sodinokibi | 15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b

General

Target

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
Size

160KB
MD5

b572a0486274ee9c0ba816c1b91b87c7
SHA1

43a904323a8583203b307c622c71c8ca706c2462
SHA256

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b
SHA512

77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171
SSDEEP

3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\ProgramData\1ogzdt-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 1ogzdt. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/483F7F5F49E3BAD3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/483F7F5F49E3BAD3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8yCxvrUElyo0jZtdpfPFvGqAZvPD/RI3Jxn3ujVUO1WB/aXbZQEYUBumU0dcNtaE sSbwRhXfpz4W4qWih64ECAoHB7F/ZyqynT2Csq1jqR7wVpOp2rNLjOXTo/DH42Rg IX0SaPo7Mrig0+fCg28DPHi2xYkQhD3D7lTn4NvsZbi/OrBv7l2tVENXUVbSpTq3 nX+igFqlynNWO9wVINFhAIXyIf9+zqhG2U2C6iAJkpvQ59x8arSEQNzvtEr9xfOy 1pQ7U9ixVy46Ha6/g4fEQhTzv+IJPo/Pg9cTMY/8iMBJeHl5veTZ6Hgl5DxFNpUv iAfSvv7yK0xlLK0NTo+gpSbrlK6Q37dbB6xPKnp2L7FNocc+Aul/T1ksewjopInG jx3jRW/VIXVr2ZRzDOqmWK+ddJXo7sckzmF/+RCe98mt+c43m1pdaWWzVBt0wZCl jtJOtXBCDT3R1D/l7FkDi/TejmlGNVwlsjBZLNAApe0YIrk7ZiXkkIlvTTCFqVIY meMlsb2I5IKx1Y35/oG7WSNiGHC24XMcrEKy1Z8K+mI1hiPE9HWZznVlnUomMXLN XHeWtMPDouP9ZQBHplX7V2nsVVcW1bPBK/2sF0924/UwILWxiTSj4MKBpZx4dVnl Jvrc7SI+wMLO7ycZO4oZMvADfs1v87Bb6z3/8z7YJ1xgsalTAE/qNqqT03kpEwhm R82BpAu9EthUUpDEHmudTQHZLgzD3IeB4lNeT23mJN7UVlL4FjgWKCTnc8G6hhAO JXVm/jbei/1ToB3k9+JiXHvYiNSZLuG4op/LnT+xUYO/peWfsTKUGGEr9Kyd/hcP 3uTDu1tfj4Mjf7xQ0nFxqKeYhHtPcZIxXkHHU6uTtyirU3L0y6VUE3nzoYApzZCD O0hB7yTVEumIw8bVuOLAN+Mt0eOLIYD4Ol/+5LWEGgdGVglphb2mIEp9PVhYz2QE 70cQgDCeftgqZKQC7LR8q4cm4UrPTK+PF995Ql7j07QPXDyyJ5fviHZinq9ABO9d +Py+wChBjHV/FHZaAsbx0BayruYkBSKxMmLFvuTQ+8N6SRkE2poMbGBd3/BNEb0R 4xCasH8QVUPYQ0xbJRve+qhMHqL/X3PzwuD5HTfY8D1SiiXImXzJ6x/vzVv9Z78f IVJ3tBMZrzRluvMnc84EIptU/5N4jqBFGCglMb9x6lpGhQH15h6N3K1QM9KaCKnN xBm8CUVssavwVamdvaA= Extension name: 1ogzdt ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/483F7F5F49E3BAD3

http://decryptor.top/483F7F5F49E3BAD3

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Drops startup file 2 IoCs

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\1ogzdt-readme.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\5c4c3ad0.lock	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

description	ioc	process
File opened (read-only)	\??\P:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\Q:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\W:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\A:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\B:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\G:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\J:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\K:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\X:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\O:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\S:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\V:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\E:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\H:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\I:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\L:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\M:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\R:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\T:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\Y:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\D:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\F:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\N:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\U:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened (read-only)	\??\Z:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6q6202hu05ol.bmp"	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

Drops file in Program Files directory 35 IoCs

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

description	ioc	process
File created	\??\c:\program files (x86)\1ogzdt-readme.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File created	\??\c:\program files (x86)\5c4c3ad0.lock	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\CompressResolve.mp4	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\ConnectUnblock.ADTS	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\RequestUnregister.mpeg	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\ResizeInitialize.eps	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\SelectEnable.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\DisconnectConvertFrom.xlt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\FormatProtect.asx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\GrantInvoke.wps	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\RestartConvertFrom.mpe	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\StepAdd.docx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\EnterExpand.ppsx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\ResizeResume.3gp2	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\RestartNew.bmp	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\SearchWrite.xlsx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File created	\??\c:\program files\5c4c3ad0.lock	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\CompareMeasure.php	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\ConvertFromRequest.odt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\EditUndo.xla	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\WaitSearch.easmx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\ClearSet.MTS	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\CompressWait.xls	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\ExportSet.wdp	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\RemoveSuspend.zip	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\DismountEdit.zip	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\OptimizeProtect.docm	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\SplitClose.WTV	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File created	\??\c:\program files\1ogzdt-readme.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\BlockDisconnect.docm	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\LimitConvertFrom.mov	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\SuspendHide.aif	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\WriteExport.ttc	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\ClearCompress.wps	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
File opened for modification	\??\c:\program files\LimitRead.aiff	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

pid	process
2804	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
2804	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

description	pid	process	target process
PID 2804 wrote to memory of 4676	2804	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe	cmd.exe
PID 2804 wrote to memory of 4676	2804	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe	cmd.exe
PID 2804 wrote to memory of 4676	2804	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\1ogzdt-readme.txt

Filesize
6KB

MD5
4c9b65cf2d53803502527f7a42b992ae

SHA1
ce0d401a076d67321844cd30622e78677c13a77c

SHA256
dabf7d945612f6adc5e53678153cd5c8fd472176ce779083901763de023a2122

SHA512
9ef82ea935395616506fb706de0053d76a9f2c359c71285ef848bc123ae3e1d618085a6b541f5a65bc71a14ec2ac5a972fb0d5fbecd4f8252fd0426cc8225590

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads