sodinokibi | 62a27299a63f16f14ab36532e5afc203f817df9eef94630a4873d35d8f685fbd

General

Target

92bfcee9c35d12182819cdbd8a0be9ff.exe
Size

92KB
MD5

92bfcee9c35d12182819cdbd8a0be9ff
SHA1

9df82000b77326f14e12e7ffcbcaba1fecb678f7
SHA256

62a27299a63f16f14ab36532e5afc203f817df9eef94630a4873d35d8f685fbd
SHA512

6418c2a9807d27a9d15e4a49e7da230ba241d2eaa29518de2186c13322f4b27763f4fcb29e23e5d7171d2f088c35cffaa4f0c8ce374fb0b7fd6dc50f0dac70b8
SSDEEP

1536:o73nkB0DyMgQSm9NwcKzwpR+7JICS4AR8ujGC:M/hKzstrZ

Score

10^/10

sodinokibi ransomware spyware stealer

Malware Config

Extracted

Path

C:\Recovery\j4el2e-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension j4el2e. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A15E6B5C7D1332C0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A15E6B5C7D1332C0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: MDcUzD6NngI+dBLNpRXTj3KTmh9/sswCM9hW128nUm2Gd1sBdHgTRxIL1bmAxmyM YactQjREgXt3VEUtnvgv6IORIArvLDo0hLLfpg1bvNMlbHZp9GPgmkPzvEd5FEij 3CAOZcsxFEljRwtgacua7YsGrWAcJJ8n+5JvOEo5o5wtLPjsqpkXEHcUAX9CEgnE OKjGds9VqehpfP6PMxiIMbwMbY/5VOqBi5cGklTirHE5cPl2NN+Krt7zzpgNK91V l40RbiwbGSCAvPwzqd+ow0582R5AGH9rpYTk2dPQGE/DfSvEbIy4gBB27f1zt2VY dXmuymVgiKG5aJBIPossDnstxpFpwmGpQ+hLoCNiHvn4TabZQkXCF/0Nd64GpXaL OtGRQj31AQ4WC8CED4Jxy6HQSzG3pyMH3dj1iefKTGWAvt2UWcChS/ACh85gyNFr uwNAdAgK9bCwrEWqHipMz+Ynagy3Sw0awe8dvmTpAtMDa1Ux3BQlfBrP8U3QvdHs +xnkeQRE25MJdwa7keY39NV0lrk/E37LQ5fOrr9PyGfVhZfyeZ3osIkOyDbphApi ul2lGV9Ar2oRtdo2e3CheSd3KeCrUwx4G4ePpFtyCcgjgrs4Da2xHizGEHKoVRCe 7qA6ZZT4LorfGAggnNpO81qBqJeolESUefogl9zRZMJ7maP2jTTeuuB4Av1MyQpl cinySVcAwPzGywsJ39P5P820EinykvqAW22VjN/MPAz1+bpML6lYNrAGredLYLYD 494Y9TlB5UvIevYarBcB59KG7lBJipYYBm7H0b6/OtiggokApu2vQsRFH9tMm0A+ ThJyeSBB2Eb9ULjySwZSTp5x4+bxT8UN5+w21Kx+o+nD8VsFSQoUASZ+F0G22A6b 0p3/3NjgsnusumapLN0TQTOJxoXFMHv+K8pX3ymY2lyijIug/JQnAR5ZozS2WLiT w0V7d5WYqeeMbFnZ57U8PXyKvzBRuaOjcxN77CPwBgoj14/0knhYLjfJFvAHSfRM SwkdnAFFkHsDitUrmO3EQgzayKTsBKzI9Lrno5f2dHO0M83qQ0PZ+WGkOqgJ4Lfy icjiRhWootdOkSDJOn/dqtIeVhCZkDbRUzN+uLF1l9yWYXYs4SSR6O37rZq6b9LQ RUVZvCoUgwUy/pvRD22UHuNotRe1o3Z8nb/gFFbpdrj/2GyTPcBmqnuwqIfaYCt5 07LPjo8gkIO7g5aeMmbJyVZV2rSG4XTNnnJnUK8slOSilvyXlAzYXzlkVK2y+4d0 e6S7uuPE83E91Sdo8ERhleo8OTGA+Sg2jesEuDrO+JNfQxL0jLt6GG7QASN9tl1W sUrGHR8MFzHuEl76Op7Cr6iIP4fnnOLK1zlTNQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A15E6B5C7D1332C0

