sodinokibi | b5e73c65a92abd6d8ea6040739e6b71a207035f1517f3813c56fbac937b8ff06

General

Target
PORT.exe
Size 164KB
Sample220708-lcf2dsdcb3
SHA256 b5e73c65a92abd6d8ea6040739e6b71a207035f1517f3813c56fbac937b8ff06
MD5 6268478bf01dc3eacfa23372ca8b59fa
SHA1 f497026449bef302c235a1749ede57e7a077e159
SHA512 94ed316419f5350a845f4a988cf7b74703486fab2ba7ad0652f7280370915d8685d44447a59e8fe1f133d3923a1e929a96fe659a1b69202aae619193048345e6
MD5 SHA1 SHA512

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\583h7239-readme.txt

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 583h7239. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9DBBAA9023E7FBEC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9DBBAA9023E7FBEC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: z14zNYkfxYbM+CiPVci+rf60SGy4hlsKHtmoFozJ5FoqUQoTuvYbBQ1SWWJwRNgJ 0CAmCeVM3Fi18mH8lPseJG3wgQPDb9t0SoJLgVqa9Y1rJIsjkZnd4okz9EjCjo20 CELkw5khinwKNgAxTj5ZBygLQx0HbR9NekM4hjFXKj7lAtk3yCqDaiqhqdHFZLTx DJyJxjrRVMo+q/BN1z+KhFvH2JXEof0hKU94OgPhAu1lCR1q1fBJxTj0XsDPHDuU zUsoCs/TzInqxMHCvCUQJzAG7VtuK/ehoYop9xSeLUW/899RdRMklVjfrEcH40Ow Mjby4+xLfZum8ir11jfxq1coK6zCD2ZFuIw09aYMKRlZoMUlQ9LFOixbGxzmczs5 xJqKgYBbH2rtB4C2/J+gTkWjAUPX9BmfFviRMN8gl27zojr74b42KZqlMmh6p/+U hwCYj7Tw1jXXMdaIg2BMslQQPkhdGax5Z1xDEUNs2sjkOCtZENDOH//A7KMwD3jS xgiSpiGgHPzuRmpr+GcDR6Mj5A0SQO2P5XPkEhj3wiHQ9GIuWAUNjp04fG4XLqJ6 FKIP6Abh3Os7yvFGki73RVIk9T4ahYknSZLoNFEIpYi3ker+lk2JQcPouT2dYT/p I+4gDbpTAS1DO2K0yXeWPRVnz7f5ob1MIO9oCoUzGGFFDFbJ66znUbO97kSO2pEL Y+NR9CysVF1jVUHIkH2gRPTlrSSzaNTCNll3QnYt49YWG9z5QuTXCD4xx+9l9KL+ Aycs49UPNongLygFMq28MgXrue979SxvsOYWuQQKO1DZAL5v56B49DoY4h0z4y4K MnZFJstUypwmUAtHkwr7X+/vL3v/7v+ZgLR+/784faEwKtJzhMeqkdC0g9ZyU4ux sZ/sM6gHskqZcKulrCNNrAKwqIYTTkTz6KD6iCbKoZa5R08pJ90q/Bx8PI4Qr0Fb 0sKHPPGtetzyA/DwmhD+w8SWuvqxmguWpIQsnjl7kNG52rWxdYw3OuIsxTF/+WRm b1Haky8YGyD/HZitIaQTJPDozzqhUOFe0B5rEyjt973VuTJAXIOE/yw+VbWCucoV XrnDXCoyl6J3ItyaYNWlcZRzVc3zb0aJa2CAlTnKmsT4Uvdqns6wJn99UsFWxi70 t/jxZE6+P+LZbTyjJvw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9DBBAA9023E7FBEC
http://decryptor.top/9DBBAA9023E7FBEC

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\UnblockRead.raw => \??\c:\users\admin\pictures\UnblockRead.raw.583h7239	PORT.exe
File renamed	C:\Users\Admin\Pictures\StepExpand.raw => \??\c:\users\admin\pictures\StepExpand.raw.583h7239	PORT.exe
File opened for modification	\??\c:\users\admin\pictures\GrantPush.tiff	PORT.exe
File renamed	C:\Users\Admin\Pictures\ExitMeasure.crw => \??\c:\users\admin\pictures\ExitMeasure.crw.583h7239	PORT.exe
File renamed	C:\Users\Admin\Pictures\GrantPush.tiff => \??\c:\users\admin\pictures\GrantPush.tiff.583h7239	PORT.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	PORT.exe
File opened (read-only)	\??\O:	PORT.exe
File opened (read-only)	\??\Q:	PORT.exe
File opened (read-only)	\??\R:	PORT.exe
File opened (read-only)	\??\A:	PORT.exe
File opened (read-only)	\??\E:	PORT.exe
File opened (read-only)	\??\I:	PORT.exe
File opened (read-only)	\??\N:	PORT.exe
File opened (read-only)	\??\M:	PORT.exe
File opened (read-only)	\??\V:	PORT.exe
File opened (read-only)	\??\X:	PORT.exe
File opened (read-only)	\??\D:	PORT.exe
File opened (read-only)	\??\H:	PORT.exe
File opened (read-only)	\??\L:	PORT.exe
File opened (read-only)	\??\J:	PORT.exe
File opened (read-only)	\??\K:	PORT.exe
File opened (read-only)	\??\P:	PORT.exe
File opened (read-only)	\??\S:	PORT.exe
File opened (read-only)	\??\T:	PORT.exe
File opened (read-only)	\??\U:	PORT.exe
File opened (read-only)	\??\B:	PORT.exe
File opened (read-only)	\??\G:	PORT.exe
File opened (read-only)	\??\Z:	PORT.exe
File opened (read-only)	\??\W:	PORT.exe
File opened (read-only)	\??\Y:	PORT.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ko7r5o593.bmp"	PORT.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\StepStop.mp3	PORT.exe
File opened for modification	\??\c:\program files\UnprotectInitialize.vdw	PORT.exe
File opened for modification	\??\c:\program files\WaitImport.pub	PORT.exe
File opened for modification	\??\c:\program files\OutFormat.asp	PORT.exe
File opened for modification	\??\c:\program files\RenameWait.wav	PORT.exe
File created	\??\c:\program files\583h7239-readme.txt	PORT.exe
File opened for modification	\??\c:\program files\CompleteExport.pot	PORT.exe
File opened for modification	\??\c:\program files\CopyWait.mp2v	PORT.exe
File opened for modification	\??\c:\program files\PublishWait.mpeg3	PORT.exe
File opened for modification	\??\c:\program files\ReceivePing.easmx	PORT.exe
File created	\??\c:\program files (x86)\583h7239-readme.txt	PORT.exe
File opened for modification	\??\c:\program files\ImportFormat.iso	PORT.exe
File opened for modification	\??\c:\program files\InitializeSwitch.7z	PORT.exe
File opened for modification	\??\c:\program files\ResizeUnregister.ex_	PORT.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
988	PORT.exe
988	PORT.exe
2976	powershell.exe
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	PORT.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeBackupPrivilege	5016	vssvc.exe
Token: SeRestorePrivilege	5016	vssvc.exe
Token: SeAuditPrivilege	5016	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 2976	988	PORT.exe	81
PID 988 wrote to memory of 2976	988	PORT.exe	81

C:\Users\Admin\AppData\Local\Temp\PORT.exe
"C:\Users\Admin\AppData\Local\Temp\PORT.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976