sodinokibi | 514579601990c60bbd1df9ef2389f306f48cd639812b8a6bb4b5a1517c7374a9

General

Target

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
Size

160KB
MD5

b572a0486274ee9c0ba816c1b91b87c7
SHA1

43a904323a8583203b307c622c71c8ca706c2462
SHA256

15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b
SHA512

77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171
SSDEEP

3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg

Score

10^/10

sodinokibi ransomware

Malware Config

Extracted

Path

C:\ProgramData\c9284d0-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion c9284d0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9C2A53B498CBDDA2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9C2A53B498CBDDA2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8MsDlWwdR4sBvKbNfLhb2EodivYHdw+faB6oAsp/LRIko0BreQbGEOWPgim4hYIY sBfdsNqiIbwaA/1DD8BK3Bx5ulUDCJd5G6WZdMyP+TGfSRRUEIfGmoGlinFEcbLq nicoZ7i3KODwyY6ZerPTDTvKi2AitNXSBDtRbF0TQR5SJReRDh0D1FZlX/45lsmR iscME9qQQ1VP/+1pDl88MoyRdq6/+galGviYSRiL7DneW2EInIDCeh0Qaf5qQAWP oJj0rhES3wRwttwQJJ9NaTdDs5mEQaAFvH8PnTEbFmzRjAaAzUX3YRkxKxGBjrLv x/LOK4owCxEx8xNIS3gvdyFqQ86oBoABRRaKcWnPjVX0yYwcTjCIJJ01ReNAZ9Vg qGXgjr7DF0rPonYojvw9uheE8lgx0UXF7SzNfSzIukyL72wJPBM+MzJ5GUVbJ4iH XiufR3UR3RVH1Tsw6msjf+fAGlAhoqah8paS4aG87/AScxQA0Em/bdstd5qm6dCV UtBQ00Utr5ofTT5dQdGnK023xn8CVL0DSjHOArUVBgytaYBgr40lU/47wytSNafw aqWxDKJsoDyMkKp5JLBtl3OflVVohYTOQnUxnrCHR0vWpV2LFS27icD1lAUBdnT3 0D/QSsG2EgUaw6ZDGNAcI/+L/oq+8cV0fBk5yFw7QfGmnI8lZKS2xJ3qmEcK9+pf FLvWMKRNbRcOq4wdglZusfvk9sX2RWgrV1M66pcGMc8HWbfxn+ZqlprlCcXVHq97 c+l4dYsLM/tG4z97gGWljES6waWlr7kVHa/9sWPGna3VHCFtFPvwecKr4uaO/cCC 0Q1t+r7+1+Cj8mtDfAEl9ULfdr2f4WXPty63t5YQyst8k03+U4ZUaiZgUPJyy3Rj hqMlKaIqihUGLG7MP9AZjQD/Uk/qP1brn2FvPo+K8GtMW2SaKYa/FyWab29nWNog Tydt11DSmEad+zpqDpsPVOiuIPT6xmmkZk4tg4o8RuhWHGGN1X19zdYR21ZQEu4i EXsBAcU+WEmq2+vr/xXIEaYQef1l7wqZbLDc2ckYN1Kayk9DQooHLammMqiefovS gNpbmUPbgiUyWRt/defEpaKsmLWmC/nvUFnq7diljK29Oz+PFNPXI2TJKNK/Iuk+ hKqS0yoX/DO3Hf8HDJb5Pj1ueRja3Xd13K04Mi+bh5/W116bd2ZB2VhbEzcmqjYO n/+EZs7DLFtO4qG6074ong== Extension name: c9284d0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9C2A53B498CBDDA2

http://decryptor.top/9C2A53B498CBDDA2

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Drops startup file 2 IoCs

description	ioc	Process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\c9284d0-readme.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\5c4c3ad0.lock	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\S:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\V:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\X:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\M:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\N:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\Y:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\Z:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\B:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\J:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\P:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\Q:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\T:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\A:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\H:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\I:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\K:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\L:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\R:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\U:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\W:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\E:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\G:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\D:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened (read-only)	\??\F:	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kn14.bmp"	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\AddSend.jpe	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\EnableSend.doc	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\RestoreMerge.au	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\SplitPublish.vdx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\TraceSend.DVR	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\WatchClose.rm	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\program files (x86)\5c4c3ad0.lock	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\RevokeSet.dwg	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\SaveConvertTo.xsl	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\UseMount.search-ms	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\JoinClose.pptm	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\UnregisterUpdate.xsl	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\program files\5c4c3ad0.lock	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\program files (x86)\c9284d0-readme.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ApproveRevoke.emz	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ConvertToMeasure.svgz	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\DebugOpen.tif	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\HideExit.mpeg3	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File created	\??\c:\program files\c9284d0-readme.txt	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\ConvertFromResize.tiff	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\InvokePop.ADTS	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\JoinConnect.css	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\SkipComplete.xlsx	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
File opened for modification	\??\c:\program files\StepJoin.pptm	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1584	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
1584	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4528	1584	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe	82
PID 1584 wrote to memory of 4528	1584	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe	82
PID 1584 wrote to memory of 4528	1584	15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe	82

C:\Users\Admin\AppData\Local\Temp\15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe
"C:\Users\Admin\AppData\Local\Temp\15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\c9284d0-readme.txt

Filesize
6KB

MD5
3776e833ea0b43fe6d76a2843e578a8f

SHA1
c0f7728cb652af4f3ecd486276b97ab6466cf674

SHA256
722008db0bba5c08e221c93e0d82acc1bc5a4c8656274526645b3b45515ea119

SHA512
d6018fcda399e3d430b80eb2f25dfd8e103e7585dc66ee75feb60b0c6ba43945008d7a43d24731e5307af0524ce6a46247ff055bb3be3e2df650261e7bcfad60

Download Submit

Resubmissions

Analysis

Sharing