http://decoder.re/A15E6B5C7D1332C0

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

92bfcee9c35d12182819cdbd8a0be9ff.exe

description	ioc	process
File opened (read-only)	\??\A:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\I:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\R:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\K:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\U:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\H:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\O:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\V:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\Y:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\G:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\B:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\J:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\N:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\F:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\M:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\P:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\Z:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\L:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\X:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\D:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\E:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\Q:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\S:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\T:	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened (read-only)	\??\W:	92bfcee9c35d12182819cdbd8a0be9ff.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

92bfcee9c35d12182819cdbd8a0be9ff.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37yyn6.bmp"	92bfcee9c35d12182819cdbd8a0be9ff.exe

Drops file in Program Files directory 18 IoCs

Processes:

92bfcee9c35d12182819cdbd8a0be9ff.exe

description	ioc	process
File opened for modification	\??\c:\program files\CheckpointSearch.xml	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\DismountLock.search-ms	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\InstallRemove.rmi	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\MountRestart.vssx	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\RestoreOpen.clr	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\TraceGet.mid	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\ApproveMerge.xlt	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\ClearSuspend.css	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\CompressGrant.ini	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\DisconnectBlock.tiff	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\OutOptimize.html	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\PingClear.vssm	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\RemoveRead.vsd	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\SavePublish.pdf	92bfcee9c35d12182819cdbd8a0be9ff.exe
File created	\??\c:\program files\j4el2e-readme.txt	92bfcee9c35d12182819cdbd8a0be9ff.exe
File created	\??\c:\program files (x86)\j4el2e-readme.txt	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\AddRemove.bmp	92bfcee9c35d12182819cdbd8a0be9ff.exe
File opened for modification	\??\c:\program files\RegisterDisable.xla	92bfcee9c35d12182819cdbd8a0be9ff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

92bfcee9c35d12182819cdbd8a0be9ff.exe

pid	process
3268	92bfcee9c35d12182819cdbd8a0be9ff.exe
3268	92bfcee9c35d12182819cdbd8a0be9ff.exe
3268	92bfcee9c35d12182819cdbd8a0be9ff.exe
3268	92bfcee9c35d12182819cdbd8a0be9ff.exe
3268	92bfcee9c35d12182819cdbd8a0be9ff.exe
3268	92bfcee9c35d12182819cdbd8a0be9ff.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

92bfcee9c35d12182819cdbd8a0be9ff.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3268	92bfcee9c35d12182819cdbd8a0be9ff.exe
Token: SeTakeOwnershipPrivilege	3268	92bfcee9c35d12182819cdbd8a0be9ff.exe
Token: SeBackupPrivilege	2908	vssvc.exe
Token: SeRestorePrivilege	2908	vssvc.exe
Token: SeAuditPrivilege	2908	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\92bfcee9c35d12182819cdbd8a0be9ff.exe
"C:\Users\Admin\AppData\Local\Temp\92bfcee9c35d12182819cdbd8a0be9ff.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:4648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\j4el2e-readme.txt

Filesize
6KB

MD5
9b8b2f35dae80a11112b6f2646ad1ec0

SHA1
13c72e9214ee8fa056e8fb5997d931f9b62d56b4

SHA256
82860562278eb2753a8ebfa115aab01b4838f11d6a9353e1d8dc8b370501f1d9

SHA512
fa8a3e969a8105cb844beb11f2e6ebd6f04f8ae875722cc3a2a3ff7acac97ddd23b2ade5f18dc63436194c8492f680989b09886da3e019e98b849eba0bc4f1f8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads