sodinokibi | 2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec

General

Target
2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
Size 181KB
Sample220511-tegdyacce9
SHA256 2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec
MD5 a80bcbe62fd8d070796a757e3ca2a21b
SHA1 d9edd7a50a0e94cf764c7c5d77361e83cb62ccac
SHA512 24860da84806129fe6c49814aa9264221a33af384d3766efcb7ffb15452353ee12cf93a38a4f0afb537965b9a042363317df257dc26a88d41b1d65ec1d1c96c5
MD5 SHA1 SHA512

Score

10^/10

sodinokibi persistence ransomware

Malware Config

Extracted

Path

C:\46g19e-readme.txt

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 46g19e. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C1FDB45F37B735D5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C1FDB45F37B735D5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: r4XaFFXQjgJGSG7mg2svEedaJhWo+2rPXr2suPhs8Gu44Pz6iQy38inTNkHLadCn U6KXzz2hbBg+fZjyNb6Dde2RAm2QSdNgecT4WjztnhgP+Koxi3RnR6HHE7pW4sdn miOZ2Xy79VAQbDwequS5qIAooquNNrLWiwMiUKOQTZwBvaLFSIAVy0anOzJ5rw/O NIc5qUGaOSBSDzMvnPc1efcBWmCC1CES3/0DxMx3hZwp/uzePEBpogmXPkBzgebU Pn+AkGMAooDrxLW6kpBBLl60vNXs9tu5oVIcwmrxm2wvAiXt8ykx/I6S0O4XccxV qK5dtTjLnkbyXAT0ypu9l+i0MOA1n654fKPTPI3Ifyta8IcMgCPyCvkJnmMnJnjG j5XWLrstZ+a1/StmrIp2ljeoaDAryRZSxKFopjcDtTRH+ahRtwThcQAWSE2BOuJf kNTVwQm/T0aA8BkagKi2CNXngvxdYuRChjCoaKo1OJ6of3x6ixYvgp9MPS7j9SZH tusHtNty1Z2lsUkmoJhW8cgmzHH5ajj5pvLn8U2hegWSiVaVN2548PbdQmMyVF9N 5ZnOO7h8lWoVUEAzKUU8PggL6PQ0Ayb04Iijs7e0ZlrLHOhGbwI3gonuVpl++B2Y iTUOBFgvjLY2JaU0NuZOeQ0JRNJk98Re/r3Z1lFq/7qCM7Peb9llNx9FCg8u+QJi Ia6DSMX5b2UJlbfmKRIPXaBujgefFT3Hf2YAnIhXu9adqCOLDv/LlyhElzZ2i66r +WO9grQKF95kHUtQUaL7mOnbX4/2LzTX+uMDe0RZQkOD5gczSFcABfZEYY1Nr8fQ hbr6K9UU8IFlUi5siWNcQ1TAuR006MzwLBepQOmFbGCAFM6HqMHpxHJ5tjClqSJS d9WsqmBStAuNamSC5151UvIslBq43AqpGvH06MRNzyOaBgD+ZTu+GW4dSUiK+Won 9EjMxjZ85d6lxKbpk035W33zx4nYK1aVJnO53nJ2cO//mfSBn4xXOBVbAu/ehHnB 5nwYK9gr5tYg2P6yT7rKpm8Rx5gmloSRD+9RNVaUk3PcnUGgs2vyglgK9jws6cNT 8S5+gonTUYzjzEAFzQ/Fd7M/VFNaTTHfZi9g4TZ5tQaG9pt0ry4ig0DzN3Bfy5Zg OM49FGpTZ378xQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C1FDB45F37B735D5
http://decryptor.cc/C1FDB45F37B735D5

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ProtectCheckpoint.tiff => \??\c:\users\admin\pictures\ProtectCheckpoint.tiff.46g19e	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File renamed	C:\Users\Admin\Pictures\SplitHide.raw => \??\c:\users\admin\pictures\SplitHide.raw.46g19e	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File renamed	C:\Users\Admin\Pictures\StepResolve.raw => \??\c:\users\admin\pictures\StepResolve.raw.46g19e	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File renamed	C:\Users\Admin\Pictures\UnprotectInvoke.tif => \??\c:\users\admin\pictures\UnprotectInvoke.tif.46g19e	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File renamed	C:\Users\Admin\Pictures\EnterSelect.crw => \??\c:\users\admin\pictures\EnterSelect.crw.46g19e	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\users\admin\pictures\LockUninstall.tiff	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File renamed	C:\Users\Admin\Pictures\LockUninstall.tiff => \??\c:\users\admin\pictures\LockUninstall.tiff.46g19e	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\users\admin\pictures\ProtectCheckpoint.tiff	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\i7bumVGoL5 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe"	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\A:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\B:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\G:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\L:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\P:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\U:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\D:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\E:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\F:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\J:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\K:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\O:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\Y:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\Z:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\I:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\M:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\R:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\V:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\X:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\H:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\N:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\Q:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\T:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened (read-only)	\??\W:	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\CompareResume.xlt	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\LimitMerge.WTV	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\MeasureEnable.gif	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\OpenShow.docx	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\SendExpand.xsl	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\SplitRestart.7z	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\SuspendSearch.WTV	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File created	\??\c:\program files (x86)\46g19e-readme.txt	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\ConnectPing.ods	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\ImportUnpublish.reg	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\InitializeUnpublish.ini	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\CloseDisconnect.midi	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\PublishImport.tiff	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\PushUnpublish.vsx	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\ResolveCompress.xlsb	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\SuspendBlock.edrwx	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\UnlockExpand.nfo	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\DisableSync.3gp2	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\CompleteMeasure.potx	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\HideWait.M2T	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\LockUnpublish.wm	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\NewMeasure.vst	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\RedoUse.xlsx	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\RevokeDisable.ADTS	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File opened for modification	\??\c:\program files\UseOpen.rar	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
File created	\??\c:\program files\46g19e-readme.txt	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5052	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
5052	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
2876	powershell.exe
2876	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeBackupPrivilege	4648	vssvc.exe
Token: SeRestorePrivilege	4648	vssvc.exe
Token: SeAuditPrivilege	4648	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 2876	5052	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe	82
PID 5052 wrote to memory of 2876	5052	2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe	82

C:\Users\Admin\AppData\Local\Temp\2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe
"C:\Users\Admin\AppData\Local\Temp\2bad63edfca3e163691110868bfafe4c2fea3ee72f5dc520bee5d4401cec3cec.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876