sodinokibi | 0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f

General

Target
0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
Size 164KB
Sample220531-cat1ssafd9
SHA256 0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f
MD5 bcfdf8b5efd11e3f338154e0dc9a1940
SHA1 8d4fbdf12c294f3ad1413ddbc44cae843b596ecc
SHA512 1dc9c31ff13f4bcd6c822b6bea178ea1fca037958a53923f7ea7c07f3619f86aa323dfb48245ce0d6dde919d47907b1432cb01e3cf44a058254b7df6fbcb3c09
MD5 SHA1 SHA512

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\utv3t26385-readme.txt

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension utv3t26385. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A1A2E77C835AD26C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/A1A2E77C835AD26C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dHGa9cZaSjLz/ieq/ZsL2OA+tEyburOi7O05d+tp2Llkwopo4s2ZWfKxf2WQYX3S NqFfIU46yLpMb4Uv5/QYWcutR/PoZqzpqNCYPAmKNLRRB6PhR1QSW/iVU7DL2WWc Fu3aZaRhiShDWUrW+fhn1Gx0AuT0GXEKuC2vFJGg6ugynccAx2+SEHsHXBvUO1W8 ic3jTRKlDP/g9G3NWOQivnS5dOSHjTb6+glXozbGp1vPMty9EPcHwLlOjazSbRJp qHbtZWBngyi1m5xDmEZkEKf+T+RvjOLfqZSUJqTqh3DUhwA2hbK1V+y653JO8yYG 3kecaLGLhYgejXoC+DCD6tt1Z14cr84wW8/4hAJwxpgNO6lfuPPJumn6IkHLgeFY Cx65/nxOoJTt8ks4YA8Y3BsNvGDLVuzpDbVbLZGiBrremGmAXu4vHxkxvnsDlsjv Kgm0Sp1gsYl/pCBTlfO3d7DhF99OwkOPnDtx2lYMmjwDbrGYb2KVN9x9TdgEJKQV IXdC0Zr4Hvx4GT7QBF2I21pOdnIbcF672pGIMMG6b9aiCyjSG9Wle1dbAlh2B+bY rWczsbJNjx3Ch87eRyME8762idcaavEpZq1s7EjTKpeX6clJaVLTPxdTkLh6Zg58 PhLkSING3elsaLYTA1TybTCRKnlOylVmbsORw7XyTkqlNkt9Vm3tR4iFe5oRZL1Y yCM0oEvWOsj/ghS3VXkx1XcmKPrVt62j2XWdDzhrfHg82NElFmw5YWdEoIuLpdKE SG0B5RBbGse+6leXZN+ip0gCxsiYqnHQdQfOh/DA1oxizn3GdW6B6kl3zmAbDG1m WQvIn9TCkeb+YVGxK0i8A3h1eAD5cHNHF4OaIOMPldQWBSEyW0hlGDOYG6jgTPqp sf8D03lkyQlvxx0Df0aQXJbNbVQ3W1jjzw3iJx0P1t1/J7cewAIJdy9PVJToie8f Gjh8JBXwubEUxEA0+coUfbVjBPqV92AanVPJxjUAjhUfVZhl0Si9xzR9BSosn33+ hMhRYFdJunzFcfuhBTeXjrdz3o6tGsVqUVmv74x4ac+HcBoAzJ78vQ/Etn49khsE K66ZG9WrzWEKH95h4BduGDbUcQ6yrexo4R6ZAVjAZjzyNXapvFFHygkmmtugFFNG qYuBpyj4zkiuIdDKqUipwqhg Extension name: utv3t26385 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A1A2E77C835AD26C
http://decryptor.top/A1A2E77C835AD26C

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	\??\c:\users\admin\pictures\SendSuspend.tiff	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\users\admin\pictures\StartCompare.tiff	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File renamed	C:\Users\Admin\Pictures\CheckpointExport.tif => \??\c:\users\admin\pictures\CheckpointExport.tif.utv3t26385	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File renamed	C:\Users\Admin\Pictures\EditStart.tif => \??\c:\users\admin\pictures\EditStart.tif.utv3t26385	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File renamed	C:\Users\Admin\Pictures\SendSuspend.tiff => \??\c:\users\admin\pictures\SendSuspend.tiff.utv3t26385	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File renamed	C:\Users\Admin\Pictures\UseRequest.tiff => \??\c:\users\admin\pictures\UseRequest.tiff.utv3t26385	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\users\admin\pictures\UseRequest.tiff	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File renamed	C:\Users\Admin\Pictures\InvokeProtect.png => \??\c:\users\admin\pictures\InvokeProtect.png.utv3t26385	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File renamed	C:\Users\Admin\Pictures\SelectSwitch.png => \??\c:\users\admin\pictures\SelectSwitch.png.utv3t26385	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File renamed	C:\Users\Admin\Pictures\StartCompare.tiff => \??\c:\users\admin\pictures\StartCompare.tiff.utv3t26385	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\F:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\I:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\K:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\L:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\M:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\Q:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\S:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\U:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\X:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\A:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\B:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\H:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\N:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\R:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\W:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\P:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\Y:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\D:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\E:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\G:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\J:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\O:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\V:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened (read-only)	\??\Z:	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\56l5ww0.bmp"	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\GetSearch.wmv	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\RedoWait.html	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\MoveDisable.3gpp	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ReadRestart.wps	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\SendStep.aiff	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\UnprotectFind.jpg	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\CheckpointFind.dot	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ClearExpand.3gpp	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ReceivePop.3gp2	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\DismountSearch.gif	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\LockSearch.m1v	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\SubmitSuspend.dib	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File created	\??\c:\program files\utv3t26385-readme.txt	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ResumeMeasure.m1v	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\StartMeasure.m1v	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\UndoUnblock.otf	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\RedoSync.xml	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ResetLock.asf	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\UnblockUnlock.ps1xml	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File created	\??\c:\program files (x86)\utv3t26385-readme.txt	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\CloseExit.mp3	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ConnectBlock.3gp	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ConvertConfirm.dwfx	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\OptimizeResize.txt	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ReadCompare.rle	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ConfirmSet.mov	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\InitializeJoin.mp3	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
File opened for modification	\??\c:\program files\ResetInitialize.M2V	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4376	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
4376	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
1808	powershell.exe
1808	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeBackupPrivilege	848	vssvc.exe
Token: SeRestorePrivilege	848	vssvc.exe
Token: SeAuditPrivilege	848	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1808	4376	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe	80
PID 4376 wrote to memory of 1808	4376	0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe	80

C:\Users\Admin\AppData\Local\Temp\0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe
"C:\Users\Admin\AppData\Local\Temp\0770a8217ee25842f8366a121e7f12416a493f8bf7f4219c1ae1c16fdf393a0f.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1808