Resubmissions
07-08-2023 08:22
230807-j9kdzaed44 10Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07-08-2023 08:22
Behavioral task
behavioral1
Sample
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe
Resource
win10v2004-20230703-en
General
-
Target
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe
-
Size
160KB
-
MD5
b572a0486274ee9c0ba816c1b91b87c7
-
SHA1
43a904323a8583203b307c622c71c8ca706c2462
-
SHA256
15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b
-
SHA512
77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171
-
SSDEEP
3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg
Malware Config
Extracted
C:\ProgramData\ta1kr80c2-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6ED632DB0757E0A5
http://decryptor.top/6ED632DB0757E0A5
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Drops startup file 2 IoCs
Processes:
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ta1kr80c2-readme.txt 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File created \??\c:\users\admin\appdata\roaming\microsoft\word\startup\5c4c3ad0.lock 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exedescription ioc process File opened (read-only) \??\G: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\I: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\J: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\R: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\T: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\Z: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\D: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\B: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\K: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\M: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\Q: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\W: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\X: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\F: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\A: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\L: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\N: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\P: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\S: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\U: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\Y: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\E: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\H: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\O: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened (read-only) \??\V: 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tj03.bmp" 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe -
Drops file in Program Files directory 22 IoCs
Processes:
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exedescription ioc process File created \??\c:\program files (x86)\5c4c3ad0.lock 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\RedoUse.odt 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\UnblockClear.wmf 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File created \??\c:\program files\ta1kr80c2-readme.txt 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\ConvertToUnregister.wma 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\PushMove.css 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\UnlockConvertTo.mpg 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\ConfirmCopy.asp 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\FormatConvert.vsdx 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\OpenExpand.midi 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\OptimizeLimit.3gp2 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\OutLimit.snd 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\RestoreConvertFrom.docx 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\RemoveInitialize.xht 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\SendConvert.rm 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File created \??\c:\program files\5c4c3ad0.lock 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File created \??\c:\program files (x86)\ta1kr80c2-readme.txt 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\BlockDeny.ps1xml 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\GrantCompare.vbs 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\ImportExpand.gif 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\PublishImport.ADT 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe File opened for modification \??\c:\program files\TestStop.gif 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exepid process 3344 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe 3344 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exedescription pid process target process PID 3344 wrote to memory of 4072 3344 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe cmd.exe PID 3344 wrote to memory of 4072 3344 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe cmd.exe PID 3344 wrote to memory of 4072 3344 2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe"1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵PID:4072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ta1kr80c2-readme.txtFilesize
6KB
MD5f5e5565b7ef097f4e8ae2103a8d1baac
SHA110e1c4fb3f10795194f3a1cb9a5a0f1b0e7880f3
SHA256ea8f94f3a8955976ac984b6f2876a171cb95a164e604ecd99faaf12188c30c2a
SHA51250035d1a4d02949e1911974bdbbe3e398334f0641d707001b26effd1b5d891a315e6fea93b3b1959cc53396024a02ac1bf36338ccf8a9454fc8db0edd58243c8