sodinokibi | b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355

General

Target

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe
Size

2.2MB
MD5

d57b968e46117db2f28f660090056cbd
SHA1

91408887001f38abd455efafd7fcee127e76c074
SHA256

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355
SHA512

dda24c65f1aa301818b76cbdfcf5f7fe6b0b3f846623aa8611f49487d342796cd89a162849c8ebb47834a8c77b361fada6641c8f12bb1c090b48a98b387793d7
SSDEEP

49152:pQOZDV/xW2GlEVJu1u2F00bq1olF9BbP5Fp:pZDRxwJ1ji0+yTx

Score

10^/10

sodinokibi $2a$10$9jz5ifrh1v0vhyo02j4h8ogobfa6j48rvgp/ffuyumddpjdwgkqxi 6858 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$9jZ5Ifrh1v0vhyO02j4H8OGoBFa6j48RvGp/FfUyUmDdPJdWGKqXi

Campaign

6858

Decoy

dubnew.com

danielblum.info

groupe-cets.com

simoneblum.de

slimani.net

oncarrot.com

live-con-arte.de

allentownpapershow.com

hashkasolutindo.com

withahmed.com

qualitus.com

zenderthelender.com

ceid.info.tr

strandcampingdoonbeg.com

bradynursery.com

365questions.org

bouldercafe-wuppertal.de

charlottepoudroux-photographie.fr

pay4essays.net

aminaboutique247.com

Attributes

net
false
pid
$2a$10$9jZ5Ifrh1v0vhyO02j4H8OGoBFa6j48RvGp/FfUyUmDdPJdWGKqXi
prc
sql
winword
mspub
sqbcoreservice
mydesktopservice
visio
ocomm
dbsnmp
powerpnt
msaccess
thunderbird
dbeng50
oracle
tbirdconfig
xfssvccon
outlook
encsvc
mydesktopqos
ocssd
agntsvc
onenote
infopath
thebat
steam
firefox
excel
isqlplussvc
wordpad
ocautoupds
synctime
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
6858
svc
vss
veeam
svc$
backup
memtas
sophos
mepocs
sql

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

1056 vbc.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1180 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe

pid process

940 b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe

description pid process target process

PID 940 set thread context of 1056 940 b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1056	vbc.exe

pid	process
1180	cmd.exe

pid	process
940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe

description	pid	process	target process
PID 940 set thread context of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.execmd.exe

description	pid	process	target process
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1056	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 940 wrote to memory of 1180	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	cmd.exe
PID 940 wrote to memory of 1180	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	cmd.exe
PID 940 wrote to memory of 1180	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	cmd.exe
PID 940 wrote to memory of 1180	940	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	cmd.exe
PID 1180 wrote to memory of 852	1180	cmd.exe	choice.exe
PID 1180 wrote to memory of 852	1180	cmd.exe	choice.exe
PID 1180 wrote to memory of 852	1180	cmd.exe	choice.exe
PID 1180 wrote to memory of 852	1180	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe
"C:\Users\Admin\AppData\Local\Temp\b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Local\Temp\vbc.exe
C:\Users\Admin\AppData\Local\Temp\vbc.exe
2⤵
- Executes dropped EXE
PID:1056

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 5
3⤵
PID:852

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vbc.exe
Filesize
1.1MB

MD5
13e16c5885a2496a6da66535b125f5f8

SHA1
4600ee4dbb12d19d4552615863f4f1260404ae45

SHA256
b94d3bf5504160465039d0dcd15b64014c9a0b67f0dca4cefac3d6e19e187873

SHA512
d0fada8d95a25a5cb5a00dc9e39685cd7221abb8ca3a5474b7477faffbb2dd882b919f35df5ef27a65ce2722d22ba36d10e0960225f86027c1e2a22907f0cb34

Download Submit
\Users\Admin\AppData\Local\Temp\vbc.exe
Filesize
1.1MB

MD5
13e16c5885a2496a6da66535b125f5f8

SHA1
4600ee4dbb12d19d4552615863f4f1260404ae45

SHA256
b94d3bf5504160465039d0dcd15b64014c9a0b67f0dca4cefac3d6e19e187873

SHA512
d0fada8d95a25a5cb5a00dc9e39685cd7221abb8ca3a5474b7477faffbb2dd882b919f35df5ef27a65ce2722d22ba36d10e0960225f86027c1e2a22907f0cb34

Download Submit
memory/852-64-0x0000000000000000-mapping.dmp

Download
memory/940-54-0x0000000000C60000-0x0000000000E9C000-memory.dmp

Filesize
2.2MB

Download
memory/940-55-0x0000000004BE0000-0x0000000004D8C000-memory.dmp

Filesize
1.7MB

Download
memory/1056-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1056-58-0x0000000000404274-mapping.dmp

Download
memory/1056-61-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1056-62-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1056-65-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1180-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing