sodinokibi | f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554

Reason

Machine shutdown

General

Target

v2.exe
Size

121KB
MD5

944ed18066724dc6ca3fb3d72e4b9bdf
SHA1

1a19c8793cd783a5bb89777f5bc09e580f97ce29
SHA256

74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
SHA512

a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3
SSDEEP

1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\9oo2ne1s7-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9oo2ne1s7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/18E4DE1A3746FDBC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/18E4DE1A3746FDBC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 28qvZweCiecAApGOdz1r6TGWw27QhxmcMNlGnVofmCWvWZ0MhnKCiA7yTlofmqnd 9/1T69yCiIyQGWn+lKPoRwjKv4IVd93dU1LUfUpBwcyRfi5CMXas1ZY5hJKeXsNd pSE64Lh84I+VV+0OQTkecQ8xuz/1TNzlMD8s4eiXO1GlR59xq92IjD8df/7YbFg6 tc7Q2j/R/vfabKbcrT9ffszPmyeFZ0T7bYoNN5Q42RDdMjXGcKfjuGTRGMzPrcvo VmOrmXxK9p0WgSp5C0UKjRvYwUnVYewVOmHEG19jQ/J0bXR8ylMvpR3dYuUXmH// MmNUlite9dqRqxk4Uzw5lVH2kYIoreIaxBZ+6b7iEdKOFC1/+m7cUpw9DQIeeImx J1fFbOhdNluYZ48r5lhxeF+xA5rcwn+2WkebDljCeyi9Q6nIFtT4bb7Sg2pQCyRK N4xW37rMwI62ljFgkKq3YPfESvbCxHuVZY8hYokdM+UxILykL2jHKDKdsDV4mjR/ isTuJ7W+iaw36L9OqmNHC4LYtHqio5Bfyh5a6k1ItjQcRZenSrmIhLrnxoTjNz5B NErhnlhLhwAohYbvGmGxGKmBasCWY3JteKW6BP2rRJ6Re92yWRTBt7KJTmxy8FCz b8bFutUCOBG2IqdayBg9/W45mGbHIW3+nlydaYqE9AA5FXn32fsII6J/Fvb4Zcv4 qFBDXlUak/idf0xIR5AL/UT6zT8igFvGwgi/JCnL9HZDLAiyfK9V/dWC30ZHAoTd KBRMgpxwrQhEjTv8x/XMJ0fEFpohE4u+JiAdgWU1tY2Q1lCzpgjlD6gFRbcInESj TUgjD0aOHJGXSnaoOmJyUF7knmyuHavzxjT8jFNKLlubcCpYMRkDQ7kmhcaY6bLP Gpx7qYlBtUghJAygc+E81/HLNWw+FkIT/tFWzvTIOVMcUb6Pywr7vTKbPH8PRsvz KrQylRubc2RHMzJvxFW3gJZyqqgEDkvIbPy1j9awuUSO/ogXrrBusUqGdb7yfzdW h7HtTwpGJU/hZJu5SXPPzyJmef+h3PMuiTQD8aYvn7hSt3XcWHGrx6/d0oatcrDB SAemxpbApt6Gwlk8OKxNWvB3TaA996YXF4SMc0L9Zh5lKmLYBZlPZDaVET7Nivch EgCyC5jFcnHbiHdE1Qm6CJtguV21xw1xIsPxI6OPDmvXf2qxCyo4n2QfRBDOTZ+R 7ZwEKdjvm+3C5VGGZ8nrysI/8o7QPiuVUqBpjnzXttrkQ5isoHHhPWOl9UfxFfaO 4OdzPcu5j/eO2G8f/v6EEmSy7mdhk52CHe+t16ft+2I6RvgXEMQLccBvbyliUg6L ygPzHT0P96yyI015Y0vQttp+uIAJsSzv3iZmlJafJUjbxg== ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/18E4DE1A3746FDBC

http://decoder.re/18E4DE1A3746FDBC

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Drops startup file 1 IoCs

Processes:

v2.exe

description ioc process

File created \??\c:\users\admin\appdata\roaming\microsoft\word\startup\9oo2ne1s7-readme.txt v2.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\9oo2ne1s7-readme.txt	v2.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

v2.exe

description	ioc	process
File opened (read-only)	\??\K:	v2.exe
File opened (read-only)	\??\L:	v2.exe
File opened (read-only)	\??\N:	v2.exe
File opened (read-only)	\??\O:	v2.exe
File opened (read-only)	\??\T:	v2.exe
File opened (read-only)	\??\X:	v2.exe
File opened (read-only)	\??\E:	v2.exe
File opened (read-only)	\??\J:	v2.exe
File opened (read-only)	\??\R:	v2.exe
File opened (read-only)	\??\V:	v2.exe
File opened (read-only)	\??\Y:	v2.exe
File opened (read-only)	\??\A:	v2.exe
File opened (read-only)	\??\H:	v2.exe
File opened (read-only)	\??\U:	v2.exe
File opened (read-only)	\??\Z:	v2.exe
File opened (read-only)	\??\Q:	v2.exe
File opened (read-only)	\??\S:	v2.exe
File opened (read-only)	\??\I:	v2.exe
File opened (read-only)	\??\M:	v2.exe
File opened (read-only)	\??\P:	v2.exe
File opened (read-only)	\??\W:	v2.exe
File opened (read-only)	\??\F:	v2.exe
File opened (read-only)	\??\B:	v2.exe
File opened (read-only)	\??\G:	v2.exe

Drops file in Program Files directory 32 IoCs

Processes:

v2.exe

description	ioc	process
File opened for modification	\??\c:\program files\RemoveRepair.svgz	v2.exe
File opened for modification	\??\c:\program files\SearchDebug.docx	v2.exe
File opened for modification	\??\c:\program files\DenyRestart.potm	v2.exe
File opened for modification	\??\c:\program files\GroupDisable.asp	v2.exe
File opened for modification	\??\c:\program files\LimitEnter.contact	v2.exe
File opened for modification	\??\c:\program files\PopRedo.docx	v2.exe
File opened for modification	\??\c:\program files\ProtectShow.jpe	v2.exe
File opened for modification	\??\c:\program files\ResetConnect.asp	v2.exe
File opened for modification	\??\c:\program files\TestDisconnect.vstm	v2.exe
File opened for modification	\??\c:\program files\SearchRevoke.mhtml	v2.exe
File opened for modification	\??\c:\program files\SwitchSend.pptx	v2.exe
File created	\??\c:\program files (x86)\9oo2ne1s7-readme.txt	v2.exe
File opened for modification	\??\c:\program files\PublishUnregister.css	v2.exe
File opened for modification	\??\c:\program files\HideEdit.m1v	v2.exe
File opened for modification	\??\c:\program files\PingUndo.jpeg	v2.exe
File opened for modification	\??\c:\program files\SubmitPing.midi	v2.exe
File created	\??\c:\program files\9oo2ne1s7-readme.txt	v2.exe
File opened for modification	\??\c:\program files\ExportPush.cr2	v2.exe
File opened for modification	\??\c:\program files\FindResolve.dib	v2.exe
File opened for modification	\??\c:\program files\GrantInstall.avi	v2.exe
File opened for modification	\??\c:\program files\LimitSwitch.mpeg2	v2.exe
File opened for modification	\??\c:\program files\RenameMount.ADT	v2.exe
File opened for modification	\??\c:\program files\SwitchClear.edrwx	v2.exe
File opened for modification	\??\c:\program files\UnblockResume.3gp2	v2.exe
File opened for modification	\??\c:\program files\FindRedo.mp4v	v2.exe
File opened for modification	\??\c:\program files\GetEnter.m1v	v2.exe
File opened for modification	\??\c:\program files\ImportConfirm.mhtml	v2.exe
File opened for modification	\??\c:\program files\InitializeRevoke.svgz	v2.exe
File opened for modification	\??\c:\program files\NewFind.M2TS	v2.exe
File opened for modification	\??\c:\program files\OutRemove.contact	v2.exe
File opened for modification	\??\c:\program files\PublishTest.mpeg	v2.exe
File opened for modification	\??\c:\program files\SplitSet.htm	v2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "178"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

v2.exe

pid process

4044 v2.exe
4044 v2.exe

pid	process
4044	v2.exe
4044	v2.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

v2.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4044	v2.exe
Token: SeTakeOwnershipPrivilege	4044	v2.exe
Token: SeBackupPrivilege	2644	vssvc.exe
Token: SeRestorePrivilege	2644	vssvc.exe
Token: SeAuditPrivilege	2644	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

5612 LogonUI.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

pid	process
5612	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\v2.exe
"C:\Users\Admin\AppData\Local\Temp\v2.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2460

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2928

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\9oo2ne1s7-readme.txt
1⤵
PID:5808

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ba055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\9oo2ne1s7-readme.txt
Filesize
7KB

MD5
1062d5e4d8e1a7b514d54e8a8c7aa0b3

SHA1
eeef9d89b49db8c66d025619ef9e317afa5d721c

SHA256
354f46699eec221d0c4f15481fdc6d1b12020f06a9512ea5fac2be615c0102c9

SHA512
8de0b187a58c0a793003e098a65470e02ec405d9f67d87570af49be046cdd995cdeb4c357d18fd3581bb2c3dc3426449194cca3546907f0b463019d218fc0eee

Download Submit
C:\Users\Admin\Downloads\9oo2ne1s7-readme.txt
Filesize
7KB

MD5
1062d5e4d8e1a7b514d54e8a8c7aa0b3

SHA1
eeef9d89b49db8c66d025619ef9e317afa5d721c

SHA256
354f46699eec221d0c4f15481fdc6d1b12020f06a9512ea5fac2be615c0102c9

SHA512
8de0b187a58c0a793003e098a65470e02ec405d9f67d87570af49be046cdd995cdeb4c357d18fd3581bb2c3dc3426449194cca3546907f0b463019d218fc0eee

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads