56ed1cbc
SHA512

fe8e1ff84dc4596bfb038a2d5777e247b8999926ea09118e50eed5bb79d931943ee54658443dd2bd18bc751a2f78356fa585c1231fb3cc91e365f8c9ede568fc

Score

10^/10

sodinokibi 30 97 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

30

Campaign

97

C2

sytzedevries.com

druktemakersheerenveen.nl

energosbit-rp.ru

business-basic.de

acibademmobil.com.tr

leansupremegarcinia.net

worldproskitour.com

shortsalemap.com

pansionatblago.ru

humanviruses.org

ya-elka.ru

block-optic.com

silkeight.com

carmel-york.com

unexplored.gr

hotjapaneselesbian.com

forextimes.ru

avisioninthedesert.com

agenceassemble.fr

keyboardjournal.com

Attributes

net
true
pid
30
prc
mysqld_nt.exe
dbsnmp.exe
ocssd.exe
sqlwriter.exe
winword.exe
oracle.exe
thunderbird.exe
mysqld_opt.exe
agntsvc.exe
excel.exe
ocautoupds.exe
encsvc.exe
infopath.exe
mspub.exe
msaccess.exe
steam.exe
sqlservr.exe
dbeng50.exe
sqlbrowser.exe
onenote.exe
firefoxconfig.exe
mydesktopqos.exe
thebat64.exe
xfssvccon.exe
synctime.exe
ocomm.exe
powerpnt.exe
tbirdconfig.exe
sqbcoreservice.exe
mysqld.exe
visio.exe
wordpad.exe
mydesktopservice.exe
isqlplussvc.exe
sqlagent.exe
thebat.exe
outlook.exe
msftesql.exe
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
97

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

POWERPNT.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

964 POWERPNT.EXE

pid	process
964	POWERPNT.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

POWERPNT.EXE

description	pid	process	target process
PID 964 wrote to memory of 2044	964	POWERPNT.EXE	splwow64.exe
PID 964 wrote to memory of 2044	964	POWERPNT.EXE	splwow64.exe
PID 964 wrote to memory of 2044	964	POWERPNT.EXE	splwow64.exe
PID 964 wrote to memory of 2044	964	POWERPNT.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\DHL __.pdf(4).exe
"C:\Users\Admin\AppData\Local\Temp\DHL __.pdf(4).exe"
1⤵
PID:1520

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\UnlockSuspend.pot"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-58-0x00000000743D1000-0x00000000743D5000-memory.dmp

Filesize
16KB

Download
memory/964-59-0x00000000715E1000-0x00000000715E3000-memory.dmp

Filesize
8KB

Download
memory/964-60-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/964-63-0x00000000725CD000-0x00000000725D8000-memory.dmp

Filesize
44KB

Download
memory/964-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1520-54-0x0000000000640000-0x000000000065C000-memory.dmp

Filesize
112KB

Download
memory/1520-55-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/1520-56-0x0000000000640000-0x000000000065C000-memory.dmp

Filesize
112KB

Download
memory/1520-57-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2044-61-0x0000000000000000-mapping.dmp

Download
memory/2044-64-0x000007FEFBDC1000-0x000007FEFBDC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing