sodinokibi | 12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39

General

Target

12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
Size

120KB
MD5

2075566e7855679d66705741dabe82b4
SHA1

136443e2746558b403ae6fc9d9b40bfa92b23420
SHA256

12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39
SHA512

312dcb3d83a5201ef16c5027aabd8d7baebfd9761bf9514cafecc8a6936970b897b18b993e056d0f7aec81e6f0ab5756aa5efd3165e43f64692d5dbdb7423129
SSDEEP

1536:bjxXC9jVwbhEW8z3w1R+KjJLRiOQJo0SoLCdpuOk2ICS4Ang6lUgvfYiFyRFywX/:mmV1wKdLoLC/OemUWYjfywpbPa

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\Recovery\7eyi5ykf-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7eyi5ykf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F9E73F0C6C96925F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/F9E73F0C6C96925F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Jsam951KorNKbMaOUDjszOXsPuYz2MIgOUUjuVG5ablsUORvzAGt2/8vxxvVXka2 vihBMUeqy8RTwXNz+o+XAGr5NuNp9581dkkRLjSnMODVuxw+G9BrR7Jo0LjHAGUO f+Lk6rT1RRhuX+5XU4Pk04ncF6nFaHrtcnGRUreP62XeuU8yQxt7j/nkVmZXYOWQ /ltJM0KcfIbVosJPraLc0nrpV4ZMhUD/MknqMyeWKVWE4GCGukqDQk9nzkMvWBtX V9RrlbNf4jUzbcCoKFfaIxVcqm+at6Fr14SMCgPYLTYm4Xe/5HUuLTwcP4XucthK 8VC72cZr+rxkAJ9OeCPkhyCvCh6OgUvgSN9iY1/PKTdgZYeGgbtwS66eeFgDKzHD CcV+Bb4BDKAQEYuhLXMBlNmOK7/1QY7xrAwa1rI5cq1WhJeP3rlgJwR4DmU5LFeF L29PYxOIa2mDxhDOcLk1ZdHBuqQDW6IDQpghtpifolpGeO3LOhSATjl/HP5lFIUU Fw5iO8DbUEpxlXG5eUZft5iOs+Aku5+rRuMA8tzamN7EIIJp6FYqUV5rDR7JOLEn Mr4mxT1n9cfvBTn3zRnwHFPj+R/NSbWj1iMZP/fcHWIFUQs5SOoF+DcxZJECxBC+ 0ot5qCXPMKkHupDi/3PUxA2rEOflo5dCXWNPMcccnTukis/aItvs/gnp+9E6YSqb z+Ks9Dlvizjr3le3fl5dUMrsgW+qZ+3CMTOdLFItS+CHxsy4JjA8HTxXCyVxRLvM IB3mJPM8I3SjWCRbhKwdyxuHdHa3eLLaIFWwtga0cBHi6sNXaBmuuZJFBh7wgz8E NviXMcKMMFdr8T+IZbuyvgbxhKWCCULz4F3dJub+6MxUz9pMVt02zSUojsqK6YUb Zxghs0xr7fwZmpC0gLBnpiByAJlsw5zlILFCsaxGOLzMdaFa9eh9Wx9m9kTIEV/M NZWu0uq2EaHIfo7I06MNNaLwMzpE3s7VHxmhiXlgRGegFztpuN7EJZlRLj456pS9 i5iIbe815uVl42HQ1qg0lVfjcRrQPwSUhiEJc+pxHiIm6gXrnftFBzZ8xBfb0RYW bFTswazYgJsA2+VnoDJMZkHpHlJzoRSi7RBmdsMN9CiaBvO817XGtItV9Ddv2pXW xGI+jdAySVYmcdcGtagtQ8ZGFuzJkzmmCcmwVsaUhKZ+PKTPvf0pkJMRo9KJAVz5 wTaMfEwpgzOyQtdvXP7rY/AlYyq9xbtV1SYo/Zs0NtpENM7XpdROrJRt9JNYnuqM NxhBEMmsfVrtu5QzmZB+I4lU4NTmGIe+ ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F9E73F0C6C96925F

http://decoder.re/F9E73F0C6C96925F

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConvertFromBackup.png => \??\c:\users\admin\pictures\ConvertFromBackup.png.7eyi5ykf	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File renamed	C:\Users\Admin\Pictures\ProtectSearch.raw => \??\c:\users\admin\pictures\ProtectSearch.raw.7eyi5ykf	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\users\admin\pictures\ReadSearch.tiff	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File renamed	C:\Users\Admin\Pictures\ReadSearch.tiff => \??\c:\users\admin\pictures\ReadSearch.tiff.7eyi5ykf	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File renamed	C:\Users\Admin\Pictures\ExportRestore.raw => \??\c:\users\admin\pictures\ExportRestore.raw.7eyi5ykf	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File renamed	C:\Users\Admin\Pictures\GrantOut.tif => \??\c:\users\admin\pictures\GrantOut.tif.7eyi5ykf	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File renamed	C:\Users\Admin\Pictures\NewSend.raw => \??\c:\users\admin\pictures\NewSend.raw.7eyi5ykf	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File renamed	C:\Users\Admin\Pictures\OpenResolve.crw => \??\c:\users\admin\pictures\OpenResolve.crw.7eyi5ykf	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File renamed	C:\Users\Admin\Pictures\SelectBlock.tif => \??\c:\users\admin\pictures\SelectBlock.tif.7eyi5ykf	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

description	ioc	process
File opened (read-only)	\??\Z:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\D:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\B:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\T:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\G:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\N:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\P:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\S:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\A:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\F:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\I:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\K:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\Q:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\V:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\X:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\Y:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\E:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\H:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\M:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\O:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\R:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\U:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\W:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\J:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened (read-only)	\??\L:	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2u8nk98.bmp"	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

Drops file in Program Files directory 25 IoCs

Processes:

12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

description	ioc	process
File opened for modification	\??\c:\program files\DismountUse.ttf	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\HideGet.pcx	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\InstallDismount.odt	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\ResizeWrite.zip	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\ConvertToRepair.pub	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\CopyInstall.mov	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\MountFormat.ppsm	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\RegisterRename.001	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\ResetSwitch.wvx	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\ResumeCheckpoint.potm	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\EditConvertFrom.png	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\LockMeasure.htm	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\OptimizeBackup.xls	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\ShowGet.jtx	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\StartOut.bmp	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\RemoveSelect.mp2v	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\RenameBackup.xltm	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File created	\??\c:\program files\7eyi5ykf-readme.txt	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File created	\??\c:\program files (x86)\7eyi5ykf-readme.txt	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\ExportFind.avi	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\InitializeDeny.wvx	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\JoinCopy.3gp	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\NewSet.xht	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\StepExit.xml	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
File opened for modification	\??\c:\program files\WriteInvoke.m1v	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

pid	process
3776	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
3776	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
3776	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
3776	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3776	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
Token: SeTakeOwnershipPrivilege	3776	12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
Token: SeBackupPrivilege	2160	vssvc.exe
Token: SeRestorePrivilege	2160	vssvc.exe
Token: SeAuditPrivilege	2160	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe
"C:\Users\Admin\AppData\Local\Temp\12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\7eyi5ykf-readme.txt
1⤵
PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\7eyi5ykf-readme.txt
Filesize
7KB

MD5
8886f6300acc0b8ef38e65e7f2e46d4c

SHA1
0c2fd427dacc9dd65b3018b45aae8ae560e6db48

SHA256
838de35e1cf3c6743380295dd6d8529502c6e0f0f84f025f7faf5062dffa8435

SHA512
c36ce448fc36aa696b2f5beb77240a67f29833c9cf95ce7d6bb22f08cfd5aac100d7bc1591071ebc015805e2991535492ce1460881f8d5ef745c57b7badb8c8b

Download Submit
C:\Users\Admin\Desktop\7eyi5ykf-readme.txt
Filesize
7KB

MD5
8886f6300acc0b8ef38e65e7f2e46d4c

SHA1
0c2fd427dacc9dd65b3018b45aae8ae560e6db48

SHA256
838de35e1cf3c6743380295dd6d8529502c6e0f0f84f025f7faf5062dffa8435

SHA512
c36ce448fc36aa696b2f5beb77240a67f29833c9cf95ce7d6bb22f08cfd5aac100d7bc1591071ebc015805e2991535492ce1460881f8d5ef745c57b7badb8c8b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads